attio-mcp 0.1.1 → 1.0.0

package/dist/utils/uri-parser.js

@@ -7,7 +7,7 @@ import { ResourceType } from '../types/attio.js';
  * @throws Error if URI format is invalid
  */
 export function parseResourceUri(uri) {
-    const match = uri.match(/^attio:\/\/([^\/]+)\/(.+)$/);
+    const match = uri.match(/^attio:\/\/([^/]+)\/(.+)$/);
     if (!match) {
         throw new Error(`Invalid resource URI format: ${uri}`);
     }

package/dist/utils/uri-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"uri-parser.js","sourceRoot":"","sources":["../../src/utils/uri-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAEtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IAE9B,yBAAyB;IACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAuB,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,OAAuB,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkB,EAAE,EAAU;IAC9D,OAAO,WAAW,IAAI,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"uri-parser.js","sourceRoot":"","sources":["../../src/utils/uri-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAErD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;IAE9B,yBAAyB;IACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAuB,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,OAAuB,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkB,EAAE,EAAU;IAC9D,OAAO,WAAW,IAAI,IAAI,EAAE,EAAE,CAAC;AACjC,CAAC"}

package/dist/utils/validation/email-validation.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Email validation utilities for the Attio MCP Server
+ *
+ * Provides RFC 5322 compliant email validation that is consistent
+ * across the application. This replaces the inconsistent simple regex
+ * patterns that were scattered throughout the codebase.
+ */
+/**
+ * Validates an email address according to RFC 5322 with practical limitations
+ *
+ * This validation is more comprehensive than the previous simple regex and handles:
+ * - International domains
+ * - Plus addressing (user+tag@domain.com)
+ * - Multiple subdomains
+ * - TLDs from 2 to 63 characters
+ * - Proper length limits per RFC 5321
+ *
+ * @param email - The email address to validate
+ * @returns true if the email is valid, false otherwise
+ */
+export declare function isValidEmail(email: string): boolean;
+/**
+ * Validates an array of email addresses
+ *
+ * @param emails - Array of email addresses to validate
+ * @returns An object with valid and invalid email arrays
+ */
+export declare function validateEmails(emails: string[]): {
+    valid: string[];
+    invalid: string[];
+};
+/**
+ * Normalizes an email address to lowercase
+ * Note: Only the domain part should be normalized to lowercase per RFC.
+ * The local part (before @) is case-sensitive per spec, but most
+ * email providers treat it as case-insensitive.
+ *
+ * @param email - Email address to normalize
+ * @returns Normalized email address or null if invalid
+ */
+export declare function normalizeEmail(email: string): string | null;
+/**
+ * Extracts the domain from an email address
+ *
+ * @param email - Email address to extract domain from
+ * @returns Domain part of the email or null if invalid
+ */
+export declare function extractEmailDomain(email: string): string | null;
+//# sourceMappingURL=email-validation.d.ts.map

package/dist/utils/validation/email-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-validation.d.ts","sourceRoot":"","sources":["../../../src/utils/validation/email-validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAgEnD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG;IAChD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAaA;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO/D"}

package/dist/utils/validation/email-validation.js

@@ -0,0 +1,122 @@
+/**
+ * Email validation utilities for the Attio MCP Server
+ *
+ * Provides RFC 5322 compliant email validation that is consistent
+ * across the application. This replaces the inconsistent simple regex
+ * patterns that were scattered throughout the codebase.
+ */
+/**
+ * Validates an email address according to RFC 5322 with practical limitations
+ *
+ * This validation is more comprehensive than the previous simple regex and handles:
+ * - International domains
+ * - Plus addressing (user+tag@domain.com)
+ * - Multiple subdomains
+ * - TLDs from 2 to 63 characters
+ * - Proper length limits per RFC 5321
+ *
+ * @param email - The email address to validate
+ * @returns true if the email is valid, false otherwise
+ */
+export function isValidEmail(email) {
+    if (!email || typeof email !== 'string') {
+        return false;
+    }
+    // Trim whitespace
+    email = email.trim();
+    // Check for reasonable length limits (RFC 5321)
+    if (email.length === 0 || email.length > 254) {
+        return false;
+    }
+    // More comprehensive email validation regex based on RFC 5322
+    // This handles international domains, plus addressing, multiple subdomains, etc.
+    const emailRegex = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
+    if (!emailRegex.test(email)) {
+        return false;
+    }
+    // Additional validation for edge cases
+    const parts = email.split('@');
+    if (parts.length !== 2) {
+        return false;
+    }
+    const [localPart, domain] = parts;
+    // Check local part length (before @) - RFC 5321 limit
+    if (localPart.length === 0 || localPart.length > 64) {
+        return false;
+    }
+    // Check for consecutive dots in local part (not allowed per RFC 5322)
+    if (localPart.includes('..')) {
+        return false;
+    }
+    // Local part cannot start or end with dot
+    if (localPart.startsWith('.') || localPart.endsWith('.')) {
+        return false;
+    }
+    // Check domain has at least one dot
+    if (!domain.includes('.')) {
+        return false;
+    }
+    // Check domain parts
+    const domainParts = domain.split('.');
+    for (const part of domainParts) {
+        // Each domain part should not be empty and should not exceed 63 characters
+        if (part.length === 0 || part.length > 63) {
+            return false;
+        }
+        // Domain parts should not start or end with hyphen
+        if (part.startsWith('-') || part.endsWith('-')) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Validates an array of email addresses
+ *
+ * @param emails - Array of email addresses to validate
+ * @returns An object with valid and invalid email arrays
+ */
+export function validateEmails(emails) {
+    const valid = [];
+    const invalid = [];
+    for (const email of emails) {
+        if (isValidEmail(email)) {
+            valid.push(email);
+        }
+        else {
+            invalid.push(email);
+        }
+    }
+    return { valid, invalid };
+}
+/**
+ * Normalizes an email address to lowercase
+ * Note: Only the domain part should be normalized to lowercase per RFC.
+ * The local part (before @) is case-sensitive per spec, but most
+ * email providers treat it as case-insensitive.
+ *
+ * @param email - Email address to normalize
+ * @returns Normalized email address or null if invalid
+ */
+export function normalizeEmail(email) {
+    if (!isValidEmail(email)) {
+        return null;
+    }
+    // For practical purposes, convert entire email to lowercase
+    // as most email providers treat the local part as case-insensitive
+    return email.trim().toLowerCase();
+}
+/**
+ * Extracts the domain from an email address
+ *
+ * @param email - Email address to extract domain from
+ * @returns Domain part of the email or null if invalid
+ */
+export function extractEmailDomain(email) {
+    if (!isValidEmail(email)) {
+        return null;
+    }
+    const parts = email.split('@');
+    return parts[1].toLowerCase();
+}
+//# sourceMappingURL=email-validation.js.map

package/dist/utils/validation/email-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-validation.js","sourceRoot":"","sources":["../../../src/utils/validation/email-validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,kBAAkB;IAClB,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAErB,gDAAgD;IAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8DAA8D;IAC9D,iFAAiF;IACjF,MAAM,UAAU,GACd,sIAAsI,CAAC;IAEzI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,uCAAuC;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAElC,sDAAsD;IACtD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,0CAA0C;IAC1C,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qBAAqB;IACrB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,2EAA2E;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,mDAAmD;QACnD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgB;IAI7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4DAA4D;IAC5D,mEAAmE;IACnE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAChC,CAAC"}

package/dist/utils/validation/field-validation.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Field Validation Utility
+ *
+ * Provides secure field name validation to prevent parameter injection attacks
+ * and ensure only valid fields are used in API requests.
+ */
+import { ResourceType } from '../../types/attio.js';
+/**
+ * Field name sanitization options
+ */
+export interface FieldSanitizationOptions {
+    /** Whether to allow underscore characters (default: true) */
+    allowUnderscores?: boolean;
+    /** Whether to allow numeric characters (default: true) */
+    allowNumbers?: boolean;
+    /** Maximum field name length (default: 50) */
+    maxLength?: number;
+    /** Whether to convert to lowercase (default: false) */
+    toLowerCase?: boolean;
+}
+/**
+ * Field validation result
+ */
+export interface FieldValidationResult {
+    /** Whether the field is valid */
+    valid: boolean;
+    /** Sanitized field name (if valid) */
+    sanitized?: string;
+    /** Validation error message (if invalid) */
+    error?: string;
+    /** Security warnings */
+    warnings: string[];
+}
+/**
+ * Sanitize a field name to prevent injection attacks
+ * Enhanced for comprehensive security testing
+ */
+export declare function sanitizeFieldName(fieldName: string, options?: FieldSanitizationOptions): string;
+/**
+ * Validate a single field name
+ */
+export declare function validateFieldName(fieldName: string, resourceType: ResourceType, options?: FieldSanitizationOptions): FieldValidationResult;
+/**
+ * Validate an array of field names
+ */
+export declare function validateFieldNames(fieldNames: string[], resourceType: ResourceType, options?: FieldSanitizationOptions): {
+    valid: boolean;
+    sanitizedFields: string[];
+    errors: string[];
+    warnings: string[];
+};
+/**
+ * Secure field validation for API requests
+ * Throws an error if validation fails
+ * Enhanced for comprehensive security testing
+ */
+export declare function secureValidateFields(fieldNames: unknown, // Allow any type for comprehensive input validation
+resourceType: ResourceType, operation?: string): string[];
+/**
+ * Validate category names for attribute filtering
+ */
+export declare function validateCategoryName(categoryName: string): FieldValidationResult;
+/**
+ * Validate an array of category names
+ */
+export declare function validateCategoryNames(categoryNames: string[]): {
+    valid: boolean;
+    sanitizedCategories: string[];
+    errors: string[];
+    warnings: string[];
+};
+/**
+ * Secure category validation for API requests
+ * Throws an error if validation fails
+ * Enhanced for comprehensive security testing
+ */
+export declare function secureValidateCategories(categoryNames: unknown, // Allow any type for comprehensive input validation
+operation?: string): string[];
+//# sourceMappingURL=field-validation.d.ts.map

package/dist/utils/validation/field-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-validation.d.ts","sourceRoot":"","sources":["../../../src/utils/validation/field-validation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAoPpD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,0DAA0D;IAC1D,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,uDAAuD;IACvD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IAEf,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wBAAwB;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,wBAA6B,GACrC,MAAM,CAwFR;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,YAAY,EAC1B,OAAO,GAAE,wBAA6B,GACrC,qBAAqB,CA0DvB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAAE,EACpB,YAAY,EAAE,YAAY,EAC1B,OAAO,GAAE,wBAA6B,GACrC;IACD,KAAK,EAAE,OAAO,CAAC;IACf,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAsBA;AAoDD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,OAAO,EAAE,oDAAoD;AACzE,YAAY,EAAE,YAAY,EAC1B,SAAS,GAAE,MAA0B,GACpC,MAAM,EAAE,CA+EV;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,GACnB,qBAAqB,CAkDvB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG;IAC9D,KAAK,EAAE,OAAO,CAAC;IACf,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAsBA;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,aAAa,EAAE,OAAO,EAAE,oDAAoD;AAC5E,SAAS,GAAE,MAA6B,GACvC,MAAM,EAAE,CA+EV"}