drawio-mcp-server 2.0.4 → 2.1.0

package/build/tls/index.test.js

@@ -0,0 +1,141 @@
+import { describe, it, expect } from "@jest/globals";
+import { mkdtempSync, readFileSync, existsSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { resolveTlsMaterial } from "./index.js";
+import { tlsFilePaths } from "./paths.js";
+function tmpDir(prefix = "tls-resolve-") {
+    return mkdtempSync(join(tmpdir(), prefix));
+}
+function writePem(dir, name, body) {
+    const p = join(dir, name);
+    writeFileSync(p, body);
+    return p;
+}
+const VALID_CERT = `-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n`;
+const VALID_KEY = `-----BEGIN PRIVATE KEY-----\nMIIE\n-----END PRIVATE KEY-----\n`;
+describe("resolveTlsMaterial — none", () => {
+    it("returns null when TLS disabled", () => {
+        expect(resolveTlsMaterial({
+            config: { tlsEnabled: false },
+            log: () => { },
+        })).toBeNull();
+    });
+});
+describe("resolveTlsMaterial — manual", () => {
+    it("loads cert + key from explicit paths", () => {
+        const dir = tmpDir();
+        const certPath = writePem(dir, "c.pem", VALID_CERT);
+        const keyPath = writePem(dir, "k.pem", VALID_KEY);
+        const m = resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsCert: certPath, tlsKey: keyPath },
+            log: () => { },
+        });
+        expect(m).toEqual({ cert: VALID_CERT, key: VALID_KEY, caPath: undefined });
+    });
+});
+describe("resolveTlsMaterial — auto", () => {
+    it("first run generates CA + leaf and returns material with caPath", () => {
+        const dir = tmpDir();
+        const messages = [];
+        const m = resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: (msg) => messages.push(msg),
+        });
+        expect(m?.cert).toContain("BEGIN CERTIFICATE");
+        expect(m?.key).toContain("PRIVATE KEY");
+        expect(m?.caPath).toBe(tlsFilePaths(dir).caCert);
+        expect(existsSync(tlsFilePaths(dir).caCert)).toBe(true);
+        expect(existsSync(tlsFilePaths(dir).caKey)).toBe(true);
+        expect(existsSync(tlsFilePaths(dir).serverCert)).toBe(true);
+        expect(existsSync(tlsFilePaths(dir).serverKey)).toBe(true);
+        expect(messages.some((m) => m.includes("Install the local CA"))).toBe(true);
+    });
+    it("second run reuses material when SAN unchanged and material valid", () => {
+        const dir = tmpDir();
+        const m1 = resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: () => { },
+        });
+        const caBefore = readFileSync(tlsFilePaths(dir).caCert, "utf8");
+        const leafBefore = readFileSync(tlsFilePaths(dir).serverCert, "utf8");
+        const m2 = resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: () => { },
+        });
+        expect(m2?.cert).toBe(m1?.cert);
+        expect(readFileSync(tlsFilePaths(dir).caCert, "utf8")).toBe(caBefore);
+        expect(readFileSync(tlsFilePaths(dir).serverCert, "utf8")).toBe(leafBefore);
+    });
+    it("regenerates leaf only (CA preserved) when SAN changes", () => {
+        const dir = tmpDir();
+        resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: () => { },
+        });
+        const caBefore = readFileSync(tlsFilePaths(dir).caCert, "utf8");
+        const leafBefore = readFileSync(tlsFilePaths(dir).serverCert, "utf8");
+        const m2 = resolveTlsMaterial({
+            config: {
+                tlsEnabled: true,
+                tlsAuto: true,
+                tlsDir: dir,
+                host: "192.168.1.10",
+            },
+            log: () => { },
+        });
+        expect(readFileSync(tlsFilePaths(dir).caCert, "utf8")).toBe(caBefore);
+        expect(readFileSync(tlsFilePaths(dir).serverCert, "utf8")).not.toBe(leafBefore);
+        expect(m2?.cert).toContain("BEGIN CERTIFICATE");
+    });
+    it("throws when both manual and auto specified", () => {
+        expect(() => resolveTlsMaterial({
+            config: {
+                tlsEnabled: true,
+                tlsAuto: true,
+                tlsCert: "/c",
+                tlsKey: "/k",
+            },
+            log: () => { },
+        })).toThrow(/cannot combine.*--tls-auto.*--tls-cert/i);
+    });
+    it("throws when tlsEnabled but no mode chosen", () => {
+        expect(() => resolveTlsMaterial({ config: { tlsEnabled: true }, log: () => { } })).toThrow(/--tls requires either --tls-auto or --tls-cert\/--tls-key/i);
+    });
+    it("renews leaf only (CA preserved) when leaf is within 30-day window", () => {
+        const dir = tmpDir();
+        resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: () => { },
+            now: new Date("2024-01-01T00:00:00Z"),
+        });
+        const caBefore = readFileSync(tlsFilePaths(dir).caCert, "utf8");
+        const leafBefore = readFileSync(tlsFilePaths(dir).serverCert, "utf8");
+        const messages = [];
+        resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: (msg) => messages.push(msg),
+            now: new Date("2024-12-10T00:00:00Z"),
+        });
+        expect(readFileSync(tlsFilePaths(dir).caCert, "utf8")).toBe(caBefore);
+        expect(readFileSync(tlsFilePaths(dir).serverCert, "utf8")).not.toBe(leafBefore);
+        expect(messages.some((m) => m.includes("Renewed TLS leaf"))).toBe(true);
+    });
+    it("regenerates CA + leaf when CA is within 30-day window", () => {
+        const dir = tmpDir();
+        resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: () => { },
+            now: new Date("2024-01-01T00:00:00Z"),
+        });
+        const caBefore = readFileSync(tlsFilePaths(dir).caCert, "utf8");
+        const messages = [];
+        resolveTlsMaterial({
+            config: { tlsEnabled: true, tlsAuto: true, tlsDir: dir, host: undefined },
+            log: (msg) => messages.push(msg),
+            now: new Date("2033-12-10T00:00:00Z"),
+        });
+        expect(readFileSync(tlsFilePaths(dir).caCert, "utf8")).not.toBe(caBefore);
+        expect(messages.some((m) => m.includes("Install the local CA"))).toBe(true);
+    });
+});

package/build/tls/install-hint.js

@@ -0,0 +1,45 @@
+export function caInstallHint(args) {
+    const { platform, caPath } = args;
+    if (platform === "darwin") {
+        return [
+            `Install the local CA into the macOS System keychain so browsers trust it:`,
+            ``,
+            `  sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${caPath}`,
+            ``,
+            `Then quit and restart the browser.`,
+        ].join("\n");
+    }
+    if (platform === "win32") {
+        return [
+            `Install the local CA into the Windows Trusted Root store (run as Administrator):`,
+            ``,
+            `  certutil -addstore -f ROOT "${caPath}"`,
+            ``,
+            `Then quit and restart the browser.`,
+        ].join("\n");
+    }
+    if (platform === "linux") {
+        return [
+            `Install the local CA so the system and browsers trust it.`,
+            ``,
+            `Debian/Ubuntu:`,
+            `  sudo cp ${caPath} /usr/local/share/ca-certificates/drawio-mcp-ca.crt`,
+            `  sudo update-ca-certificates`,
+            ``,
+            `Fedora/RHEL:`,
+            `  sudo cp ${caPath} /etc/pki/ca-trust/source/anchors/drawio-mcp-ca.crt`,
+            `  sudo update-ca-trust extract`,
+            ``,
+            `Arch/Manjaro:`,
+            `  sudo trust anchor --store ${caPath}`,
+            ``,
+            `Firefox uses its own NSS store; import via Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import.`,
+            ``,
+            `Then quit and restart the browser.`,
+        ].join("\n");
+    }
+    return [
+        `Install the local CA at ${caPath} into your OS / browser trust store.`,
+        `Without this, browsers will reject the self-signed certificate.`,
+    ].join("\n");
+}

package/build/tls/install-hint.test.js

@@ -0,0 +1,32 @@
+import { describe, it, expect } from "@jest/globals";
+import { caInstallHint } from "./install-hint.js";
+describe("caInstallHint", () => {
+    it("Linux hint mentions update-ca-certificates and Firefox NSS", () => {
+        const hint = caInstallHint({ platform: "linux", caPath: "/x/ca.crt" });
+        expect(hint).toContain("/x/ca.crt");
+        expect(hint).toMatch(/update-ca-certificates|trust anchor/i);
+        expect(hint).toMatch(/firefox/i);
+    });
+    it("macOS hint mentions security add-trusted-cert", () => {
+        const hint = caInstallHint({ platform: "darwin", caPath: "/x/ca.crt" });
+        expect(hint).toContain("security add-trusted-cert");
+        expect(hint).toContain("/x/ca.crt");
+    });
+    it("Windows hint mentions certutil -addstore", () => {
+        const hint = caInstallHint({
+            platform: "win32",
+            caPath: "C:\\x\\ca.crt",
+        });
+        expect(hint).toContain("certutil");
+        expect(hint).toContain("ROOT");
+        expect(hint).toContain("C:\\x\\ca.crt");
+    });
+    it("falls back to generic hint on unknown platform", () => {
+        const hint = caInstallHint({
+            platform: "freebsd",
+            caPath: "/x/ca.crt",
+        });
+        expect(hint).toContain("/x/ca.crt");
+        expect(hint).toMatch(/trust store/i);
+    });
+});

package/build/tls/load.js

@@ -0,0 +1,18 @@
+import { existsSync, readFileSync } from "node:fs";
+export function loadManualMaterial(args) {
+    if (!existsSync(args.certPath)) {
+        throw new Error(`TLS cert file not found: ${args.certPath}`);
+    }
+    if (!existsSync(args.keyPath)) {
+        throw new Error(`TLS key file not found: ${args.keyPath}`);
+    }
+    const cert = readFileSync(args.certPath, "utf8");
+    const key = readFileSync(args.keyPath, "utf8");
+    if (!cert.includes("BEGIN CERTIFICATE")) {
+        throw new Error(`TLS cert at ${args.certPath} is not PEM-encoded (missing BEGIN CERTIFICATE)`);
+    }
+    if (!key.includes("PRIVATE KEY")) {
+        throw new Error(`TLS key at ${args.keyPath} is not PEM-encoded (missing PRIVATE KEY)`);
+    }
+    return { cert, key };
+}

package/build/tls/load.test.js

@@ -0,0 +1,40 @@
+import { describe, it, expect } from "@jest/globals";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { loadManualMaterial } from "./load.js";
+function tmpFile(content) {
+    const dir = mkdtempSync(join(tmpdir(), "tls-load-"));
+    const path = join(dir, "file.pem");
+    writeFileSync(path, content);
+    return path;
+}
+const VALID_CERT = `-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n`;
+const VALID_KEY = `-----BEGIN PRIVATE KEY-----\nMIIE\n-----END PRIVATE KEY-----\n`;
+describe("loadManualMaterial", () => {
+    it("reads cert and key from disk", () => {
+        const certPath = tmpFile(VALID_CERT);
+        const keyPath = tmpFile(VALID_KEY);
+        const m = loadManualMaterial({ certPath, keyPath });
+        expect(m.cert).toBe(VALID_CERT);
+        expect(m.key).toBe(VALID_KEY);
+    });
+    it("throws when cert file missing", () => {
+        const keyPath = tmpFile(VALID_KEY);
+        expect(() => loadManualMaterial({ certPath: "/nope/cert.pem", keyPath })).toThrow(/cert.*not found/i);
+    });
+    it("throws when key file missing", () => {
+        const certPath = tmpFile(VALID_CERT);
+        expect(() => loadManualMaterial({ certPath, keyPath: "/nope/key.pem" })).toThrow(/key.*not found/i);
+    });
+    it("throws when cert lacks BEGIN CERTIFICATE marker", () => {
+        const certPath = tmpFile("not pem");
+        const keyPath = tmpFile(VALID_KEY);
+        expect(() => loadManualMaterial({ certPath, keyPath })).toThrow(/BEGIN CERTIFICATE/);
+    });
+    it("throws when key lacks PRIVATE KEY marker", () => {
+        const certPath = tmpFile(VALID_CERT);
+        const keyPath = tmpFile("not pem");
+        expect(() => loadManualMaterial({ certPath, keyPath })).toThrow(/PRIVATE KEY/);
+    });
+});

package/build/tls/paths.js

@@ -0,0 +1,30 @@
+import { join as joinPosix } from "node:path/posix";
+import { join as joinWin32 } from "node:path/win32";
+import { join } from "node:path";
+export const APP_NAME = "drawio-mcp-server";
+export function resolveTlsDir(args) {
+    if (args.override && args.override.length > 0)
+        return args.override;
+    if (args.platform === "darwin") {
+        return joinPosix(args.home, "Library", "Application Support", APP_NAME, "tls");
+    }
+    if (args.platform === "win32") {
+        const base = args.env.LOCALAPPDATA && args.env.LOCALAPPDATA.length > 0
+            ? args.env.LOCALAPPDATA
+            : joinWin32(args.home, "AppData", "Local");
+        return joinWin32(base, APP_NAME, "tls");
+    }
+    // Linux + other unix
+    const xdg = args.env.XDG_DATA_HOME;
+    const base = xdg && xdg.length > 0 ? xdg : joinPosix(args.home, ".local", "share");
+    return joinPosix(base, APP_NAME, "tls");
+}
+export function tlsFilePaths(dir) {
+    return {
+        caCert: join(dir, "ca.crt"),
+        caKey: join(dir, "ca.key"),
+        serverCert: join(dir, "server.crt"),
+        serverKey: join(dir, "server.key"),
+        meta: join(dir, "meta.json"),
+    };
+}

package/build/tls/paths.test.js

@@ -0,0 +1,53 @@
+import { describe, it, expect } from "@jest/globals";
+import { join } from "node:path";
+import { resolveTlsDir, tlsFilePaths } from "./paths.js";
+describe("resolveTlsDir", () => {
+    it("uses explicit override when provided", () => {
+        expect(resolveTlsDir({
+            override: "/tmp/x",
+            platform: "linux",
+            env: {},
+            home: "/h",
+        })).toBe("/tmp/x");
+    });
+    it("Linux: honours XDG_DATA_HOME", () => {
+        expect(resolveTlsDir({
+            platform: "linux",
+            env: { XDG_DATA_HOME: "/custom/data" },
+            home: "/home/u",
+        })).toBe("/custom/data/drawio-mcp-server/tls");
+    });
+    it("Linux: defaults to ~/.local/share when XDG_DATA_HOME is unset", () => {
+        expect(resolveTlsDir({ platform: "linux", env: {}, home: "/home/u" })).toBe("/home/u/.local/share/drawio-mcp-server/tls");
+    });
+    it("macOS: defaults to ~/Library/Application Support", () => {
+        expect(resolveTlsDir({ platform: "darwin", env: {}, home: "/Users/u" })).toBe("/Users/u/Library/Application Support/drawio-mcp-server/tls");
+    });
+    it("Windows: honours LOCALAPPDATA", () => {
+        expect(resolveTlsDir({
+            platform: "win32",
+            env: { LOCALAPPDATA: "C:\\Users\\u\\AppData\\Local" },
+            home: "C:\\Users\\u",
+        })).toBe("C:\\Users\\u\\AppData\\Local\\drawio-mcp-server\\tls");
+    });
+    it("Windows: falls back to ~/AppData/Local when LOCALAPPDATA unset", () => {
+        expect(resolveTlsDir({ platform: "win32", env: {}, home: "C:\\Users\\u" })).toBe("C:\\Users\\u\\AppData\\Local\\drawio-mcp-server\\tls");
+    });
+    it("treats empty XDG_DATA_HOME as unset", () => {
+        expect(resolveTlsDir({
+            platform: "linux",
+            env: { XDG_DATA_HOME: "" },
+            home: "/h",
+        })).toBe("/h/.local/share/drawio-mcp-server/tls");
+    });
+});
+describe("tlsFilePaths", () => {
+    it("returns expected file names under given dir", () => {
+        const p = tlsFilePaths("/base");
+        expect(p.caCert).toBe(join("/base", "ca.crt"));
+        expect(p.caKey).toBe(join("/base", "ca.key"));
+        expect(p.serverCert).toBe(join("/base", "server.crt"));
+        expect(p.serverKey).toBe(join("/base", "server.key"));
+        expect(p.meta).toBe(join("/base", "meta.json"));
+    });
+});

package/build/tls/san.js

@@ -0,0 +1,27 @@
+import { createHash } from "node:crypto";
+import { isIP } from "node:net";
+const LOOPBACK_DEFAULTS = [
+    { type: "dns", value: "localhost" },
+    { type: "ip", value: "127.0.0.1" },
+    { type: "ip", value: "::1" },
+];
+export function buildSanList(host) {
+    const entries = [...LOOPBACK_DEFAULTS];
+    if (!host || host === "0.0.0.0" || host === "::")
+        return entries;
+    const family = isIP(host);
+    if (family === 0)
+        return entries;
+    const candidate = { type: "ip", value: host };
+    const exists = entries.some((e) => e.type === candidate.type && e.value === candidate.value);
+    if (!exists)
+        entries.push(candidate);
+    return entries;
+}
+export function sanHash(entries) {
+    const canonical = [...entries]
+        .map((e) => `${e.type}:${e.value}`)
+        .sort()
+        .join("|");
+    return createHash("sha256").update(canonical).digest("hex");
+}

package/build/tls/san.test.js

@@ -0,0 +1,72 @@
+import { describe, it, expect } from "@jest/globals";
+import { buildSanList, sanHash } from "./san.js";
+describe("buildSanList", () => {
+    it("returns loopback defaults when host is undefined", () => {
+        expect(buildSanList(undefined)).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+        ]);
+    });
+    it("appends explicit IPv4 host without duplicating loopback", () => {
+        expect(buildSanList("192.168.1.10")).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+            { type: "ip", value: "192.168.1.10" },
+        ]);
+    });
+    it("appends explicit IPv6 host without duplicating loopback", () => {
+        expect(buildSanList("fe80::1")).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+            { type: "ip", value: "fe80::1" },
+        ]);
+    });
+    it("does not duplicate when host equals an existing loopback entry", () => {
+        expect(buildSanList("127.0.0.1")).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+        ]);
+    });
+    it("treats 0.0.0.0 as a wildcard binding, still using loopback SAN set", () => {
+        expect(buildSanList("0.0.0.0")).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+        ]);
+    });
+    it("treats :: as an IPv6 wildcard binding, still using loopback SAN set", () => {
+        expect(buildSanList("::")).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+        ]);
+    });
+    it("silently ignores non-IP hosts (hostname strings are not added as SAN entries)", () => {
+        expect(buildSanList("example.com")).toEqual([
+            { type: "dns", value: "localhost" },
+            { type: "ip", value: "127.0.0.1" },
+            { type: "ip", value: "::1" },
+        ]);
+    });
+});
+describe("sanHash", () => {
+    it("is stable for identical input", () => {
+        const a = sanHash(buildSanList("192.168.1.10"));
+        const b = sanHash(buildSanList("192.168.1.10"));
+        expect(a).toBe(b);
+    });
+    it("differs when host changes", () => {
+        const a = sanHash(buildSanList(undefined));
+        const b = sanHash(buildSanList("192.168.1.10"));
+        expect(a).not.toBe(b);
+    });
+    it("is order-insensitive (canonicalised)", () => {
+        const original = buildSanList("192.168.1.10");
+        const reversed = [...original].reverse();
+        expect(sanHash(reversed)).toBe(sanHash(original));
+    });
+});