affine-mcp-server 1.5.0 → 1.7.0

package/dist/cli.js

@@ -0,0 +1,288 @@
+import { fetch } from "undici";
+import * as fs from "fs";
+import * as readline from "readline";
+import { CONFIG_FILE, loadConfigFile, writeConfigFile, validateBaseUrl, VERSION } from "./config.js";
+import { loginWithPassword } from "./auth.js";
+const CLI_FETCH_TIMEOUT_MS = 30_000;
+class CliError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CliError";
+    }
+}
+function ask(prompt, hidden = false) {
+    if (hidden && process.stdin.isTTY) {
+        return readHidden(prompt);
+    }
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: process.stdin.isTTY ?? false,
+        });
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve((answer || "").trim());
+        });
+    });
+}
+/** Read a line with echo disabled using raw-mode stdin (no private API hacks). */
+function readHidden(prompt) {
+    return new Promise((resolve, reject) => {
+        process.stderr.write(prompt);
+        const buf = [];
+        process.stdin.setRawMode(true);
+        process.stdin.resume();
+        process.stdin.setEncoding("utf8");
+        const onData = (ch) => {
+            switch (ch) {
+                case "\r":
+                case "\n":
+                    cleanup();
+                    process.stderr.write("\n");
+                    resolve(buf.join(""));
+                    break;
+                case "\u0003": // Ctrl-C
+                    cleanup();
+                    process.stderr.write("\n");
+                    reject(new CliError("Aborted."));
+                    break;
+                case "\u007F": // Backspace
+                case "\b":
+                    buf.pop();
+                    break;
+                default:
+                    buf.push(ch);
+            }
+        };
+        const cleanup = () => {
+            process.stdin.setRawMode(false);
+            process.stdin.pause();
+            process.stdin.removeListener("data", onData);
+        };
+        process.stdin.on("data", onData);
+    });
+}
+async function gql(baseUrl, auth, query, variables) {
+    const headers = {
+        "Content-Type": "application/json",
+        "User-Agent": `affine-mcp-server/${VERSION}`,
+    };
+    if (auth.token)
+        headers["Authorization"] = `Bearer ${auth.token}`;
+    if (auth.cookie)
+        headers["Cookie"] = auth.cookie;
+    const body = { query };
+    if (variables)
+        body.variables = variables;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), CLI_FETCH_TIMEOUT_MS);
+    let res;
+    try {
+        res = await fetch(`${baseUrl}/graphql`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+    }
+    catch (err) {
+        if (err.name === "AbortError")
+            throw new Error(`Request timed out after ${CLI_FETCH_TIMEOUT_MS / 1000}s`);
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status}`);
+    const json = await res.json();
+    if (json.errors)
+        throw new Error(json.errors.map((e) => e.message).join("; "));
+    return json.data;
+}
+async function detectWorkspace(baseUrl, auth) {
+    console.error("Detecting workspaces...");
+    try {
+        const data = await gql(baseUrl, auth, `query {
+      workspaces {
+        id createdAt memberCount
+        owner { name }
+      }
+    }`);
+        const workspaces = data.workspaces;
+        if (workspaces.length === 0) {
+            console.error("  No workspaces found.");
+            return "";
+        }
+        const formatWs = (w) => {
+            const owner = w.owner?.name || "unknown";
+            const members = w.memberCount ?? 0;
+            const date = w.createdAt ? new Date(w.createdAt).toLocaleDateString() : "";
+            const membersStr = members === 1 ? "1 member" : `${members} members`;
+            return `${w.id}  (by ${owner}, ${membersStr}, ${date})`;
+        };
+        if (workspaces.length === 1) {
+            console.error(`  Found 1 workspace: ${formatWs(workspaces[0])}`);
+            console.error("  Auto-selected.");
+            return workspaces[0].id;
+        }
+        console.error(`  Found ${workspaces.length} workspaces:`);
+        workspaces.forEach((w, i) => console.error(`    ${i + 1}) ${formatWs(w)}`));
+        const choice = (await ask(`\nSelect [1]: `)) || "1";
+        const idx = parseInt(choice, 10) - 1;
+        if (idx < 0 || idx >= workspaces.length) {
+            throw new CliError("Invalid selection.");
+        }
+        return workspaces[idx].id;
+    }
+    catch (err) {
+        if (err instanceof CliError)
+            throw err;
+        console.error(`  Could not list workspaces: ${err.message}`);
+        return "";
+    }
+}
+async function loginWithEmail(baseUrl) {
+    const email = await ask("Email: ");
+    const password = await ask("Password: ", true);
+    if (!email || !password) {
+        throw new CliError("Email and password are required.");
+    }
+    console.error("Signing in...");
+    let cookieHeader;
+    try {
+        ({ cookieHeader } = await loginWithPassword(baseUrl, email, password));
+    }
+    catch (err) {
+        throw new CliError(`Sign-in failed: ${err.message}`);
+    }
+    // Verify identity
+    const auth = { cookie: cookieHeader };
+    try {
+        const data = await gql(baseUrl, auth, "query { currentUser { name email } }");
+        console.error(`✓ Signed in as: ${data.currentUser.name} <${data.currentUser.email}>\n`);
+    }
+    catch (err) {
+        throw new CliError(`Session verification failed: ${err.message}`);
+    }
+    // Auto-generate an API token so the MCP server can use token auth (no cookie expiry issues)
+    console.error("Generating API token...");
+    let token;
+    try {
+        const data = await gql(baseUrl, auth, `mutation($input: GenerateAccessTokenInput!) { generateUserAccessToken(input: $input) { id name token } }`, { input: { name: `affine-mcp-${new Date().toISOString().slice(0, 10)}` } });
+        token = data.generateUserAccessToken.token;
+        console.error(`✓ Token created (name: ${data.generateUserAccessToken.name})\n`);
+    }
+    catch (err) {
+        throw new CliError(`Failed to generate token: ${err.message}\n` +
+            "You can create one manually in Affine Settings → Integrations → MCP Server");
+    }
+    const workspaceId = await detectWorkspace(baseUrl, { token });
+    return { token, workspaceId };
+}
+async function loginWithToken(baseUrl) {
+    console.error("\nTo generate a token:");
+    console.error(`  1. Open ${baseUrl}/settings in your browser`);
+    console.error("  2. Account Settings → Integrations → MCP Server");
+    console.error("  3. Copy the Personal access token\n");
+    const token = await ask("API token: ", true);
+    if (!token) {
+        throw new CliError("No token provided.");
+    }
+    console.error("Testing connection...");
+    try {
+        const data = await gql(baseUrl, { token }, "query { currentUser { name email } }");
+        console.error(`✓ Authenticated as: ${data.currentUser.name} <${data.currentUser.email}>\n`);
+    }
+    catch (err) {
+        throw new CliError(`Authentication failed: ${err.message}`);
+    }
+    const workspaceId = await detectWorkspace(baseUrl, { token });
+    return { token, workspaceId };
+}
+async function login() {
+    console.error("Affine MCP Server — Login\n");
+    const existing = loadConfigFile();
+    if (existing.AFFINE_API_TOKEN) {
+        console.error(`Existing config: ${CONFIG_FILE}`);
+        console.error(`  URL:       ${existing.AFFINE_BASE_URL || "(default)"}`);
+        console.error(`  Token:     (set)`);
+        console.error(`  Workspace: ${existing.AFFINE_WORKSPACE_ID || "(none)"}\n`);
+        const overwrite = await ask("Overwrite? [y/N] ");
+        if (!/^[yY]$/.test(overwrite)) {
+            console.error("Keeping existing config.");
+            return;
+        }
+        console.error("");
+    }
+    const defaultUrl = "https://app.affine.pro";
+    const rawUrl = (await ask(`Affine URL [${defaultUrl}]: `)) || defaultUrl;
+    const baseUrl = validateBaseUrl(rawUrl);
+    const isSelfHosted = !baseUrl.includes("affine.pro");
+    let result;
+    if (isSelfHosted) {
+        const method = await ask("\nAuth method — [1] Email/password (recommended)  [2] Paste API token: ");
+        if (method === "2") {
+            result = await loginWithToken(baseUrl);
+        }
+        else {
+            result = await loginWithEmail(baseUrl);
+        }
+    }
+    else {
+        // Cloudflare blocks programmatic sign-in on app.affine.pro — token is the only option
+        result = await loginWithToken(baseUrl);
+    }
+    writeConfigFile({
+        AFFINE_BASE_URL: baseUrl,
+        AFFINE_API_TOKEN: result.token,
+        AFFINE_WORKSPACE_ID: result.workspaceId,
+    });
+    console.error(`\n✓ Saved to ${CONFIG_FILE} (mode 600)`);
+    console.error("The MCP server will use these credentials automatically.");
+}
+async function status() {
+    const config = loadConfigFile();
+    if (!config.AFFINE_API_TOKEN) {
+        throw new CliError("Not logged in. Run: affine-mcp login");
+    }
+    console.error(`Config: ${CONFIG_FILE}`);
+    console.error(`URL:       ${config.AFFINE_BASE_URL || "(default)"}`);
+    console.error(`Token:     (set)`);
+    console.error(`Workspace: ${config.AFFINE_WORKSPACE_ID || "(none)"}\n`);
+    try {
+        const data = await gql(config.AFFINE_BASE_URL || "https://app.affine.pro", { token: config.AFFINE_API_TOKEN }, "query { currentUser { name email } workspaces { id } }");
+        console.error(`User: ${data.currentUser.name} <${data.currentUser.email}>`);
+        console.error(`Workspaces: ${data.workspaces.length}`);
+    }
+    catch (err) {
+        throw new CliError(`Connection failed: ${err.message}`);
+    }
+}
+function logout() {
+    if (fs.existsSync(CONFIG_FILE)) {
+        fs.unlinkSync(CONFIG_FILE);
+        console.error(`Removed ${CONFIG_FILE}`);
+    }
+    else {
+        console.error("No config file found.");
+    }
+}
+const COMMANDS = { login, status, logout };
+export async function runCli(command) {
+    const fn = COMMANDS[command];
+    if (!fn)
+        return false;
+    try {
+        await fn();
+    }
+    catch (err) {
+        if (err instanceof CliError) {
+            console.error(`✗ ${err.message}`);
+            process.exit(1);
+        }
+        throw err;
+    }
+    return true;
+}

package/dist/config.js

@@ -1,45 +1,132 @@
-const defaultEndpoints = {
-    listWorkspaces: { method: "GET", path: "/api/workspaces" },
-    listDocs: { method: "GET", path: "/api/workspaces/:workspaceId/docs" },
-    getDoc: { method: "GET", path: "/api/docs/:docId" },
-    createDoc: { method: "POST", path: "/api/workspaces/:workspaceId/docs" },
-    updateDoc: { method: "PATCH", path: "/api/docs/:docId" },
-    deleteDoc: { method: "DELETE", path: "/api/docs/:docId" },
-    searchDocs: {
-        method: "GET",
-        path: "/api/workspaces/:workspaceId/search"
-    }
-};
-export function loadConfig() {
-    const baseUrl = process.env.AFFINE_BASE_URL?.replace(/\/$/, "") || "http://localhost:3010";
-    const apiToken = process.env.AFFINE_API_TOKEN;
-    const cookie = process.env.AFFINE_COOKIE;
-    const email = process.env.AFFINE_EMAIL;
-    const password = process.env.AFFINE_PASSWORD;
-    let headers = undefined;
-    const headersJson = process.env.AFFINE_HEADERS_JSON;
-    if (headersJson) {
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { createRequire } from "module";
+const require = createRequire(import.meta.url);
+const pkg = require("../package.json");
+export const VERSION = pkg.version;
+/** Config file location: ~/.config/affine-mcp/config */
+const CONFIG_DIR = path.join(process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"), "affine-mcp");
+export const CONFIG_FILE = path.join(CONFIG_DIR, "config");
+/** Read key=value config file, returns empty object if missing */
+export function loadConfigFile() {
+    if (!fs.existsSync(CONFIG_FILE))
+        return {};
+    const content = fs.readFileSync(CONFIG_FILE, "utf-8");
+    const result = {};
+    for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#"))
+            continue;
+        const eq = trimmed.indexOf("=");
+        if (eq === -1)
+            continue;
+        result[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+    }
+    return result;
+}
+/** Write config file atomically with 600 permissions (temp + rename). */
+export function writeConfigFile(vars) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    const lines = [
+        "# Affine MCP Server credentials",
+        "# Generated by: affine-mcp login",
+        `# ${new Date().toISOString()}`,
+    ];
+    for (const [key, value] of Object.entries(vars)) {
+        if (value)
+            lines.push(`${key}=${value}`);
+    }
+    lines.push("");
+    // Atomic write: write to temp file then rename to prevent partial reads
+    const tmpFile = path.join(CONFIG_DIR, `.config.tmp.${process.pid}`);
+    try {
+        fs.writeFileSync(tmpFile, lines.join("\n"), { mode: 0o600 });
+        fs.renameSync(tmpFile, CONFIG_FILE);
+    }
+    catch (err) {
+        // Clean up temp file on failure
         try {
-            headers = JSON.parse(headersJson);
-        }
-        catch (e) {
-            console.warn("Failed to parse AFFINE_HEADERS_JSON; ignoring.");
+            fs.unlinkSync(tmpFile);
         }
+        catch { }
+        throw err;
     }
-    if (cookie) {
-        headers = { ...(headers || {}), Cookie: cookie };
+}
+/** Validate and sanitize a base URL. Throws on invalid or dangerous URLs. */
+export function validateBaseUrl(input) {
+    let parsed;
+    try {
+        parsed = new URL(input);
     }
-    const graphqlPath = process.env.AFFINE_GRAPHQL_PATH || "/graphql";
-    const defaultWorkspaceId = process.env.AFFINE_WORKSPACE_ID;
-    let endpoints = defaultEndpoints;
-    const endpointsJson = process.env.AFFINE_ENDPOINTS_JSON;
-    if (endpointsJson) {
-        try {
-            endpoints = { ...defaultEndpoints, ...JSON.parse(endpointsJson) };
+    catch {
+        throw new Error(`Invalid URL: ${input}`);
+    }
+    // Reject credentials embedded in URL (SSRF vector)
+    if (parsed.username || parsed.password) {
+        throw new Error("URL must not contain embedded credentials (user:pass@host)");
+    }
+    // Only allow http and https schemes
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        throw new Error(`Unsupported URL scheme: ${parsed.protocol} (only http/https allowed)`);
+    }
+    // Warn (but allow) plain HTTP for non-local targets
+    const host = parsed.hostname;
+    const isLocal = host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "0.0.0.0";
+    if (parsed.protocol === "http:" && !isLocal) {
+        console.error("WARNING: Using plain HTTP for a non-localhost URL. Consider HTTPS for security.");
+    }
+    // Return normalized URL without trailing slash
+    return parsed.origin + parsed.pathname.replace(/\/$/, "");
+}
+/**
+ * Helper: read env var with config file fallback.
+ * Environment variables always take priority over the config file.
+ */
+function env(name, file, fallback) {
+    return process.env[name] || file[name] || fallback;
+}
+function parseHeadersJson(raw) {
+    if (!raw)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            console.warn("Failed to parse AFFINE_HEADERS_JSON; expected a JSON object of string headers.");
+            return undefined;
+        }
+        const headers = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (typeof value !== "string") {
+                console.warn(`Ignoring non-string AFFINE_HEADERS_JSON value for header '${key}'.`);
+                continue;
+            }
+            headers[key] = value;
         }
-        catch (e) {
-            console.warn("Failed to parse AFFINE_ENDPOINTS_JSON; using defaults.");
+        const sensitiveKeys = Object.keys(headers).filter((k) => /^(authorization|cookie)$/i.test(k));
+        if (sensitiveKeys.length) {
+            console.warn(`WARNING: AFFINE_HEADERS_JSON contains sensitive key(s): ${sensitiveKeys.join(", ")}. ` +
+                `These may conflict with built-in auth and are not protected by debug-logging guards.`);
         }
+        return headers;
+    }
+    catch {
+        console.warn("Failed to parse AFFINE_HEADERS_JSON; ignoring.");
+        return undefined;
+    }
+}
+export function loadConfig() {
+    const file = loadConfigFile();
+    const baseUrl = validateBaseUrl(env("AFFINE_BASE_URL", file, "http://localhost:3010"));
+    const apiToken = env("AFFINE_API_TOKEN", file);
+    const cookie = env("AFFINE_COOKIE", file);
+    const email = env("AFFINE_EMAIL", file);
+    const password = env("AFFINE_PASSWORD", file);
+    let headers = parseHeadersJson(process.env.AFFINE_HEADERS_JSON);
+    if (cookie) {
+        headers = { ...(headers || {}), Cookie: cookie };
     }
-    return { baseUrl, apiToken, cookie, headers, graphqlPath, email, password, defaultWorkspaceId, endpoints };
+    const graphqlPath = env("AFFINE_GRAPHQL_PATH", file, "/graphql");
+    const defaultWorkspaceId = env("AFFINE_WORKSPACE_ID", file);
+    return { baseUrl, apiToken, cookie, headers, graphqlPath, email, password, defaultWorkspaceId };
 }

package/dist/graphqlClient.js

@@ -1,27 +1,54 @@
 import { fetch } from "undici";
+import { VERSION } from "./config.js";
+const GQL_FETCH_TIMEOUT_MS = 30_000;
+/** Strip HTML tags and truncate to a safe length for error messages. */
+function sanitizeErrorBody(s, max = 200) {
+    const stripped = s.replace(/<[^>]*>/g, "").replace(/\s+/g, " ").trim();
+    return stripped.length > max ? stripped.slice(0, max) + "..." : stripped;
+}
 export class GraphQLClient {
     opts;
-    headers;
+    _headers;
     authenticated = false;
     constructor(opts) {
         this.opts = opts;
-        this.headers = { ...(opts.headers || {}) };
+        this._headers = { ...(opts.headers || {}) };
         // Set authentication in priority order
         if (opts.bearer) {
-            this.headers["Authorization"] = `Bearer ${opts.bearer}`;
+            this._headers["Authorization"] = `Bearer ${opts.bearer}`;
             this.authenticated = true;
             console.error("Using Bearer token authentication");
         }
-        else if (this.headers.Cookie) {
+        else if (this._headers.Cookie) {
             this.authenticated = true;
             console.error("Using Cookie authentication");
         }
     }
+    /** The GraphQL endpoint URL */
+    get endpoint() {
+        return this.opts.endpoint;
+    }
+    /** Current request headers (including auth) */
+    get headers() {
+        return { ...this._headers };
+    }
+    /** Cookie header value, if set */
+    get cookie() {
+        return this._headers["Cookie"] || "";
+    }
+    /** Bearer token, if set */
+    get bearer() {
+        const auth = this._headers["Authorization"] || "";
+        return auth.startsWith("Bearer ") ? auth.slice(7) : "";
+    }
     setHeaders(next) {
-        this.headers = { ...this.headers, ...next };
+        this._headers = { ...this._headers, ...next };
     }
     setCookie(cookieHeader) {
-        this.headers["Cookie"] = cookieHeader;
+        if (/[\r\n]/.test(cookieHeader)) {
+            throw new Error("Cookie header contains illegal CR/LF characters");
+        }
+        this._headers["Cookie"] = cookieHeader;
         this.authenticated = true;
         console.error("Session cookies set from email/password login");
     }
@@ -29,16 +56,60 @@ export class GraphQLClient {
         return this.authenticated;
     }
     async request(query, variables) {
-        const headers = { "Content-Type": "application/json", ...this.headers };
-        const res = await fetch(this.opts.endpoint, {
-            method: "POST",
-            headers,
-            body: JSON.stringify({ query, variables })
-        });
+        const headers = {
+            "Content-Type": "application/json",
+            "User-Agent": `affine-mcp-server/${VERSION}`,
+            ...this._headers,
+        };
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), GQL_FETCH_TIMEOUT_MS);
+        let res;
+        try {
+            res = await fetch(this.opts.endpoint, {
+                method: "POST",
+                headers,
+                body: JSON.stringify({ query, variables }),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            if (err.name === "AbortError")
+                throw new Error(`GraphQL request timed out after ${GQL_FETCH_TIMEOUT_MS / 1000}s`);
+            throw err;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        // Handle redirects (undici may follow them but strip auth headers)
+        if (res.status >= 300 && res.status < 400) {
+            const location = res.headers.get("location");
+            throw new Error(`GraphQL endpoint returned redirect ${res.status} -> ${location || "(no location)"}. ` +
+                `Check AFFINE_BASE_URL.`);
+        }
+        const contentType = res.headers.get("content-type") || "";
+        // Guard against non-JSON responses (Cloudflare challenges, HTML error pages)
+        if (!contentType.includes("application/json") && !contentType.includes("application/graphql")) {
+            const body = await res.text();
+            const snippet = sanitizeErrorBody(body);
+            throw new Error(`GraphQL endpoint returned non-JSON response (${res.status} ${res.statusText}, ` +
+                `Content-Type: ${contentType || "(none)"}). Body: ${snippet}`);
+        }
+        if (!res.ok) {
+            // Try to parse error body as JSON
+            let body;
+            try {
+                const json = await res.json();
+                body = json.errors?.map((e) => e.message).join("; ") || JSON.stringify(json);
+            }
+            catch {
+                body = await res.text().catch(() => "(unreadable body)");
+            }
+            throw new Error(`GraphQL HTTP ${res.status}: ${sanitizeErrorBody(body)}`);
+        }
         const json = await res.json();
-        if (!res.ok || json.errors) {
-            const msg = json.errors?.map((e) => e.message).join("; ") || res.statusText;
-            throw new Error(`GraphQL error: ${msg}`);
+        if (json.errors) {
+            const msg = json.errors.map((e) => e.message).join("; ");
+            throw new Error(`GraphQL error: ${sanitizeErrorBody(msg)}`);
         }
         return json.data;
     }