@unchainedshop/api 4.0.0-rc.2 → 4.0.0-rc.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unchainedshop/api",
-  "version": "4.0.0-rc.2",
+  "version": "4.0.0-rc.4",
   "main": "lib/api-index.js",
   "types": "lib/api-index.d.ts",
   "type": "module",
@@ -32,16 +32,22 @@
   "homepage": "https://github.com/unchainedshop/unchained#readme",
   "peerDependencies": {
     "@ethereumjs/util": ">= 10 < 11",
-    "@fastify/cookie": ">= 11.0 < 12",
-    "@fastify/session": ">= 11.0 < 12",
-    "connect-mongo": ">= 5.1.0 < 6",
-    "express": ">= 5.0 < 6",
-    "express-session": ">= 1.18 < 2",
     "fastify": ">= 5.2 < 6",
-    "graphql-yoga": ">= 5.9 < 6.0",
+    "@fastify/cookie": ">= 11 < 12",
+    "@fastify/session": ">= 11 < 12",
+    "@fastify/multipart": ">= 9 < 10",
+    "connect-mongo": ">= 5.1 < 6",
+    "@modelcontextprotocol/sdk": ">= 1 < 2",
+    "express": ">= 5 < 6",
+    "express-session": ">= 1.18 < 2",
+    "multer": ">= 2 < 3",
+    "graphql-yoga": ">= 5.9 < 6",
     "passport": ">= 0.7 < 1"
   },
   "peerDependenciesMeta": {
+    "@modelcontextprotocol/sdk": {
+      "optional": false
+    },
     "graphql-yoga": {
       "optional": false
     },
@@ -51,9 +57,15 @@
     "@ethereumjs/util": {
       "optional": true
     },
+    "fastify": {
+      "optional": true
+    },
     "@fastify/cookie": {
       "optional": true
     },
+    "@fastify/multipart": {
+      "optional": true
+    },
     "@fastify/session": {
       "optional": true
     },
@@ -63,7 +75,7 @@
     "express-session": {
       "optional": true
     },
-    "fastify": {
+    "multer": {
       "optional": true
     },
     "passport": {
@@ -71,29 +83,33 @@
     }
   },
   "dependencies": {
-    "@unchainedshop/core": "^4.0.0-rc.2",
-    "@unchainedshop/events": "^4.0.0-rc.2",
-    "@unchainedshop/logger": "^4.0.0-rc.2",
-    "@unchainedshop/roles": "^4.0.0-rc.2",
-    "@unchainedshop/utils": "^4.0.0-rc.2",
+    "@unchainedshop/core": "^4.0.0-rc.4",
+    "@unchainedshop/events": "^4.0.0-rc.4",
+    "@unchainedshop/logger": "^4.0.0-rc.4",
+    "@unchainedshop/roles": "^4.0.0-rc.4",
+    "@unchainedshop/utils": "^4.0.0-rc.4",
     "accounting": "0.4.1",
     "dataloader": "^2.2.3",
     "expiry-map": "^2.0.0",
     "graphql-scalars": "^1.24.2",
     "moniker": "0.1.2",
-    "p-memoize": "^7.1.1"
+    "p-memoize": "^7.1.1",
+    "zod": "^3.25.67"
   },
   "devDependencies": {
     "@ethereumjs/util": "^10.0.0",
+    "fastify": "^5.4.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/session": "^11.1.0",
-    "@types/express": "^5.0.1",
-    "@types/node": "^22.15.3",
+    "@fastify/multipart": "^9.0.3",
+    "@modelcontextprotocol/sdk": "^1.13.1",
+    "@types/express": "^5.0.3",
+    "@types/node": "^24.0.4",
     "express": "^5.1.0",
     "express-session": "^1.18.1",
-    "fastify": "^5.3.2",
+    "multer": "^2.0.1",
     "passport": "^0.7.0",
-    "tsx": "^4.19.4",
+    "tsx": "^4.20.3",
     "typescript": "^5.8.3"
   }
 }

package/src/api-index.ts

@@ -38,7 +38,10 @@ export const startAPIServer = async (options: UnchainedServerOptions) => {
     ...serverOptions
   } = options || {};
 
-  const contextResolver = createContextResolver(unchainedAPI, { roles, adminUiConfig });
+  const contextResolver = createContextResolver(unchainedAPI, {
+    roles,
+    adminUiConfig,
+  });
 
   setCurrentContextResolver(
     customContext

package/src/errors.ts

@@ -40,6 +40,11 @@ export const ProductWrongTypeError = createError(
   'The current type of the product does not allow this operation',
 );
 
+export const ProductVariationInfinityLoop = createError(
+  'ProductInfinityLoop',
+  'Assigning the proxy to itself as child in product assignments is not allowed, this would create an infinite loop',
+);
+
 export const AssortmentNotFoundError = createError('AssortmentNotFoundError', 'Assortment not found');
 
 export const AssortmentFilterNotFoundError = createError(
@@ -178,10 +183,6 @@ export const MultipleBookmarksFound = createError(
   'The convenience bookmark mutation cannot be used because multiple bookmarks were explicitly created with different metadata',
 );
 
-export const QueryStringRequiredError = createError(
-  'QueryStringRequiredError',
-  'Query string is required when no assortments are in scope',
-);
 export const PaymentProviderNotFoundError = createError(
   'PaymentProviderNotFoundError',
   'Payment provider not found',

package/src/express/createMCPMiddleware.ts

@@ -0,0 +1,91 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import createMcpServer from '../mcp/index.js';
+import { Request, RequestHandler } from 'express';
+import { Context } from '../context.js';
+
+// Map to store transports by session ID
+const transports: Record<string, StreamableHTTPServerTransport> = {};
+
+const handlePostRequest: RequestHandler = async (req: Request & { unchainedContext: Context }, res) => {
+  // Check for existing session ID
+
+  const sessionId = req.headers['mcp-session-id'] as string | undefined;
+
+  let transport: StreamableHTTPServerTransport;
+
+  if (sessionId && transports[sessionId]) {
+    // Reuse existing transport
+    transport = transports[sessionId];
+  } else if (!sessionId && isInitializeRequest(req.body)) {
+    // New initialization request
+    transport = new StreamableHTTPServerTransport({
+      sessionIdGenerator: () => crypto.randomUUID(),
+      onsessioninitialized: (sessionId) => {
+        // Store the transport by session ID
+        transports[sessionId] = transport;
+      },
+    });
+
+    // Clean up transport when closed
+    transport.onclose = () => {
+      if (transport.sessionId) {
+        delete transports[transport.sessionId];
+      }
+    };
+
+    const roles = req.unchainedContext.user.roles || [];
+    const server = createMcpServer(req.unchainedContext, roles);
+    await server.connect(transport);
+  } else {
+    // Invalid request
+    res.status(400).json({
+      jsonrpc: '2.0',
+      error: {
+        code: -32000,
+        message: 'Bad Request: No valid session ID provided',
+      },
+      id: null,
+    });
+    return;
+  }
+
+  // Handle the request
+  await transport.handleRequest(req, res, req.body);
+};
+
+// Reusable handler for GET and DELETE requests
+const handleSessionRequest: RequestHandler = async (req, res) => {
+  const sessionId = req.headers['mcp-session-id'] as string | undefined;
+  if (!sessionId || !transports[sessionId]) {
+    res.status(400).send('Invalid or missing session ID');
+    return;
+  }
+
+  const transport = transports[sessionId];
+  await transport.handleRequest(req, res);
+};
+
+const createMCPMiddleware: RequestHandler = (req, res, next) => {
+  if (!(req as any).unchainedContext.user) {
+    res.status(401);
+    res.header(
+      'WWW-Authenticate',
+      `Bearer realm="Unchained MCP", error="invalid_token", resource="${process.env.ROOT_URL || 'http://localhost:4010'}",`,
+    );
+    res.json({
+      error: 'invalid_token',
+      resource_metadata: `${process.env.ROOT_URL || 'http://localhost:4010'}/.well-known/oauth-protected-resource`,
+    });
+    return;
+  }
+
+  if (req.method === 'POST') {
+    return handlePostRequest(req, res, next);
+  } else if (req.method === 'GET' || req.method === 'DELETE') {
+    return handleSessionRequest(req, res, next);
+  }
+  res.status(405).send('Method Not Allowed');
+};
+
+export default createMCPMiddleware;

package/src/express/createTempUploadMiddleware.ts

@@ -0,0 +1,60 @@
+import { createLogger } from '@unchainedshop/logger';
+import { checkAction } from '../acl.js';
+import { actions } from '../roles/index.js';
+import { Context } from '../context.js';
+import { getFileAdapter } from '@unchainedshop/core-files';
+
+const logger = createLogger('unchained:temp-upload');
+
+const methodWrongHandler = (res) => {
+  logger.error('Method not supported, return 404');
+  res.writeHead(404);
+  res.end();
+  return;
+};
+
+export default async function tempUploadMiddleware(
+  req: Request & { query?: any; files: any; unchainedContext: Context },
+  res,
+) {
+  try {
+    const context = req.unchainedContext;
+
+    if (req.method !== 'POST') {
+      return methodWrongHandler(res);
+    }
+
+    await checkAction(context, (actions as any).uploadTempFile);
+
+    const [data] = req.files || [];
+
+    const file = await context.services.files.uploadFileFromStream({
+      directoryName: 'temp-uploads',
+      rawFile: {
+        filename: data.originalname,
+        buffer: data.buffer,
+        mimetype: data.mimetype,
+      },
+      meta: { fieldname: data.fieldname, encoding: data.encoding },
+    });
+
+    // Add an expiration date to this file manually!
+    const expires = new Date(Date.now() + 24 * 60 * 60 * 1000);
+    await context.modules.files.update(file._id, {
+      expires, // Default to 1 hour
+    });
+
+    const fileUploadAdapter = getFileAdapter();
+    const rawUrl = await fileUploadAdapter.createDownloadURL(file);
+    const url = context.modules.files.normalizeUrl(rawUrl, {});
+    const body = JSON.stringify({ fileId: file._id, url, expires: expires.toISOString() });
+
+    res.writeHead(200);
+    res.end(body);
+  } catch (e) {
+    logger.error(e.message);
+    res.writeHead(503);
+    res.end(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+    return;
+  }
+}

package/src/express/index.ts

@@ -1,17 +1,21 @@
 import e from 'express';
-import { getCurrentContextResolver, LoginFn, LogoutFn } from '../context.js';
-import createBulkImportMiddleware from './createBulkImportMiddleware.js';
-import createERCMetadataMiddleware from './createERCMetadataMiddleware.js';
 import session from 'express-session';
+import multer from 'multer';
 import MongoStore from 'connect-mongo';
 import { Passport } from 'passport';
 import { YogaServerInstance } from 'graphql-yoga';
 import { mongodb } from '@unchainedshop/mongodb';
 import { UnchainedCore } from '@unchainedshop/core';
 import { emit } from '@unchainedshop/events';
-import { API_EVENTS } from '../events.js';
 import { User } from '@unchainedshop/core-users';
 
+import { getCurrentContextResolver, LoginFn, LogoutFn } from '../context.js';
+import createBulkImportMiddleware from './createBulkImportMiddleware.js';
+import createERCMetadataMiddleware from './createERCMetadataMiddleware.js';
+import createTempUploadMiddleware from './createTempUploadMiddleware.js';
+import createMCPMiddleware from './createMCPMiddleware.js';
+import { API_EVENTS } from '../events.js';
+
 const resolveUserRemoteAddress = (req: e.Request) => {
   const remoteAddress =
     (req.headers['x-real-ip'] as string) ||
@@ -23,9 +27,14 @@ const resolveUserRemoteAddress = (req: e.Request) => {
   return { remoteAddress, remotePort };
 };
 
+const storage = multer.memoryStorage();
+const upload = multer({ storage: storage });
+
 const {
   BULK_IMPORT_API_PATH = '/bulk-import',
   ERC_METADATA_API_PATH = '/erc-metadata',
+  TEMP_UPLOAD_API_PATH = '/temp-upload',
+  MCP_API_PATH = '/mcp',
   GRAPHQL_API_PATH = '/graphql',
   UNCHAINED_COOKIE_NAME = 'unchained_token',
   UNCHAINED_COOKIE_PATH = '/',
@@ -126,10 +135,16 @@ export const connect = (
   {
     graphqlHandler,
     db,
-  }: { graphqlHandler: YogaServerInstance<any, any>; db: mongodb.Db; unchainedAPI: UnchainedCore },
+  }: {
+    graphqlHandler: YogaServerInstance<any, any>;
+    db: mongodb.Db;
+    unchainedAPI: UnchainedCore;
+  },
   {
     allowRemoteToLocalhostSecureCookies = false,
-  }: { allowRemoteToLocalhostSecureCookies?: boolean } = {},
+  }: {
+    allowRemoteToLocalhostSecureCookies?: boolean;
+  } = {},
 ) => {
   if (allowRemoteToLocalhostSecureCookies) {
     // Workaround: Allow to use sandbox with localhost
@@ -137,6 +152,16 @@ export const connect = (
     expressApp.use((req, res, next) => {
       req.headers['x-forwarded-proto'] = 'https';
       res.setHeader('Access-Control-Allow-Private-Network', 'true');
+      res.setHeader('Access-Control-Allow-Origin', req.headers.origin || '*');
+      res.setHeader('Access-Control-Allow-Credentials', 'true');
+      res.setHeader(
+        'Access-Control-Allow-Methods',
+        ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'].join(', '),
+      );
+      res.setHeader(
+        'Access-Control-Allow-Headers',
+        req.headers['access-control-request-headers'] || '*',
+      );
       next();
     });
   }
@@ -189,4 +214,8 @@ export const connect = (
   expressApp.use(GRAPHQL_API_PATH, graphqlHandler.handle);
   expressApp.use(ERC_METADATA_API_PATH, createERCMetadataMiddleware);
   expressApp.use(BULK_IMPORT_API_PATH, createBulkImportMiddleware);
+  expressApp.use(TEMP_UPLOAD_API_PATH, upload.any(), createTempUploadMiddleware);
+
+  expressApp.use(MCP_API_PATH, e.json({ limit: '10mb' }));
+  expressApp.use(MCP_API_PATH, createMCPMiddleware);
 };

package/src/fastify/index.ts

@@ -10,8 +10,11 @@ import { API_EVENTS } from '../events.js';
 import { User } from '@unchainedshop/core-users';
 import fastifySession from '@fastify/session';
 import fastifyCookie from '@fastify/cookie';
+import fastifyMultipart from '@fastify/multipart';
 import { FastifyBaseLogger, FastifyInstance, FastifyRequest } from 'fastify';
 import { createLogger } from '@unchainedshop/logger';
+import mcpHandler from './mcpHandler.js';
+import tempUploadHandler from './tempUploadHandler.js';
 
 const resolveUserRemoteAddress = (req: FastifyRequest) => {
   const remoteAddress =
@@ -25,8 +28,10 @@ const resolveUserRemoteAddress = (req: FastifyRequest) => {
 };
 
 const {
+  MCP_API_PATH = '/mcp',
   GRAPHQL_API_PATH = '/graphql',
   BULK_IMPORT_API_PATH = '/bulk-import',
+  TEMP_UPLOAD_API_PATH = '/temp-upload',
   ERC_METADATA_API_PATH = '/erc-metadata/:productId/:localeOrTokenFilename/:tokenFileName?',
   UNCHAINED_COOKIE_NAME = 'unchained_token',
   UNCHAINED_COOKIE_PATH = '/',
@@ -112,7 +117,11 @@ export const connect = (
   {
     graphqlHandler,
     db,
-  }: { graphqlHandler: YogaServerInstance<any, any>; db: mongodb.Db; unchainedAPI: UnchainedCore },
+  }: {
+    graphqlHandler: YogaServerInstance<any, any>;
+    db: mongodb.Db;
+    unchainedAPI: UnchainedCore;
+  },
   {
     allowRemoteToLocalhostSecureCookies = false,
   }: { allowRemoteToLocalhostSecureCookies?: boolean } = {},
@@ -123,9 +132,13 @@ export const connect = (
     fastify.addHook('preHandler', async function (request) {
       request.headers['x-forwarded-proto'] = 'https';
     });
-    fastify.addHook('onSend', async function (_, reply) {
+    fastify.addHook('onSend', async function (req, reply) {
       reply.headers({
         'Access-Control-Allow-Private-Network': 'true',
+        'Access-Control-Allow-Origin': req.headers.origin || '*',
+        'Access-Control-Allow-Credentials': 'true',
+        'Access-Control-Allow-Methods': ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'].join(', '),
+        'Access-Control-Allow-Headers': req.headers['access-control-request-headers'] || '*',
       });
     });
   }
@@ -190,6 +203,23 @@ export const connect = (
     handler: ercMetadataHandler,
   });
 
+  fastify.route({
+    url: MCP_API_PATH,
+    method: ['GET', 'POST', 'DELETE'],
+    handler: mcpHandler,
+  });
+
+  fastify.register((s, opts, registered) => {
+    s.register(fastifyMultipart);
+    s.route({
+      url: TEMP_UPLOAD_API_PATH,
+      method: ['POST'],
+      bodyLimit: 1024 * 1024 * 35, // 35MB
+      handler: tempUploadHandler,
+    });
+    registered();
+  });
+
   fastify.register((s, opts, registered) => {
     s.removeAllContentTypeParsers();
     s.addContentTypeParser('*', function (req, payload, done) {

package/src/fastify/mcpHandler.ts

@@ -0,0 +1,97 @@
+import { createLogger } from '@unchainedshop/logger';
+import { Context } from '../context.js';
+import { FastifyRequest, RouteHandlerMethod } from 'fastify';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
+import createMcpServer from '../mcp/index.js';
+
+const logger = createLogger('unchained:mcp-handler');
+
+const transports: Record<string, StreamableHTTPServerTransport> = {};
+
+const mcpHandler: RouteHandlerMethod = async (
+  req: FastifyRequest & { unchainedContext: Context },
+  res,
+) => {
+  if (!req.unchainedContext.user) {
+    res.status(401);
+    res.header(
+      'WWW-Authenticate',
+      `Bearer realm="Unchained MCP", error="invalid_token", resource="${process.env.ROOT_URL || 'http://localhost:4010'}",`,
+    );
+    return res.send(
+      JSON.stringify({
+        error: 'invalid_token',
+        resource_metadata: `${process.env.ROOT_URL || 'http://localhost:4010'}/.well-known/oauth-protected-resource`,
+      }),
+    );
+  }
+
+  try {
+    if (req.method === 'POST') {
+      const sessionId = req.headers['mcp-session-id'] as string | undefined;
+
+      let transport: StreamableHTTPServerTransport;
+
+      if (sessionId && transports[sessionId]) {
+        // Reuse existing transport
+        transport = transports[sessionId];
+      } else if (!sessionId && isInitializeRequest(req.body)) {
+        // New initialization request
+        transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: () => crypto.randomUUID(),
+          onsessioninitialized: (sessionId) => {
+            // Store the transport by session ID
+            transports[sessionId] = transport;
+          },
+        });
+
+        // Clean up transport when closed
+        transport.onclose = () => {
+          if (transport.sessionId) {
+            delete transports[transport.sessionId];
+          }
+        };
+
+        const roles = req.unchainedContext.user.roles || [];
+        const server = createMcpServer(req.unchainedContext, roles);
+        await server.connect(transport);
+      } else {
+        // Invalid request
+        res.status(400);
+        return res.send(
+          JSON.stringify({
+            jsonrpc: '2.0',
+            error: {
+              code: -32000,
+              message: 'Bad Request: No valid session ID provided',
+            },
+            id: null,
+          }),
+        );
+      }
+
+      await transport.handleRequest(req.raw, res.raw, req.body);
+      return res;
+    } else if (req.method === 'GET' || req.method === 'DELETE') {
+      const sessionId = req.headers['mcp-session-id'] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send('Invalid or missing session ID');
+        return;
+      }
+
+      const transport = transports[sessionId];
+      await transport.handleRequest(req.raw, res.raw);
+      return res;
+    }
+
+    res.status(405);
+    return res.send('Method Not Allowed');
+  } catch (e) {
+    logger.error(e.message);
+    res.status(503);
+    return res.send(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+  }
+};
+
+export default mcpHandler;

package/src/fastify/tempUploadHandler.ts

@@ -0,0 +1,52 @@
+import { createLogger } from '@unchainedshop/logger';
+import { getFileAdapter } from '@unchainedshop/core-files';
+import { checkAction } from '../acl.js';
+import { actions } from '../roles/index.js';
+import { Context } from '../context.js';
+import { FastifyRequest, RouteHandlerMethod } from 'fastify';
+
+const logger = createLogger('unchained:temp-upload');
+
+const tempUploadHandler: RouteHandlerMethod = async (
+  req: FastifyRequest & { file: any; unchainedContext: Context },
+  res,
+) => {
+  try {
+    const context = req.unchainedContext;
+
+    await checkAction(context, (actions as any).uploadTempFile);
+
+    const data = await req.file();
+
+    const file = await context.services.files.uploadFileFromStream({
+      directoryName: 'temp-uploads',
+      rawFile: Promise.resolve({
+        filename: data.filename,
+        createReadStream: () => data.file,
+        mimetype: data.mimetype,
+      }),
+      meta: { fieldname: data.fieldname, encoding: data.encoding },
+    });
+
+    // Add an expiration date to this file manually!
+    const expires = new Date(Date.now() + 24 * 60 * 60 * 1000);
+    await context.modules.files.update(file._id, {
+      expires, // Default to 1 hour
+    });
+
+    const fileUploadAdapter = getFileAdapter();
+    const rawUrl = await fileUploadAdapter.createDownloadURL(file);
+    const url = context.modules.files.normalizeUrl(rawUrl, {});
+    const body = JSON.stringify({ fileId: file._id, url, expires: expires.toISOString() });
+    res.status(200);
+    res.header('Content-Length', Buffer.byteLength(body));
+    res.header('Content-Type', 'application/json');
+    return res.send(body);
+  } catch (e) {
+    logger.error(e.message);
+    res.status(503);
+    return res.send(JSON.stringify({ name: e.name, code: e.code, message: e.message }));
+  }
+};
+
+export default tempUploadHandler;

package/src/loaders/assortmentMediaTextLoader.ts

@@ -1,8 +1,8 @@
 import { UnchainedCore } from '@unchainedshop/core';
 import { AssortmentMediaText } from '@unchainedshop/core-assortments';
 import DataLoader from 'dataloader';
-import { buildLocaleMap } from './utils.js';
 import buildTextMap from './buildTextMap.js';
+import buildLocaleMap from './buildLocaleMap.js';
 
 export default (unchainedAPI: UnchainedCore) =>
   new DataLoader<{ assortmentMediaId: string; locale: Intl.Locale }, AssortmentMediaText>(

package/src/loaders/assortmentTextLoader.ts

@@ -1,8 +1,8 @@
 import { UnchainedCore } from '@unchainedshop/core';
 import { AssortmentText } from '@unchainedshop/core-assortments';
 import DataLoader from 'dataloader';
-import { buildLocaleMap } from './utils.js';
 import buildTextMap from './buildTextMap.js';
+import buildLocaleMap from './buildLocaleMap.js';
 
 export default (unchainedAPI: UnchainedCore) =>
   new DataLoader<{ assortmentId: string; locale: Intl.Locale }, AssortmentText>(async (queries) => {