@stage-labs/metro 0.1.0-beta.2 → 0.1.0-beta.21

package/runtime/node_modules/@metro-labs/mcp/src/db/connector-config.ts

@@ -0,0 +1,147 @@
+import { ApiError } from '../daemon/api-error.js';
+import type {
+  ConnectorAuth,
+  VerifiedRecord,
+  VerifiedServer,
+} from '../daemon/connector-verify.js';
+import { readStoredTools } from '../daemon/connector-tools.js';
+
+const CONNECTOR_NAME_MAX = 64;
+const HEADER_NAME_RE = /^[A-Za-z0-9!#$%&'*+.^_`|~-]{1,64}$/;
+const HEADER_VALUE_RE = /^[\x20-\x7e]{1,4096}$/;
+const DEFAULT_HEADER = 'Authorization';
+
+export class ConnectorError extends ApiError {}
+
+export type ConnectorSignIn = 'connected' | 'disconnected' | null;
+
+export interface ConnectorConfig {
+  auth: ConnectorAuth;
+  createdAt: string;
+  verified: VerifiedRecord;
+  oauth: boolean;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function text(value: unknown): string {
+  return typeof value === 'string' ? value : '';
+}
+
+function hasControlChar(value: string): boolean {
+  for (const ch of value) {
+    const code = ch.codePointAt(0) ?? 0;
+    if (code < 0x20 || code === 0x7f) return true;
+  }
+  return false;
+}
+
+export function connectorName(raw: unknown): string {
+  const name = typeof raw === 'string' ? raw.trim() : '';
+  if (name === '') throw new ConnectorError('a connector needs a name', 400);
+  if (name.length > CONNECTOR_NAME_MAX)
+    throw new ConnectorError(
+      `a connector name must be ${String(CONNECTOR_NAME_MAX)} characters or fewer`,
+      400,
+    );
+  if (hasControlChar(name))
+    throw new ConnectorError(
+      'a connector name must not contain control characters',
+      400,
+    );
+  return name;
+}
+
+export function connectorAuth(
+  rawHeader: unknown,
+  rawValue: unknown,
+): ConnectorAuth {
+  const header = text(rawHeader).trim();
+  const value = text(rawValue).trim();
+  if (header === '' && value === '') return { kind: 'none' };
+  if (value === '')
+    throw new ConnectorError(
+      'that header has no value — give both a header name and its value, or neither',
+      400,
+    );
+  const name = header === '' ? DEFAULT_HEADER : header;
+  if (!HEADER_NAME_RE.test(name))
+    throw new ConnectorError('that is not a valid HTTP header name', 400);
+  if (!HEADER_VALUE_RE.test(value))
+    throw new ConnectorError('that header value is not sendable', 400);
+  return { kind: 'header', name, value };
+}
+
+function readOAuth(raw: Record<string, unknown>): ConnectorAuth {
+  const accessToken = text(raw.accessToken);
+  const clientId = text(raw.clientId);
+  const tokenEndpoint = text(raw.tokenEndpoint);
+  if (accessToken === '' || clientId === '' || tokenEndpoint === '')
+    return { kind: 'none' };
+  const refreshToken = text(raw.refreshToken);
+  const clientSecret = text(raw.clientSecret);
+  return {
+    kind: 'oauth',
+    accessToken,
+    clientId,
+    tokenEndpoint,
+    issuer: text(raw.issuer),
+    ...(refreshToken === '' ? {} : { refreshToken }),
+    ...(clientSecret === '' ? {} : { clientSecret }),
+    ...(typeof raw.expiresAt === 'number' ? { expiresAt: raw.expiresAt } : {}),
+  };
+}
+
+function readAuth(raw: unknown): ConnectorAuth {
+  if (!isRecord(raw)) return { kind: 'none' };
+  if (raw.kind === 'oauth') return readOAuth(raw);
+  if (raw.kind !== 'header') return { kind: 'none' };
+  const name = text(raw.name);
+  const value = text(raw.value);
+  if (name === '' || value === '') return { kind: 'none' };
+  return { kind: 'header', name, value };
+}
+
+function readVerified(raw: unknown): VerifiedRecord {
+  const record = isRecord(raw) ? raw : {};
+  const catalog = readStoredTools(record.catalog);
+  return {
+    at: text(record.at),
+    server: text(record.server),
+    version: text(record.version),
+    protocol: text(record.protocol),
+    icon: text(record.icon),
+    tools: typeof record.tools === 'number' ? record.tools : 0,
+    catalog,
+  };
+}
+
+export function readConfig(raw: unknown): ConnectorConfig {
+  const record = isRecord(raw) ? raw : {};
+  const auth = readAuth(record.auth);
+  return {
+    auth,
+    createdAt: text(record.createdAt),
+    verified: readVerified(record.verified),
+    oauth: record.oauth === true || auth.kind === 'oauth',
+  };
+}
+
+export function signInState(config: ConnectorConfig): ConnectorSignIn {
+  if (config.auth.kind === 'oauth') return 'connected';
+  return config.oauth ? 'disconnected' : null;
+}
+
+export function stamp(server: VerifiedServer): VerifiedRecord {
+  return {
+    at: new Date().toISOString(),
+    server: server.server,
+    version: server.version,
+    protocol: server.protocol,
+    icon: server.icon,
+    tools: server.tools,
+    catalog: server.catalog,
+  };
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/connectors.ts

@@ -0,0 +1,329 @@
+import { assertRenameFreeOfClash } from './connector-collections.js';
+import { projectIdOrThrow } from './projects.js';
+import { and, asc, eq, inArray } from 'drizzle-orm';
+import {
+  connectorUrlText,
+  ConnectorVerifyError,
+  parseConnectorUrl,
+  verifyRemoteMcp,
+  type ConnectorAuth,
+  type OAuthAuth,
+  type VerifiedRecord,
+} from '../daemon/connector-verify.js';
+import { oauthExpired, refreshOAuth } from '../daemon/connector-oauth.js';
+import { advertisesOAuth } from '../daemon/oauth-discovery.js';
+import {
+  ConnectorError,
+  connectorAuth,
+  connectorName,
+  readConfig,
+  signInState,
+  stamp,
+  type ConnectorConfig,
+  type ConnectorSignIn,
+} from './connector-config.js';
+import { errMsg, log } from '../daemon/log.js';
+import { newId } from './ids.js';
+import { getDb } from './client.js';
+import { connectors, type ConnectorTransport } from './schema.js';
+
+export interface Connector {
+  id: string;
+  name: string;
+  url: string;
+  transport: ConnectorTransport;
+  auth: ConnectorAuth['kind'];
+  header: string | null;
+  secret: string | null;
+  bearer: string | null;
+  expiresAt: number | null;
+  signIn: ConnectorSignIn;
+  verified: VerifiedRecord;
+}
+
+export interface ConnectorInput {
+  name: unknown;
+  url: unknown;
+  header: unknown;
+  value: unknown;
+}
+
+export type ConnectorCheck =
+  | { id: string; name: string; ok: true; verified: VerifiedRecord }
+  | { id: string; name: string; ok: false; reason: string };
+
+export interface DeletedConnector {
+  id: string;
+  name: string;
+}
+
+type ConnectorRow = typeof connectors.$inferSelect;
+
+function toConnector(row: ConnectorRow): Connector {
+  const config = readConfig(row.config);
+  const auth = config.auth;
+  return {
+    id: row.id,
+    name: row.name,
+    url: row.url,
+    transport: row.transport,
+    auth: auth.kind,
+    header: auth.kind === 'header' ? auth.name : null,
+    secret: auth.kind === 'header' ? auth.value : null,
+    bearer: auth.kind === 'oauth' ? auth.accessToken : null,
+    expiresAt: auth.kind === 'oauth' ? (auth.expiresAt ?? null) : null,
+    signIn: signInState(config),
+    verified: config.verified,
+  };
+}
+
+const missing = (): ConnectorError =>
+  new ConnectorError('no such connector', 404);
+
+async function ownedConnectorOrThrow(
+  email: string,
+  id: string,
+): Promise<ConnectorRow> {
+  const rows = await getDb()
+    .select()
+    .from(connectors)
+    .where(eq(connectors.id, id));
+  const row = rows[0];
+  if (row === undefined) throw missing();
+  try {
+    await projectIdOrThrow(email, row.projectId);
+  } catch {
+    throw missing();
+  }
+  return row;
+}
+
+async function saveConfig(
+  row: ConnectorRow,
+  config: ConnectorConfig,
+): Promise<Connector> {
+  const rows = await getDb()
+    .update(connectors)
+    .set({ config })
+    .where(and(eq(connectors.id, row.id), eq(connectors.projectId, row.projectId)))
+    .returning();
+  const saved = rows[0];
+  if (saved === undefined) throw missing();
+  return toConnector(saved);
+}
+
+async function connectorRowsFor(
+  email: string,
+  project: string,
+): Promise<ConnectorRow[]> {
+  const projectId = await projectIdOrThrow(email, project);
+  return getDb()
+    .select()
+    .from(connectors)
+    .where(eq(connectors.projectId, projectId))
+    .orderBy(asc(connectors.id));
+}
+
+export async function listConnectorsForEmail(
+  email: string,
+  project: string,
+): Promise<Connector[]> {
+  return (await connectorRowsFor(email, project)).map(toConnector);
+}
+
+async function withFreshToken(row: ConnectorRow): Promise<Connector> {
+  const config = readConfig(row.config);
+  if (config.auth.kind !== 'oauth' || !oauthExpired(config.auth))
+    return toConnector(row);
+  const url = parseConnectorUrl(row.url);
+  const auth = await refreshOAuth(config.auth, url.toString());
+  return saveConfig(row, { ...config, auth });
+}
+
+async function rowsByIds(ids: string[]): Promise<ConnectorRow[]> {
+  if (ids.length === 0) return [];
+  return getDb()
+    .select()
+    .from(connectors)
+    .where(inArray(connectors.id, ids))
+    .orderBy(asc(connectors.id));
+}
+
+export async function listFreshConnectorsByIds(
+  ids: string[],
+): Promise<Connector[]> {
+  const rows = await rowsByIds(ids);
+  return Promise.all(
+    rows.map(async (row) =>
+      withFreshToken(row).catch((err: unknown) => {
+        log.warn(
+          { id: row.id, err: errMsg(err) },
+          'connectors: could not refresh the access token',
+        );
+        return toConnector(row);
+      }),
+    ),
+  );
+}
+
+export async function getConnectorForEmail(
+  email: string,
+  id: string,
+): Promise<Connector> {
+  return toConnector(await ownedConnectorOrThrow(email, id));
+}
+
+async function insertConnector(
+  projectId: string,
+  name: string,
+  url: URL,
+  config: ConnectorConfig,
+): Promise<Connector> {
+  const rows = await getDb()
+    .insert(connectors)
+    .values({
+      id: newId(),
+      projectId,
+      name,
+      url: connectorUrlText(url),
+      transport: 'http',
+      config,
+    })
+    .returning();
+  const row = rows[0];
+  if (row === undefined)
+    throw new ConnectorError('connector insert returned no row', 500);
+  return toConnector(row);
+}
+
+const UNVERIFIED = {
+  at: '',
+  server: '',
+  version: '',
+  protocol: '',
+  icon: '',
+  tools: 0,
+  catalog: [],
+};
+
+export async function createPendingConnectorForEmail(
+  email: string,
+  project: string,
+  input: { name: unknown; url: unknown },
+): Promise<Connector> {
+  const name = connectorName(input.name);
+  const url = parseConnectorUrl(input.url);
+  const projectId = await projectIdOrThrow(email, project);
+  return insertConnector(projectId, name, url, {
+    auth: { kind: 'none' },
+    createdAt: new Date().toISOString(),
+    verified: UNVERIFIED,
+    oauth: true,
+  });
+}
+
+export async function createConnectorForEmail(
+  email: string,
+  project: string,
+  input: ConnectorInput,
+): Promise<Connector> {
+  const name = connectorName(input.name);
+  const url = parseConnectorUrl(input.url);
+  const auth = connectorAuth(input.header, input.value);
+  const projectId = await projectIdOrThrow(email, project);
+  const verified = stamp(await verifyRemoteMcp(url, auth));
+  return insertConnector(projectId, name, url, {
+    auth,
+    createdAt: new Date().toISOString(),
+    verified,
+    oauth: await oauthCapable(url, auth),
+  });
+}
+
+async function oauthCapable(url: URL, auth: ConnectorAuth): Promise<boolean> {
+  if (auth.kind === 'oauth') return true;
+  if (auth.kind === 'header') return false;
+  return advertisesOAuth(url);
+}
+
+async function freshAuth(
+  auth: ConnectorAuth,
+  resource: string,
+): Promise<ConnectorAuth> {
+  if (auth.kind !== 'oauth' || !oauthExpired(auth)) return auth;
+  return refreshOAuth(auth, resource);
+}
+
+export async function reconnectConnectorForEmail(
+  email: string,
+  id: string,
+  auth: OAuthAuth,
+): Promise<Connector> {
+  const row = await ownedConnectorOrThrow(email, id);
+  const config = readConfig(row.config);
+  const url = parseConnectorUrl(row.url);
+  const verified = stamp(await verifyRemoteMcp(url, auth));
+  return saveConfig(row, { ...config, auth, verified, oauth: true });
+}
+
+export async function disconnectConnectorForEmail(
+  email: string,
+  id: string,
+): Promise<Connector> {
+  const row = await ownedConnectorOrThrow(email, id);
+  const config = readConfig(row.config);
+  if (config.auth.kind !== 'oauth')
+    throw new ConnectorError('that connector is not signed in', 400);
+  return saveConfig(row, { ...config, auth: { kind: 'none' }, oauth: true });
+}
+
+export async function verifyConnectorForEmail(
+  email: string,
+  id: string,
+): Promise<ConnectorCheck> {
+  const row = await ownedConnectorOrThrow(email, id);
+  const config = readConfig(row.config);
+  try {
+    const url = parseConnectorUrl(row.url);
+    const auth = await freshAuth(config.auth, url.toString());
+    const verified = stamp(await verifyRemoteMcp(url, auth));
+    const oauth = config.oauth || (await oauthCapable(url, auth));
+    await saveConfig(row, { ...config, auth, verified, oauth });
+    return { id: row.id, name: row.name, ok: true, verified };
+  } catch (err) {
+    if (!(err instanceof ConnectorVerifyError)) throw err;
+    return { id: row.id, name: row.name, ok: false, reason: err.message };
+  }
+}
+
+export async function renameConnectorForEmail(
+  email: string,
+  id: string,
+  raw: string,
+): Promise<Connector> {
+  const name = connectorName(raw);
+  const row = await ownedConnectorOrThrow(email, id);
+  await assertRenameFreeOfClash(row.id, name);
+  const rows = await getDb()
+    .update(connectors)
+    .set({ name })
+    .where(and(eq(connectors.id, row.id), eq(connectors.projectId, row.projectId)))
+    .returning();
+  const saved = rows[0];
+  if (saved === undefined) throw missing();
+  return toConnector(saved);
+}
+
+export async function deleteConnectorForEmail(
+  email: string,
+  id: string,
+): Promise<DeletedConnector> {
+  const row = await ownedConnectorOrThrow(email, id);
+  const gone = await getDb()
+    .delete(connectors)
+    .where(eq(connectors.id, row.id))
+    .returning({ id: connectors.id, name: connectors.name });
+  const deleted = gone[0];
+  if (deleted === undefined) throw missing();
+  return deleted;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/ids.ts

@@ -0,0 +1,19 @@
+import { randomBytes } from 'node:crypto';
+
+const ID_BYTES = 8;
+const REROLLS = 16;
+
+export const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{10}$/;
+
+export function newId(): string {
+  for (let attempt = 0; attempt < REROLLS; attempt += 1) {
+    const id = randomBytes(ID_BYTES).toString('base64url');
+    if (ID_RE.test(id)) return id;
+  }
+  throw new Error('could not generate an id');
+}
+
+export function parseId(raw: unknown): string | null {
+  if (typeof raw !== 'string') return null;
+  return ID_RE.test(raw) ? raw : null;
+}

package/runtime/node_modules/@metro-labs/mcp/src/db/key-map.ts

@@ -0,0 +1,45 @@
+import { createHash } from 'node:crypto';
+import { ID_RE } from './ids.js';
+
+const digest = (token: string): string =>
+  createHash('sha256').update(token).digest('hex');
+
+let agentIdByKeyHash = new Map<string, string>();
+
+export interface KeyOwner {
+  key: string;
+  agentId: string;
+}
+
+const usable = (e: KeyOwner): boolean =>
+  e.key !== '' && ID_RE.test(e.agentId);
+
+export function setKeyMap(entries: KeyOwner[]): void {
+  agentIdByKeyHash = new Map(
+    entries.filter(usable).map((e) => [digest(e.key), e.agentId]),
+  );
+}
+
+export function registerKey(key: string, agentId: string): void {
+  if (!usable({ key, agentId })) return;
+  agentIdByKeyHash.set(digest(key), agentId);
+}
+
+export function unregisterAgentKey(agentId: string): void {
+  for (const [hash, id] of agentIdByKeyHash)
+    if (id === agentId) agentIdByKeyHash.delete(hash);
+}
+
+export function rotateAgentKey(agentId: string, key: string | null): void {
+  unregisterAgentKey(agentId);
+  if (key !== null) registerKey(key, agentId);
+}
+
+export function agentIdForKey(token: string): string | undefined {
+  if (token === '') return undefined;
+  return agentIdByKeyHash.get(digest(token));
+}
+
+export function hasAnyKey(): boolean {
+  return agentIdByKeyHash.size > 0;
+}