@wukongcrm/mcp-server 0.1.3 → 0.1.4

package/dist/http-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/http-entry.js

@@ -0,0 +1,30 @@
+import { createWukongHttpApp, loadRemoteServerEnvironment } from "./http.js";
+const environment = loadRemoteServerEnvironment();
+const { app, resourceUrl } = createWukongHttpApp({
+    publicUrl: environment.publicUrl,
+    oauthSecret: environment.oauthSecret,
+    dataDirectory: environment.dataDirectory,
+    crmBaseUrl: environment.crmBaseUrl,
+    crmBindingAuthorizeUrl: environment.crmBindingAuthorizeUrl,
+    crmBindingExchangeUrl: environment.crmBindingExchangeUrl,
+    crmBindingCallbackUrl: environment.crmBindingCallbackUrl,
+    crmBindingClientId: environment.crmBindingClientId,
+    crmBindingClientSecret: environment.crmBindingClientSecret,
+    host: environment.host,
+    allowedHosts: environment.allowedHosts,
+    trustProxy: environment.trustProxy
+});
+const httpServer = app.listen(environment.port, environment.host, () => {
+    console.log(`WukongCRM remote MCP listening on ${environment.host}:${environment.port}`);
+    console.log(`Public MCP URL: ${resourceUrl.href}`);
+    console.log(`Express trust proxy: ${String(environment.trustProxy)}`);
+});
+httpServer.on("error", (error) => {
+    console.error("Failed to start remote MCP server:", error.message);
+    process.exitCode = 1;
+});
+for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+        httpServer.close(() => process.exit(0));
+    });
+}

package/dist/http.d.ts

@@ -0,0 +1,41 @@
+import { Express } from "express";
+import { WukongOAuthProvider } from "./oauth.js";
+export type TrustProxySetting = boolean | number | string;
+export interface WukongHttpAppOptions {
+    publicUrl: string | URL;
+    oauthSecret: string;
+    dataDirectory: string;
+    crmBaseUrl?: string;
+    crmBindingAuthorizeUrl: string | URL;
+    crmBindingExchangeUrl: string | URL;
+    crmBindingCallbackUrl?: string | URL;
+    crmBindingClientId: string;
+    crmBindingClientSecret: string;
+    fetchImpl?: typeof fetch;
+    host?: string;
+    allowedHosts?: string[];
+    trustProxy?: TrustProxySetting;
+}
+export interface WukongHttpApp {
+    app: Express;
+    provider: WukongOAuthProvider;
+    resourceUrl: URL;
+    resourceMetadataUrl: string;
+}
+export declare function createWukongHttpApp(options: WukongHttpAppOptions): WukongHttpApp;
+export interface RemoteServerEnvironment {
+    publicUrl: string;
+    oauthSecret: string;
+    dataDirectory: string;
+    crmBaseUrl?: string;
+    crmBindingAuthorizeUrl: string;
+    crmBindingExchangeUrl: string;
+    crmBindingCallbackUrl: string;
+    crmBindingClientId: string;
+    crmBindingClientSecret: string;
+    host: string;
+    allowedHosts: string[];
+    trustProxy: TrustProxySetting;
+    port: number;
+}
+export declare function loadRemoteServerEnvironment(env?: NodeJS.ProcessEnv): RemoteServerEnvironment;

package/dist/http.js

@@ -0,0 +1,253 @@
+import path from "node:path";
+import { authorizationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/authorize.js";
+import { metadataHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/metadata.js";
+import { clientRegistrationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/register.js";
+import { revocationHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/revoke.js";
+import { tokenHandler } from "@modelcontextprotocol/sdk/server/auth/handlers/token.js";
+import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
+import { getOAuthProtectedResourceMetadataUrl } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import express from "express";
+import { WukongOAuthProvider } from "./oauth.js";
+import { MCP_RESOURCE_SCOPES, OAUTH_SCOPES, createWukongMcpServer } from "./server.js";
+export function createWukongHttpApp(options) {
+    const resourceUrl = validatePublicUrl(options.publicUrl);
+    const issuerUrl = new URL("/", resourceUrl);
+    const resourcePath = resourceUrl.pathname;
+    const oauthBasePath = `${resourcePath}/oauth`;
+    const bindingCallbackUrl = options.crmBindingCallbackUrl
+        ? new URL(options.crmBindingCallbackUrl.toString())
+        : new URL(`${oauthBasePath}/72crm/callback`, resourceUrl);
+    if (bindingCallbackUrl.origin !== resourceUrl.origin) {
+        throw new Error("CRM_BINDING_CALLBACK_URL 必须与 MCP_PUBLIC_URL 使用相同域名。");
+    }
+    const resourceMetadataUrl = getOAuthProtectedResourceMetadataUrl(resourceUrl);
+    const resourceMetadataPath = new URL(resourceMetadataUrl).pathname;
+    const serviceDocumentationUrl = new URL("/", resourceUrl);
+    const host = options.host ?? "127.0.0.1";
+    const allowedHosts = options.allowedHosts ?? uniqueStrings([
+        resourceUrl.hostname,
+        "localhost",
+        "127.0.0.1",
+        "[::1]"
+    ]);
+    const provider = new WukongOAuthProvider({
+        resourceUrl,
+        crmBaseUrl: options.crmBaseUrl,
+        crmBindingAuthorizeUrl: new URL(options.crmBindingAuthorizeUrl.toString()),
+        crmBindingExchangeUrl: new URL(options.crmBindingExchangeUrl.toString()),
+        crmBindingCallbackUrl: bindingCallbackUrl,
+        crmBindingClientId: options.crmBindingClientId,
+        crmBindingClientSecret: options.crmBindingClientSecret,
+        secret: options.oauthSecret,
+        dataDirectory: options.dataDirectory,
+        fetchImpl: options.fetchImpl
+    });
+    const app = createMcpExpressApp({ host, allowedHosts });
+    app.set("trust proxy", options.trustProxy ?? false);
+    const protectedResourceMetadata = {
+        resource: resourceUrl.href,
+        authorization_servers: [issuerUrl.href],
+        scopes_supported: [...MCP_RESOURCE_SCOPES],
+        resource_name: "WukongCRM MCP",
+        resource_documentation: serviceDocumentationUrl.href
+    };
+    const oauthMetadata = {
+        issuer: issuerUrl.href,
+        service_documentation: serviceDocumentationUrl.href,
+        authorization_endpoint: new URL(`${oauthBasePath}/authorize`, resourceUrl).href,
+        token_endpoint: new URL(`${oauthBasePath}/token`, resourceUrl).href,
+        registration_endpoint: new URL(`${oauthBasePath}/register`, resourceUrl).href,
+        revocation_endpoint: new URL(`${oauthBasePath}/revoke`, resourceUrl).href,
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        scopes_supported: [...OAUTH_SCOPES],
+        revocation_endpoint_auth_methods_supported: ["none"]
+    };
+    app.use(express.urlencoded({ extended: false, limit: "16kb" }));
+    app.get(`${resourcePath}/healthz`, (_req, res) => {
+        res.status(200).json({ ok: true, service: "wukong-mcp" });
+    });
+    app.get(bindingCallbackUrl.pathname, async (req, res) => {
+        setSensitiveResponseHeaders(res);
+        try {
+            const requestId = typeof req.query.state === "string" ? req.query.state : "";
+            const bindingCode = typeof req.query.code === "string" ? req.query.code : "";
+            const redirectUrl = await provider.completeBindingAuthorization(requestId, bindingCode);
+            res.redirect(302, redirectUrl);
+        }
+        catch (error) {
+            console.warn("72CRM binding callback failed:", error instanceof Error ? error.message : "unknown error");
+            res.status(400).type("text").send("授权失败，请返回 ChatGPT 重新发起连接。");
+        }
+    });
+    app.use("/.well-known/oauth-protected-resource", metadataHandler(protectedResourceMetadata));
+    app.use(resourceMetadataPath, metadataHandler(protectedResourceMetadata));
+    app.use("/.well-known/oauth-authorization-server", metadataHandler(oauthMetadata));
+    app.use("/.well-known/openid-configuration", metadataHandler(oauthMetadata));
+    app.use(`${oauthBasePath}/authorize`, authorizationHandler({ provider }));
+    app.use(`${oauthBasePath}/token`, tokenHandler({ provider }));
+    app.use(`${oauthBasePath}/register`, clientRegistrationHandler({ clientsStore: provider.clientsStore }));
+    app.use(`${oauthBasePath}/revoke`, revocationHandler({ provider }));
+    const bearerAuth = requireBearerAuth({
+        verifier: provider,
+        requiredScopes: [...MCP_RESOURCE_SCOPES],
+        resourceMetadataUrl
+    });
+    app.post(resourceUrl.pathname, bearerAuth, async (req, res) => {
+        await handleMcpPost(req, res, options, resourceMetadataUrl);
+    });
+    app.get(resourceUrl.pathname, bearerAuth, (_req, res) => {
+        sendMethodNotAllowed(res);
+    });
+    app.delete(resourceUrl.pathname, bearerAuth, (_req, res) => {
+        sendMethodNotAllowed(res);
+    });
+    return { app, provider, resourceUrl, resourceMetadataUrl };
+}
+async function handleMcpPost(req, res, options, resourceMetadataUrl) {
+    const apiKey = req.auth?.extra?.crmApiKey;
+    if (typeof apiKey !== "string" || !apiKey) {
+        res.setHeader("WWW-Authenticate", `Bearer resource_metadata="${resourceMetadataUrl}"`);
+        res.status(401).json({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: "Unauthorized" },
+            id: null
+        });
+        return;
+    }
+    const server = createWukongMcpServer({
+        baseUrl: options.crmBaseUrl,
+        apiKey,
+        fetchImpl: options.fetchImpl,
+        oauth: {
+            scopes: req.auth?.scopes ?? [],
+            resourceMetadataUrl
+        }
+    });
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+    try {
+        await server.connect(transport);
+        await transport.handleRequest(req, res, req.body);
+    }
+    catch (error) {
+        console.error("MCP request failed:", error instanceof Error ? error.message : "unknown error");
+        if (!res.headersSent) {
+            res.status(500).json({
+                jsonrpc: "2.0",
+                error: { code: -32603, message: "Internal server error" },
+                id: null
+            });
+        }
+    }
+    finally {
+        await transport.close().catch(() => undefined);
+        await server.close().catch(() => undefined);
+    }
+}
+function validatePublicUrl(value) {
+    const url = new URL(value.toString());
+    if (url.search || url.hash) {
+        throw new Error("MCP_PUBLIC_URL 不能包含查询参数或片段。");
+    }
+    const isLoopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback)) {
+        throw new Error("MCP_PUBLIC_URL 必须使用 HTTPS；只有本地开发地址可以使用 HTTP。");
+    }
+    const normalizedPath = url.pathname.replace(/\/+$/, "");
+    if (!normalizedPath) {
+        throw new Error("MCP_PUBLIC_URL 必须包含 MCP 路径，例如 https://mcp.example.com/mcp。");
+    }
+    url.pathname = normalizedPath;
+    url.hash = "";
+    return url;
+}
+function setSensitiveResponseHeaders(res) {
+    res.setHeader("Cache-Control", "no-store");
+    res.setHeader("Pragma", "no-cache");
+    res.setHeader("X-Frame-Options", "DENY");
+    res.setHeader("Referrer-Policy", "no-referrer");
+    res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'");
+}
+function sendMethodNotAllowed(res) {
+    res.status(405).json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: "Method not allowed" },
+        id: null
+    });
+}
+function uniqueStrings(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+export function loadRemoteServerEnvironment(env = process.env) {
+    const publicUrl = requiredEnvironment(env, "MCP_PUBLIC_URL");
+    const oauthSecret = requiredEnvironment(env, "MCP_OAUTH_SECRET");
+    const parsedPublicUrl = validatePublicUrl(publicUrl);
+    const crmBindingAuthorizeUrl = requiredEnvironment(env, "CRM_BINDING_AUTHORIZE_URL");
+    const crmBindingExchangeUrl = requiredEnvironment(env, "CRM_BINDING_EXCHANGE_URL");
+    const crmBindingClientId = requiredEnvironment(env, "CRM_BINDING_CLIENT_ID");
+    const crmBindingClientSecret = requiredEnvironment(env, "CRM_BINDING_CLIENT_SECRET");
+    const resourcePath = parsedPublicUrl.pathname;
+    const crmBindingCallbackUrl = env.CRM_BINDING_CALLBACK_URL?.trim() ||
+        new URL(`${resourcePath}/oauth/72crm/callback`, parsedPublicUrl).href;
+    const portText = env.MCP_PORT ?? env.PORT ?? "3000";
+    const port = Number.parseInt(portText, 10);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        throw new Error("MCP_PORT/PORT 必须是 1 到 65535 之间的整数。");
+    }
+    const configuredHosts = (env.MCP_ALLOWED_HOSTS ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    return {
+        publicUrl,
+        oauthSecret,
+        dataDirectory: path.resolve(env.MCP_DATA_DIR ?? ".wukong-mcp-data"),
+        crmBaseUrl: env.CRM_BASE_URL,
+        crmBindingAuthorizeUrl,
+        crmBindingExchangeUrl,
+        crmBindingCallbackUrl,
+        crmBindingClientId,
+        crmBindingClientSecret,
+        host: env.MCP_HOST ?? "127.0.0.1",
+        allowedHosts: uniqueStrings([
+            ...configuredHosts,
+            parsedPublicUrl.hostname,
+            "localhost",
+            "127.0.0.1",
+            "[::1]"
+        ]),
+        trustProxy: parseTrustProxy(env.MCP_TRUST_PROXY ?? "1"),
+        port
+    };
+}
+function parseTrustProxy(value) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new Error("MCP_TRUST_PROXY 不能为空。");
+    }
+    if (normalized === "true") {
+        return true;
+    }
+    if (normalized === "false") {
+        return false;
+    }
+    if (/^-?\d+$/.test(normalized)) {
+        const hops = Number.parseInt(normalized, 10);
+        if (!Number.isSafeInteger(hops) || hops < 0) {
+            throw new Error("MCP_TRUST_PROXY 的代理层数必须是非负整数。");
+        }
+        return hops;
+    }
+    return normalized;
+}
+function requiredEnvironment(env, name) {
+    const value = env[name]?.trim();
+    if (!value) {
+        throw new Error(`远程模式必须配置 ${name}。`);
+    }
+    return value;
+}

package/dist/modules.js

@@ -41,9 +41,9 @@ export const CRM_MODULES = [
         basePath: "/crmProduct",
         primaryKey: "productId",
         aliases: ["产品", "crmProduct", "4"],
-        supportedOperations: [...COMMON_READ, "简要实体", "销售产品列表"],
-        unsupportedOperations: ["新增", "更新", "删除", "上下架", "负责人转移", "导入导出"],
-        writable: false
+        supportedOperations: [...COMMON_READ, "简要实体", "销售产品列表", "新增", "更新", "字段更新", "上下架", "负责人转移", "删除"],
+        unsupportedOperations: ["导入导出", "文件流下载", "multipart 文件上传代理"],
+        writable: true
     },
     {
         key: "business",
@@ -167,7 +167,7 @@ export const CRM_MODULES = [
         writable: false
     }
 ];
-export const WRITE_MODULES = new Set(["leads", "customer", "contacts", "business"]);
+export const WRITE_MODULES = new Set(["leads", "customer", "contacts", "product", "business"]);
 const MODULE_LOOKUP = new Map();
 for (const moduleDefinition of CRM_MODULES) {
     MODULE_LOOKUP.set(moduleDefinition.key.toLowerCase(), moduleDefinition);

package/dist/oauth.d.ts

@@ -0,0 +1,71 @@
+import type { OAuthRegisteredClientsStore } from "@modelcontextprotocol/sdk/server/auth/clients.js";
+import type { OAuthServerProvider, AuthorizationParams } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
+import type { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { Response } from "express";
+type RegisterableClient = Omit<OAuthClientInformationFull, "client_id" | "client_id_issued_at"> & {
+    client_id?: string;
+    client_id_issued_at?: number;
+};
+export declare class FileOAuthState implements OAuthRegisteredClientsStore {
+    private readonly filePath;
+    private readonly clients;
+    private readonly revoked;
+    private readonly ready;
+    private persistQueue;
+    constructor(dataDirectory: string);
+    getClient(clientId: string): Promise<OAuthClientInformationFull | undefined>;
+    registerClient(client: RegisterableClient): Promise<OAuthClientInformationFull>;
+    revoke(jti: string, expiresAt: number): Promise<void>;
+    isRevoked(jti: string): Promise<boolean>;
+    private load;
+    private removeExpiredRevocations;
+    private persist;
+}
+export interface WukongOAuthProviderOptions {
+    resourceUrl: URL;
+    crmBaseUrl?: string;
+    crmBindingAuthorizeUrl: URL;
+    crmBindingExchangeUrl: URL;
+    crmBindingCallbackUrl: URL;
+    crmBindingClientId: string;
+    crmBindingClientSecret: string;
+    secret: string;
+    dataDirectory: string;
+    fetchImpl?: typeof fetch;
+    accessTokenTtlSeconds?: number;
+    refreshTokenTtlSeconds?: number;
+}
+export declare class WukongOAuthProvider implements OAuthServerProvider {
+    readonly clientsStore: FileOAuthState;
+    private readonly resourceUrl;
+    private readonly crmBaseUrl?;
+    private readonly fetchImpl?;
+    private readonly crmBindingAuthorizeUrl;
+    private readonly crmBindingExchangeUrl;
+    private readonly crmBindingCallbackUrl;
+    private readonly crmBindingClientId;
+    private readonly crmBindingClientSecret;
+    private readonly encryptionKey;
+    private readonly accessTokenTtlSeconds;
+    private readonly refreshTokenTtlSeconds;
+    private readonly pendingAuthorizations;
+    private readonly authorizationCodes;
+    constructor(options: WukongOAuthProviderOptions);
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    completeBindingAuthorization(requestId: string, bindingCode: string): Promise<string>;
+    private exchangeBindingCode;
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, _codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    revokeToken(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    private getAuthorizationCode;
+    private issueTokens;
+    private decodeAndVerifyToken;
+    private encryptToken;
+    private decryptToken;
+    private assertResource;
+    private cleanupTransientState;
+}
+export {};