@unchainedshop/api 5.0.0-alpha.2 → 5.0.0-alpha.4

package/lib/chat/utils.js

@@ -1,3 +1,14 @@
+import { createLogger } from '@unchainedshop/logger';
+import { isPeerNotInstalledError } from "../utils/optionalPeerError.js";
+const logger = createLogger('unchained:api:chat');
+export const logOptionalPeerLoadError = (packageName, error) => {
+    if (isPeerNotInstalledError(packageName, error)) {
+        logger.warn(`optional peer npm package '${packageName}' not installed, chat will not work`);
+    }
+    else {
+        logger.error(`failed to load '${packageName}'`, error);
+    }
+};
 let NoSuchToolError;
 let InvalidArgumentError;
 try {
@@ -8,9 +19,9 @@ try {
 catch {
 }
 export const errorHandler = (error) => {
-    if (NoSuchToolError.isInstance(error))
+    if (NoSuchToolError?.isInstance(error))
         return 'NoSuchToolError';
-    if (InvalidArgumentError.isInstance(error))
+    if (InvalidArgumentError?.isInstance(error))
         return 'InvalidToolArgumentsError';
     if (error?.message?.toLowerCase()?.includes('forbidden'))
         return 'NetworkError';
@@ -18,6 +29,47 @@ export const errorHandler = (error) => {
         return 'LimitExceeded';
     return `Failed to stream response: ${error?.message || 'Unknown error'}`;
 };
+export const chatErrorStatus = (error) => error?.statusCode === 503 ? 503 : 500;
+export const createChatRequestLifecycle = (response, configuredSignal) => {
+    const disconnectController = new AbortController();
+    const signal = configuredSignal
+        ? AbortSignal.any([configuredSignal, disconnectController.signal])
+        : disconnectController.signal;
+    let clientClose;
+    let closing;
+    const detach = () => {
+        response.off('close', abortOnDisconnect);
+        signal.removeEventListener('abort', closeAfterAbort);
+    };
+    const close = async () => {
+        detach();
+        if (!clientClose)
+            return;
+        closing ??= clientClose();
+        await closing;
+    };
+    const closeAfterAbort = () => {
+        void close().catch((error) => logger.error('Failed to close MCP chat client', error));
+    };
+    const abortOnDisconnect = () => {
+        if (!response.writableFinished && !disconnectController.signal.aborted) {
+            disconnectController.abort(new Error('Chat HTTP client disconnected'));
+        }
+    };
+    response.once('close', abortOnDisconnect);
+    signal.addEventListener('abort', closeAfterAbort, { once: true });
+    if (signal.aborted)
+        queueMicrotask(closeAfterAbort);
+    return {
+        signal,
+        setClientClose(closeClient) {
+            clientClose = closeClient;
+            if (signal.aborted)
+                closeAfterAbort();
+        },
+        close,
+    };
+};
 export const categorizeTools = (toolName) => {
     const name = toolName.toLowerCase();
     if (name.includes('product'))

package/lib/createGraphQLServer.js

@@ -1,5 +1,7 @@
 import { createLogger } from '@unchainedshop/logger';
 import { createYoga, createSchema, } from 'graphql-yoga';
+import { useEngine } from '@envelop/core';
+import { parse, validate, specifiedRules, execute, subscribe } from 'graphql';
 const logger = createLogger('unchained:api');
 export default async (options) => {
     const schema = 'schema' in options
@@ -15,6 +17,10 @@ export default async (options) => {
             return ctx.req?.unchainedContext;
         },
         ...options,
+        plugins: [
+            useEngine({ parse, validate, specifiedRules, execute, subscribe }),
+            ...(options.plugins ?? []),
+        ],
     });
     return server;
 };

package/lib/express/chatHandler.js

@@ -1,36 +1,36 @@
 import express from 'express';
-import { errorHandler } from "../chat/utils.js";
+import { chatErrorStatus, createChatRequestLifecycle, errorHandler, logOptionalPeerLoadError, } from "../chat/utils.js";
 import generateImageHandler from "../chat/generateImageHandler.js";
 import defaultSystemPrompt from "../chat/defaultSystemPrompt.js";
 import normalizeToolsIndex from "../chat/normalizeToolsIndex.js";
+import { buildChatResourceContext } from "../mcp/resources/localization.js";
 import { createLogger } from '@unchainedshop/logger';
 const logger = createLogger('unchained:api:chat');
 let convertToModelMessages;
 let stepCountIs;
 let streamText;
 let createMCPClient;
-let StreamableHTTPClientTransport;
-let Client;
 try {
     const aiTools = await import('ai');
-    const mcpTools = await import('@ai-sdk/mcp');
-    const mcpSDKClientLibrary = await import('@modelcontextprotocol/sdk/client/streamableHttp.js');
-    const mcpSDKClient = await import('@modelcontextprotocol/sdk/client/index.js');
-    StreamableHTTPClientTransport = mcpSDKClientLibrary.StreamableHTTPClientTransport;
-    Client = mcpSDKClient.Client;
     convertToModelMessages = aiTools.convertToModelMessages;
     stepCountIs = aiTools.stepCountIs;
     streamText = aiTools.streamText;
+}
+catch (error) {
+    logOptionalPeerLoadError('ai', error);
+}
+try {
+    const mcpTools = await import('@ai-sdk/mcp');
     createMCPClient = mcpTools.createMCPClient;
 }
-catch {
-    logger.warn(`optional peer npm packages 'ai', '@ai-sdk/mcp' and '@modelcontextprotocol/sdk' not installed, chat will not work`);
+catch (error) {
+    logOptionalPeerLoadError('@ai-sdk/mcp', error);
 }
 const setupMCPChatHandler = (chatConfiguration) => {
     if (!chatConfiguration || !chatConfiguration.model) {
         throw new Error('Model is required');
     }
-    const { tools: additionalTools = {}, unchainedMCPUrl = `${process.env.ROOT_URL}/mcp`, model, imageGenerationTool, ...restChatConfig } = chatConfiguration;
+    const { tools: additionalTools = {}, unchainedMCPUrl = `${process.env.ROOT_URL}/mcp`, model, imageGenerationTool, abortSignal: configuredAbortSignal, onAbort: configuredOnAbort, onEnd: configuredOnEnd, onFinish: configuredOnFinish, ...restChatConfig } = chatConfiguration;
     const system = chatConfiguration.system ?? defaultSystemPrompt;
     const mcpChatHandler = async (req, res) => {
         if (req.method === 'OPTIONS') {
@@ -43,50 +43,33 @@ const setupMCPChatHandler = (chatConfiguration) => {
             res.status(405).json({ error: 'Method Not Allowed. Use POST.' });
             return;
         }
-        const resourceTransport = new StreamableHTTPClientTransport(new URL(unchainedMCPUrl), {
-            requestInit: {
-                headers: {
-                    Cookie: req.headers.cookie || '',
-                },
-            },
-        });
-        const sdkClient = new Client({ name: 'unchained-chat-client', version: '1.0.0' });
-        await sdkClient.connect(resourceTransport);
-        const transport = new StreamableHTTPClientTransport(new URL(unchainedMCPUrl), {
-            requestInit: {
-                headers: {
-                    Cookie: req.headers.cookie || '',
-                },
-            },
-        });
-        const client = await createMCPClient({
-            transport,
-        });
+        const unchainedContext = req.unchainedContext;
+        const user = unchainedContext?.user;
+        if (!user) {
+            res.status(401).json({ error: 'unauthorized' });
+            return;
+        }
+        if (!(user.roles || []).includes('admin')) {
+            res.status(403).json({ error: 'forbidden', message: 'Chat requires admin privileges' });
+            return;
+        }
+        let client;
+        const lifecycle = createChatRequestLifecycle(res, configuredAbortSignal);
         try {
+            client = await createMCPClient({
+                transport: {
+                    type: 'http',
+                    url: unchainedMCPUrl,
+                    headers: {
+                        Cookie: req.headers.cookie || '',
+                        ...(req.headers.authorization ? { Authorization: req.headers.authorization } : {}),
+                    },
+                },
+                initializationOptions: { signal: lifecycle.signal },
+            });
+            lifecycle.setClientClose(() => client.close());
             const defaultUnchainedTools = await client.tools();
-            let resourceContext = '';
-            try {
-                const resources = await sdkClient.listResources();
-                if (resources?.resources) {
-                    const resourceTexts = await Promise.all(resources.resources.map(async (resource) => {
-                        try {
-                            const content = await sdkClient.readResource({ uri: resource.uri });
-                            if (content?.contents?.[0]?.text) {
-                                return `${resource.name}:\n${content.contents[0].text}`;
-                            }
-                        }
-                        catch (e) {
-                            logger.error(`Failed to read resource ${resource.uri}: ${e.message}`);
-                        }
-                        return null;
-                    }));
-                    resourceContext =
-                        '\n\nAVAILABLE SHOP CONFIGURATION:\n' + resourceTexts.filter(Boolean).join('\n\n');
-                }
-            }
-            catch (e) {
-                logger.error(`Failed to fetch MCP resources: ${e.message}`);
-            }
+            const resourceContext = await buildChatResourceContext(unchainedContext);
             const tools = {
                 ...defaultUnchainedTools,
                 ...additionalTools,
@@ -95,6 +78,7 @@ const setupMCPChatHandler = (chatConfiguration) => {
                 tools.generateImage = generateImageHandler(req)(imageGenerationTool);
             }
             if (req.method === 'GET') {
+                await lifecycle.close();
                 res.status(200).json({
                     tools: normalizeToolsIndex(tools),
                     cached: false,
@@ -130,15 +114,28 @@ const setupMCPChatHandler = (chatConfiguration) => {
             }
             const messagesToInclude = normalizedMessages.slice(startIndex);
             const result = streamText({
-                stopWhen: stepCountIs(10),
-                temperature: 0.2,
+                stopWhen: stepCountIs(500),
                 maxRetries: 3,
                 ...restChatConfig,
+                abortSignal: lifecycle.signal,
                 system: system + resourceContext,
                 model,
                 tools: cacheControlledTools,
-                onFinish: async () => {
-                    await client?.close();
+                onEnd: async (event) => {
+                    try {
+                        await (configuredOnEnd ?? configuredOnFinish)?.(event);
+                    }
+                    finally {
+                        await lifecycle.close();
+                    }
+                },
+                onAbort: async (event) => {
+                    try {
+                        await configuredOnAbort?.(event);
+                    }
+                    finally {
+                        await lifecycle.close();
+                    }
                 },
                 messages: messagesToInclude,
                 providerOptions: {
@@ -149,20 +146,25 @@ const setupMCPChatHandler = (chatConfiguration) => {
                     },
                 },
             });
+            void result.finishReason.then(undefined, async () => {
+                await lifecycle.close();
+            });
             result.pipeUIMessageStreamToResponse(res, {
                 onError: errorHandler,
             });
         }
         catch (err) {
-            await client?.close();
-            await sdkClient?.close();
-            res.status(500).json({ error: errorHandler(err) });
+            logger.error(err);
+            await lifecycle.close();
+            if (lifecycle.signal.aborted || res.destroyed || res.writableEnded)
+                return;
+            res.status(chatErrorStatus(err)).json({ error: errorHandler(err) });
         }
     };
     return mcpChatHandler;
 };
 export const connectChat = (app, chatConfiguration) => {
-    if (!createMCPClient) {
+    if (!createMCPClient || !streamText) {
         logger.warn('Optional dependencies for AI SDK Chat Handler are not installed. Please install @ai-sdk/mcp and ai packages to use this feature.');
         return;
     }

package/lib/express/createMCPMiddleware.js

@@ -1,84 +1,25 @@
-import initMCPServer from "../mcp/index.js";
 import { createLogger } from '@unchainedshop/logger';
+import handleMcpHttpRequest from "../mcp/handleMcpHttpRequest.js";
+import { toWebRequest, sendWebResponse } from "../mcp/nodeHttpBridge.js";
 const logger = createLogger('unchained:api:mcp');
-let StreamableHTTPServerTransport;
-let isInitializeRequest;
-let McpServer;
-try {
-    const mcpSDKServerLibrary = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
-    const mcpSDKClient = await import('@modelcontextprotocol/sdk/types.js');
-    const mcpSDKServer = await import('@modelcontextprotocol/sdk/server/mcp.js');
-    McpServer = mcpSDKServer.McpServer;
-    StreamableHTTPServerTransport = mcpSDKServerLibrary.StreamableHTTPServerTransport;
-    isInitializeRequest = mcpSDKClient.isInitializeRequest;
-}
-catch {
-    logger.warn(`optional peer npm package '@modelcontextprotocol/sdk' not installed, mcp will not work`);
-}
-const transports = {};
-const handlePostRequest = async (req, res) => {
-    const sessionId = req.headers['mcp-session-id'];
-    let transport;
-    if (sessionId && transports[sessionId]) {
-        transport = transports[sessionId];
+const createMCPMiddleware = async (req, res) => {
+    try {
+        if (req.method !== 'POST' && req.method !== 'GET' && req.method !== 'DELETE') {
+            res.status(405).send('Method Not Allowed');
+            return;
+        }
+        const bodyText = req.method === 'POST' && req.body !== undefined ? JSON.stringify(req.body) : undefined;
+        const response = await handleMcpHttpRequest(req.unchainedContext, toWebRequest(req, res, bodyText), req.method === 'POST' ? req.body : undefined);
+        await sendWebResponse(res, response);
     }
-    else if (!sessionId && isInitializeRequest(req.body)) {
-        transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: () => crypto.randomUUID(),
-            onsessioninitialized: (sessionId) => {
-                transports[sessionId] = transport;
-            },
-        });
-        transport.onclose = () => {
-            if (transport.sessionId) {
-                delete transports[transport.sessionId];
-            }
-        };
-        const roles = req.unchainedContext.user?.roles || [];
-        const server = initMCPServer(new McpServer({
-            name: 'Unchained MCP Server',
-            version: '1.0.0',
-        }), req.unchainedContext, roles);
-        await server.connect(transport);
+    catch (error) {
+        logger.error(error);
+        if (!res.headersSent) {
+            res.status(500).json({ error: 'Internal Server Error' });
+        }
+        else {
+            res.destroy();
+        }
     }
-    else {
-        res.status(400).json({
-            jsonrpc: '2.0',
-            error: {
-                code: -32000,
-                message: 'Bad Request: No valid session ID provided',
-            },
-            id: null,
-        });
-        return;
-    }
-    await transport.handleRequest(req, res, req.body);
-};
-const handleSessionRequest = async (req, res) => {
-    const sessionId = req.headers['mcp-session-id'];
-    if (!sessionId || !transports[sessionId]) {
-        res.status(400).send('Invalid or missing session ID');
-        return;
-    }
-    const transport = transports[sessionId];
-    await transport.handleRequest(req, res);
-};
-const createMCPMiddleware = (req, res, next) => {
-    if (!req.unchainedContext.user) {
-        res.status(401);
-        res.header('WWW-Authenticate', `Bearer realm="Unchained MCP", error="invalid_token", resource="${process.env.ROOT_URL || 'http://localhost:4010'}",`);
-        res.json({
-            error: 'invalid_token',
-            resource_metadata: `${process.env.ROOT_URL || 'http://localhost:4010'}/.well-known/oauth-protected-resource`,
-        });
-        return;
-    }
-    if (req.method === 'POST') {
-        return handlePostRequest(req, res, next);
-    }
-    else if (req.method === 'GET' || req.method === 'DELETE') {
-        return handleSessionRequest(req, res, next);
-    }
-    res.status(405).send('Method Not Allowed');
 };
 export default createMCPMiddleware;

package/lib/express/index.d.ts

@@ -4,11 +4,15 @@ import type { UnchainedCore } from '@unchainedshop/core';
 import type { AuthConfig } from '../auth.ts';
 import type { ChatConfiguration } from '../chat/utils.ts';
 import { connectChat } from './chatHandler.ts';
+import { type AdminUIPluginConfig, type AdminUIThemeConfig } from '../adminUiPlugins.ts';
+export type { AdminUIPluginConfig, AdminUIPluginEntityConfig, AdminUIPluginPageConfig, AdminUIPluginTabConfig, AdminUIPluginWidgetConfig, AdminUIPluginSlotConfig, AdminUIThemeTokens, AdminUIThemeConfig, } from '../adminUiPlugins.ts';
 export interface AdminUIRouterOptions {
-    prefix: string;
+    prefix?: string;
     enabled?: boolean;
+    theme?: AdminUIThemeConfig;
+    plugins?: AdminUIPluginConfig[];
 }
-export declare const adminUIRouter: (enabled?: boolean) => import("express-serve-static-core").Router;
+export declare const adminUIRouter: (enabled?: boolean, theme?: AdminUIThemeConfig, plugins?: AdminUIPluginConfig[]) => import("express-serve-static-core").Router;
 export declare const connect: (expressApp: e.Express, { graphqlHandler, unchainedAPI, }: {
     graphqlHandler: YogaServerInstance<any, any>;
     unchainedAPI: UnchainedCore;

package/lib/express/index.js

@@ -1,20 +1,77 @@
 import e from 'express';
 import cookieParser from 'cookie-parser';
 import { pluginRegistry } from '@unchainedshop/core';
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
 import { getCurrentContextResolver } from "../context.js";
 import { createAuthContext } from "../middleware/createAuthMiddleware.js";
 import createMCPMiddleware from "./createMCPMiddleware.js";
 import { connectChat } from "./chatHandler.js";
 import { mountRoutes } from "./mountRoutes.js";
 import { createBackchannelLogoutRoute } from "../handlers/createBackchannelLogoutHandler.js";
-export const adminUIRouter = (enabled = true) => {
+import { preparePluginAssets, resolveAdminUIPath, } from "../adminUiPlugins.js";
+export const adminUIRouter = (enabled = true, theme, plugins = []) => {
     const router = e.Router();
-    const staticURL = import.meta.resolve('@unchainedshop/admin-ui');
-    const staticPath = new URL(staticURL).pathname.split('/').slice(0, -1).join('/');
+    const adminUIPath = resolveAdminUIPath();
+    if (!adminUIPath)
+        return router;
     if (enabled) {
-        router.use(e.static(staticPath));
-        router.get(/(.*)/, (_, res) => {
-            res.sendFile(`${staticPath}/index.html`);
+        let themePromise;
+        const resolveThemeCSS = async () => {
+            let css = '/* default theme */';
+            if (theme) {
+                try {
+                    const { generateThemeCSS } = await import('@unchainedshop/admin-ui/theme');
+                    css = generateThemeCSS(theme);
+                }
+                catch {
+                    console.warn("npm dependency @unchainedshop/admin-ui is not installed, can't apply admin-ui theme");
+                }
+            }
+            const etag = `"${createHash('sha256').update(css).digest('hex').slice(0, 8)}"`;
+            return { css, etag };
+        };
+        router.get('/admin-ui-theme.css', async (req, res) => {
+            const { css, etag } = await (themePromise ||= resolveThemeCSS());
+            if (req.headers['if-none-match'] === etag) {
+                return res.status(304).end();
+            }
+            res
+                .set('Cache-Control', 'public, max-age=0, must-revalidate')
+                .set('ETag', etag)
+                .type('text/css')
+                .send(css);
+        });
+        const log = { info: console.info, warn: console.warn };
+        const devMode = process.env.NODE_ENV !== 'production';
+        const { routes: pluginRoutes } = preparePluginAssets(plugins, log, { devMode });
+        for (const [path, asset] of pluginRoutes) {
+            router.get(path, (req, res) => {
+                if (asset.etag) {
+                    if (req.headers['if-none-match'] === asset.etag) {
+                        return res.status(304).end();
+                    }
+                    res.set('ETag', asset.etag);
+                }
+                const body = typeof asset.content === 'function' ? asset.content() : asset.content;
+                res
+                    .set('Cache-Control', asset.cacheControl)
+                    .set('X-Content-Type-Options', 'nosniff')
+                    .set('Access-Control-Allow-Origin', '*')
+                    .type(asset.contentType)
+                    .send(body);
+            });
+        }
+        router.use(e.static(adminUIPath));
+        const extHtmlPath = join(adminUIPath, 'ext', '[[...slug]]', 'index.html');
+        const hasExtHtml = existsSync(extHtmlPath);
+        router.get(/(.*)/, (req, res) => {
+            const urlPath = req.path.replace(/\/+$/, '');
+            if (hasExtHtml && (urlPath === '/ext' || urlPath.startsWith('/ext/'))) {
+                return res.sendFile(extHtmlPath);
+            }
+            return res.sendFile(join(adminUIPath, 'index.html'));
         });
     }
     return router;
@@ -74,6 +131,9 @@ const createAddContextMiddleware = (authConfig, trustProxy = false) => async fun
     }
 };
 export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { allowRemoteToLocalhostSecureCookies = false, adminUI = false, chat, authConfig, trustProxy = false, } = {}) => {
+    const adminUIOptions = typeof adminUI === 'object' ? adminUI : undefined;
+    const adminUITheme = adminUIOptions?.theme;
+    const adminUIPlugins = adminUIOptions?.plugins || [];
     if (allowRemoteToLocalhostSecureCookies) {
         if (process.env.NODE_ENV === 'production') {
             throw new Error('allowRemoteToLocalhostSecureCookies is not allowed in production. ' +
@@ -104,7 +164,7 @@ export const connect = async (expressApp, { graphqlHandler, unchainedAPI, }, { a
     }
     mountRoutes(expressApp, unchainedAPI, routes);
     if (adminUI) {
-        expressApp.use(typeof adminUI === 'object' ? adminUI.prefix : '/', adminUIRouter(true));
+        expressApp.use(adminUIOptions?.prefix || '/', adminUIRouter(true, adminUITheme, adminUIPlugins));
     }
 };
 export { connectChat };