@xen-orchestra/rest-api 0.31.1 → 0.33.0

package/dist/mcp/mcp.controller.mjs

@@ -0,0 +1,59 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Controller, Example, Get, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
+import { inject } from 'inversify';
+import { provide } from 'inversify-binding-decorators';
+import { ApiError } from '../helpers/error.helper.mjs';
+import { isMcpEnabled, MCP_DISABLED_ERROR } from './mcp.helper.mjs';
+import { RestApi } from '../rest-api/rest-api.mjs';
+const ENABLED_RESPONSE = {
+    status: 200,
+    description: 'MCP is enabled',
+};
+const DISABLED_RESPONSE = {
+    status: 503,
+    description: 'MCP is disabled by administrator',
+};
+let McpController = class McpController extends Controller {
+    #restApi;
+    constructor(restApi) {
+        super();
+        this.#restApi = restApi;
+    }
+    /**
+     * Returns whether MCP is currently enabled on this XO server.
+     *
+     * The route is publicly reachable (no authentication required) so the
+     * `@xen-orchestra/mcp` binary can check the kill-switch at startup,
+     * before any credentials have been configured.
+     */
+    getMcpStatus() {
+        if (!isMcpEnabled(this.#restApi)) {
+            throw new ApiError(DISABLED_RESPONSE.description, DISABLED_RESPONSE.status, {
+                data: { error: MCP_DISABLED_ERROR },
+            });
+        }
+        return { enabled: true };
+    }
+};
+__decorate([
+    Security('none'),
+    Example({ enabled: true }),
+    Get('status'),
+    SuccessResponse(ENABLED_RESPONSE.status, ENABLED_RESPONSE.description),
+    Response(DISABLED_RESPONSE.status, DISABLED_RESPONSE.description)
+], McpController.prototype, "getMcpStatus", null);
+McpController = __decorate([
+    Route('mcp'),
+    Tags('mcp'),
+    provide(McpController),
+    __param(0, inject(RestApi))
+], McpController);
+export { McpController };

package/dist/mcp/mcp.helper.mjs

@@ -0,0 +1,11 @@
+// Single source of truth for reading the MCP kill-switch flag. Defaults to
+// `true` so legacy configs without a `[mcp]` section keep MCP enabled.
+export function isMcpEnabled(restApi) {
+    return restApi.xoApp.config.getOptional('mcp.enabled') ?? true;
+}
+// Wire-level identifier used by the kill-switch contract; shared between the
+// gate middleware (`@xen-orchestra/rest-api`) and the controller response.
+export const MCP_DISABLED_ERROR = 'mcp_disabled';
+// Whitelisted by `mcp-gate` so the MCP binary can probe the kill-switch
+// state at boot even when MCP is globally disabled.
+export const MCP_STATUS_PATH = '/mcp/status';

package/dist/messages/message.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
+import { Example, Extension, Get, Middlewares, Path, Query, Request, Response, Route, Security, Tags } from 'tsoa';
 import { inject } from 'inversify';
 import { noSuchObject } from 'xo-common/api-errors.js';
 import { provide } from 'inversify-binding-decorators';
@@ -73,6 +73,7 @@ let MessageController = class MessageController extends XapiXoController {
 __decorate([
     Example(messageIds),
     Example(partialMessages),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -84,6 +85,7 @@ __decorate([
 ], MessageController.prototype, "getMessages", null);
 __decorate([
     Example(message),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({
         resource: 'message',

package/dist/middlewares/mcp-gate.middleware.mjs

@@ -0,0 +1,30 @@
+import { ApiError } from '../helpers/error.helper.mjs';
+import { iocContainer } from '../ioc/ioc.mjs';
+import { isMcpEnabled, MCP_DISABLED_ERROR, MCP_STATUS_PATH } from '../mcp/mcp.helper.mjs';
+import { RestApi } from '../rest-api/rest-api.mjs';
+// Identifies requests originating from the `@xen-orchestra/mcp` binary.
+//
+// SECURITY: the header is NOT authenticated — any client can spoof it. Use it
+// only to RESTRICT behaviour (e.g. the MCP kill-switch), never to grant
+// privileges.
+function isMcpRequest(req) {
+    // Node lowercases header names; values keep their original case so we
+    // normalize before comparing. `Array.isArray` covers the unusual case of
+    // a duplicated header value (a malformed or hostile client).
+    const header = req.headers['x-xo-client'];
+    const value = Array.isArray(header) ? header[0] : header;
+    return typeof value === 'string' && value.toLowerCase() === 'mcp';
+}
+export function mcpGateMiddleware(req, _res, next) {
+    if (!isMcpRequest(req)) {
+        return next();
+    }
+    // Always let the kill-switch probe through so the MCP binary can fail-fast.
+    if (req.path === MCP_STATUS_PATH) {
+        return next();
+    }
+    if (!isMcpEnabled(iocContainer.get(RestApi))) {
+        return next(new ApiError('MCP is disabled by administrator', 503, { data: { error: MCP_DISABLED_ERROR } }));
+    }
+    next();
+}

package/dist/networks/network.controller.mjs

@@ -7,7 +7,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Example, Get, Path, Query, Response, Request, Route, Security, Tags, Delete, SuccessResponse, Put, Middlewares, } from 'tsoa';
+import { Delete, Example, Extension, Get, Middlewares, Path, Put, Query, Request, Response, Route, Security, SuccessResponse, Tags, } from 'tsoa';
 import { inject } from 'inversify';
 import { provide } from 'inversify-binding-decorators';
 import { AlarmService } from '../alarms/alarm.service.mjs';
@@ -139,6 +139,7 @@ let NetworkController = class NetworkController extends XapiXoController {
 __decorate([
     Example(networkIds),
     Example(partialNetworks),
+    Extension('x-mcp-exposure', 'allow'),
     Get(''),
     Security('*', ['acl']),
     __param(0, Request()),
@@ -150,6 +151,7 @@ __decorate([
 ], NetworkController.prototype, "getNetworks", null);
 __decorate([
     Example(network),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}'),
     Middlewares(acl({ resource: 'network', action: 'read', objectId: 'params.id' })),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -157,6 +159,7 @@ __decorate([
     __param(0, Path())
 ], NetworkController.prototype, "getNetwork", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}'),
     Middlewares(acl({ resource: 'network', action: 'delete', objectId: 'params.id' })),
     Response(forbiddenOperationResp.status, forbiddenOperationResp.description),
@@ -166,6 +169,7 @@ __decorate([
 ], NetworkController.prototype, "deleteNetwork", null);
 __decorate([
     Example(genericAlarmsExample),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/alarms'),
     Security('*', ['acl']),
     Tags('alarms'),
@@ -181,6 +185,7 @@ __decorate([
 __decorate([
     Example(messageIds),
     Example(partialMessages),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/messages'),
     Security('*', ['acl']),
     Tags('messages'),
@@ -196,6 +201,7 @@ __decorate([
 __decorate([
     Example(taskIds),
     Example(partialTasks),
+    Extension('x-mcp-exposure', 'allow'),
     Get('{id}/tasks'),
     Security('*', ['acl']),
     Tags('tasks'),
@@ -209,6 +215,7 @@ __decorate([
     __param(6, Query())
 ], NetworkController.prototype, "getNetworkTasks", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Put('{id}/tags/{tag}'),
     Middlewares(acl({ resource: 'network', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),
@@ -218,6 +225,7 @@ __decorate([
     __param(1, Path())
 ], NetworkController.prototype, "putNetworkTag", null);
 __decorate([
+    Extension('x-mcp-exposure', 'confirm'),
     Delete('{id}/tags/{tag}'),
     Middlewares(acl({ resource: 'network', action: 'update:tags', objectId: 'params.id' })),
     SuccessResponse(noContentResp.status, noContentResp.description),