d365fo-mcp 1.0.0

package/dist/middleware/apiKeyAuth.js

@@ -0,0 +1,70 @@
+import { timingSafeEqual } from 'node:crypto';
+/**
+ * API Key authentication middleware for HTTP mode.
+ *
+ * When the `API_KEY` environment variable is set, every request (except
+ * unauthenticated paths like `/health`) must include a matching key in
+ * one of these locations (checked in order):
+ *
+ *   1. `X-Api-Key` header          — preferred for MCP clients
+ *   2. `Authorization: Bearer <key>` header — works with tools that only support Bearer
+ *
+ * If `API_KEY` is NOT set, the middleware is a pass-through (no-op) so
+ * existing deployments keep working without changes.
+ *
+ * Timing-safe comparison is used to prevent timing side-channel attacks.
+ */
+const API_KEY = process.env.API_KEY?.trim();
+/** Paths that never require authentication */
+const PUBLIC_PATHS = new Set(['/', '/health']);
+/**
+ * Constant-time string comparison.
+ * Returns false immediately only when lengths differ (which is already
+ * observable via response time in any string comparison).
+ */
+function safeCompare(a, b) {
+    if (a.length !== b.length)
+        return false;
+    return timingSafeEqual(Buffer.from(a, 'utf8'), Buffer.from(b, 'utf8'));
+}
+function extractApiKey(req) {
+    // 1. X-Api-Key header (preferred)
+    const xApiKey = req.headers['x-api-key'];
+    if (typeof xApiKey === 'string' && xApiKey.length > 0) {
+        return xApiKey;
+    }
+    // 2. Authorization: Bearer <key>
+    const authHeader = req.headers['authorization'];
+    if (typeof authHeader === 'string' && authHeader.toLowerCase().startsWith('bearer ')) {
+        const token = authHeader.slice(7).trim();
+        if (token.length > 0)
+            return token;
+    }
+    return null;
+}
+/**
+ * Express middleware that enforces API key authentication.
+ * Mount BEFORE any route handlers.
+ */
+export function apiKeyAuth(req, res, next) {
+    // No API_KEY configured → auth disabled, pass through
+    if (!API_KEY) {
+        next();
+        return;
+    }
+    // Public endpoints are always accessible (Azure health probes, etc.)
+    if (PUBLIC_PATHS.has(req.path)) {
+        next();
+        return;
+    }
+    const provided = extractApiKey(req);
+    if (!provided || !safeCompare(provided, API_KEY)) {
+        res.status(401).json({
+            error: 'Unauthorized',
+            message: 'Missing or invalid API key. Provide it via X-Api-Key header or Authorization: Bearer <key>.',
+        });
+        return;
+    }
+    next();
+}
+//# sourceMappingURL=apiKeyAuth.js.map

package/dist/middleware/apiKeyAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyAuth.js","sourceRoot":"","sources":["../../src/middleware/apiKeyAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;GAcG;AAEH,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;AAE5C,8CAA8C;AAC9C,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/C;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,kCAAkC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iCAAiC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IACrC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACxE,sDAAsD;IACtD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAEpC,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,6FAA6F;SACvG,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,EAAE,CAAC;AACT,CAAC"}

package/dist/middleware/rateLimiter.d.ts

@@ -0,0 +1,7 @@
+/**
+ * General API rate limiter. Default 500 requests per 15 minutes per user
+ * token (or IP as fallback) — a single chat interaction can consume 10-20
+ * requests, so this stays generous. Override via RATE_LIMIT_MAX_REQUESTS.
+ */
+export declare const apiRateLimiter: import("express-rate-limit").RateLimitRequestHandler;
+//# sourceMappingURL=rateLimiter.d.ts.map

package/dist/middleware/rateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiter.d.ts","sourceRoot":"","sources":["../../src/middleware/rateLimiter.ts"],"names":[],"mappings":"AAsDA;;;;GAIG;AACH,eAAO,MAAM,cAAc,sDAyBzB,CAAC"}

package/dist/middleware/rateLimiter.js

@@ -0,0 +1,78 @@
+import rateLimit, { ipKeyGenerator } from 'express-rate-limit';
+import { createHash } from 'crypto';
+/**
+ * Rate limiter configuration for different endpoint types
+ */
+/**
+ * Safely parse an integer environment variable.
+ * Returns defaultVal when the value is missing, non-numeric, or outside [min, max].
+ */
+function parseEnvInt(key, defaultVal, min, max) {
+    const raw = process.env[key];
+    if (raw === undefined)
+        return defaultVal;
+    const parsed = parseInt(raw, 10);
+    if (isNaN(parsed) || parsed < min || parsed > max) {
+        console.warn(`[rateLimiter] Invalid ${key}="${raw}" (expected ${min}–${max}), using default ${defaultVal}`);
+        return defaultVal;
+    }
+    return parsed;
+}
+/**
+ * Rate-limit key generator. When API_KEY is set, every request shares the same
+ * auth header, so that's useless as a per-user key — key by IP instead (pure
+ * per-source DoS protection; apiKeyAuth already rejects unauthenticated
+ * requests). When API_KEY is unset, the Authorization header carries a
+ * per-user token (e.g. GitHub Copilot OAuth) that separates users behind a
+ * shared IP; it's SHA-256 hashed (never logged) and still scoped to the
+ * client IP since a forged/rotated header could otherwise mint new buckets.
+ */
+const AUTH_ENABLED = !!process.env.API_KEY?.trim();
+function ipKey(req) {
+    const rawIp = req.ip || req.socket.remoteAddress || 'unknown';
+    const ipWithoutPort = rawIp.replace(/:\d+$/, '');
+    return ipKeyGenerator(ipWithoutPort);
+}
+function generateKey(req) {
+    if (AUTH_ENABLED) {
+        return 'ip:' + ipKey(req);
+    }
+    const authHeader = req.headers['authorization'];
+    if (typeof authHeader === 'string' && authHeader.length > 8) {
+        const digest = createHash('sha256').update(authHeader).digest('hex');
+        return `ip:${ipKey(req)}|tok:${digest.slice(0, 32)}`;
+    }
+    return 'ip:' + ipKey(req);
+}
+/**
+ * General API rate limiter. Default 500 requests per 15 minutes per user
+ * token (or IP as fallback) — a single chat interaction can consume 10-20
+ * requests, so this stays generous. Override via RATE_LIMIT_MAX_REQUESTS.
+ */
+export const apiRateLimiter = rateLimit({
+    windowMs: parseEnvInt('RATE_LIMIT_WINDOW_MS', 900000, 10000, 86400000), // 10s–24h
+    max: parseEnvInt('RATE_LIMIT_MAX_REQUESTS', 500, 1, 100000),
+    keyGenerator: generateKey,
+    validate: {
+        // We safely use ipKeyGenerator in our custom generateKey function
+        keyGeneratorIpFallback: false,
+    },
+    message: {
+        error: 'Too many requests for this user or IP, please try again later.',
+        retryAfter: 'Please check the Retry-After header.',
+    },
+    standardHeaders: true, // Return rate limit info in `RateLimit-*` headers
+    legacyHeaders: false, // Disable `X-RateLimit-*` headers
+    handler: (_req, res) => {
+        res.status(429).json({
+            error: 'Too many requests',
+            message: 'You have exceeded the rate limit. Please try again later.',
+            retryAfter: res.getHeader('Retry-After'),
+        });
+    },
+    skip: (req) => {
+        // Skip rate limiting for health check endpoint
+        return req.path === '/health';
+    },
+});
+//# sourceMappingURL=rateLimiter.js.map

package/dist/middleware/rateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rateLimiter.js","sourceRoot":"","sources":["../../src/middleware/rateLimiter.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,EAAE,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;GAEG;AAEH;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,UAAkB,EAAE,GAAW,EAAE,GAAW;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,yBAAyB,GAAG,KAAK,GAAG,eAAe,GAAG,IAAI,GAAG,oBAAoB,UAAU,EAAE,CAAC,CAAC;QAC5G,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;AAEnD,SAAS,KAAK,CAAC,GAAY;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IAC9D,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,cAAc,CAAC,aAAa,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,WAAW,CAAC,sBAAsB,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,UAAU;IAClF,GAAG,EAAE,WAAW,CAAC,yBAAyB,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC;IAC3D,YAAY,EAAE,WAAW;IACzB,QAAQ,EAAE;QACR,kEAAkE;QAClE,sBAAsB,EAAE,KAAK;KAC9B;IACD,OAAO,EAAE;QACP,KAAK,EAAE,gEAAgE;QACvE,UAAU,EAAE,sCAAsC;KACnD;IACD,eAAe,EAAE,IAAI,EAAE,kDAAkD;IACzE,aAAa,EAAE,KAAK,EAAE,kCAAkC;IACxD,OAAO,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACxC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,mBAAmB;YAC1B,OAAO,EAAE,2DAA2D;YACpE,UAAU,EAAE,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,GAAY,EAAE,EAAE;QACrB,+CAA+C;QAC/C,OAAO,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC;IAChC,CAAC;CACF,CAAC,CAAC"}

package/dist/prompts/codeReview.d.ts

@@ -0,0 +1,8 @@
+/**
+ * MCP Prompt: X++ Code Review
+ * Provides code review prompts for X++ best practices
+ */
+import type { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import type { XppServerContext } from '../types/context.js';
+export declare function registerCodeReviewPrompt(server: Server, context: XppServerContext): void;
+//# sourceMappingURL=codeReview.d.ts.map

package/dist/prompts/codeReview.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeReview.d.ts","sourceRoot":"","sources":["../../src/prompts/codeReview.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGxE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAW5D,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CA0mBxF"}