llng-mcp 0.1.0

package/src/tools/instances.ts

@@ -0,0 +1,21 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { TransportRegistry } from "../transport/registry.js";
+
+export function registerInstanceTools(server: McpServer, registry: TransportRegistry): void {
+  server.tool(
+    "llng_instances",
+    "List available LLNG instances and their transport mode",
+    {},
+    async () => {
+      const instances = registry.listInstances();
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(instances, null, 2),
+          },
+        ],
+      };
+    },
+  );
+}

package/src/tools/oidc-rp.ts

@@ -0,0 +1,299 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import { TransportRegistry } from "../transport/registry.js";
+
+const RP_CONFIG_KEYS = [
+  "oidcRPMetaDataOptions",
+  "oidcRPMetaDataExportedVars",
+  "oidcRPMetaDataMacros",
+  "oidcRPMetaDataScopeRules",
+  "oidcRPMetaDataOptionsExtraClaims",
+] as const;
+
+/**
+ * Register OIDC Relying Party management tools
+ */
+export function registerOidcRpTools(server: McpServer, registry: TransportRegistry): void {
+  // 0. llng_oidc_issuer_enable - Enable OIDC issuer
+  server.tool(
+    "llng_oidc_issuer_enable",
+    "Enable OIDC issuer on the LLNG instance (activates issuerDBOpenIDConnectActivation and generates signing keys)",
+    {
+      force: z.boolean().optional().describe("Force re-enable even if already activated"),
+      instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    },
+    async (args) => {
+      try {
+        const transport = registry.getTransport(args.instance, "manager");
+        const config = await transport.configGet([
+          "issuerDBOpenIDConnectActivation",
+          "oidcServicePrivateKeySig",
+        ]);
+
+        const isActivated =
+          config["issuerDBOpenIDConnectActivation"] === 1 ||
+          config["issuerDBOpenIDConnectActivation"] === "1";
+        const hasKey =
+          typeof config["oidcServicePrivateKeySig"] === "string" &&
+          config["oidcServicePrivateKeySig"].length > 0;
+
+        if (isActivated && hasKey && !args.force) {
+          return {
+            content: [{ type: "text", text: "OIDC issuer is already enabled." }],
+          };
+        }
+
+        await transport.configSet({ issuerDBOpenIDConnectActivation: 1 });
+        await transport.execScript("rotateOidcKeys", []);
+
+        return {
+          content: [
+            {
+              type: "text",
+              text: "OIDC issuer enabled successfully. Signing keys have been generated.",
+            },
+          ],
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+            },
+          ],
+          isError: true,
+        };
+      }
+    },
+  );
+
+  // 1. llng_oidc_rp_list - List OIDC Relying Parties
+  server.tool(
+    "llng_oidc_rp_list",
+    "List configured OIDC Relying Parties with their clientID and displayName",
+    {
+      instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    },
+    async (args) => {
+      try {
+        const transport = registry.getTransport(args.instance, "manager");
+        const data = await transport.configGet(["oidcRPMetaDataOptions"]);
+        const options = data["oidcRPMetaDataOptions"];
+
+        if (!options || typeof options !== "object") {
+          return {
+            content: [{ type: "text", text: JSON.stringify([], null, 2) }],
+          };
+        }
+
+        const list = Object.entries(options).map(([confKey, opts]: [string, any]) => ({
+          confKey,
+          clientID: opts?.oidcRPMetaDataOptionsClientID || "",
+          displayName: opts?.oidcRPMetaDataOptionsDisplayName || "",
+        }));
+
+        return {
+          content: [{ type: "text", text: JSON.stringify(list, null, 2) }],
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+            },
+          ],
+          isError: true,
+        };
+      }
+    },
+  );
+
+  // 2. llng_oidc_rp_get - Get details of an OIDC RP
+  server.tool(
+    "llng_oidc_rp_get",
+    "Get full details of an OIDC Relying Party by confKey",
+    {
+      confKey: z.string().describe("The RP configuration key (internal identifier)"),
+      instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    },
+    async (args) => {
+      try {
+        const transport = registry.getTransport(args.instance, "manager");
+        const data = await transport.configGet([...RP_CONFIG_KEYS]);
+
+        const result: Record<string, any> = {};
+        for (const key of RP_CONFIG_KEYS) {
+          const container = data[key];
+          if (container && typeof container === "object" && args.confKey in container) {
+            result[key] = (container as Record<string, unknown>)[args.confKey];
+          }
+        }
+
+        return {
+          content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+            },
+          ],
+          isError: true,
+        };
+      }
+    },
+  );
+
+  // 3. llng_oidc_rp_add - Add a new OIDC RP
+  server.tool(
+    "llng_oidc_rp_add",
+    "Add a new OIDC Relying Party",
+    {
+      confKey: z.string().describe("Internal identifier for the RP"),
+      clientId: z.string().describe("OAuth2 client ID"),
+      redirectUris: z.string().describe("Redirect URIs (space or newline separated)"),
+      clientSecret: z.string().optional().describe("OAuth2 client secret"),
+      displayName: z.string().optional().describe("Display name for the RP"),
+      exportedVars: z
+        .record(z.string(), z.string())
+        .optional()
+        .describe(
+          'Claim-to-attribute mappings (default: {"name":"cn","preferred_username":"uid","email":"mail"})',
+        ),
+      extraClaims: z.record(z.string(), z.string()).optional().describe("Extra claims mappings"),
+      options: z
+        .record(z.string(), z.union([z.string(), z.number(), z.boolean()]))
+        .optional()
+        .describe("Additional raw OIDC RP options"),
+      instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    },
+    async (args) => {
+      try {
+        const transport = registry.getTransport(args.instance, "manager");
+
+        // Check OIDC issuer prerequisites
+        const issuerConfig = await transport.configGet([
+          "issuerDBOpenIDConnectActivation",
+          "oidcServicePrivateKeySig",
+        ]);
+        const isActivated =
+          issuerConfig["issuerDBOpenIDConnectActivation"] === 1 ||
+          issuerConfig["issuerDBOpenIDConnectActivation"] === "1";
+        const hasKey =
+          typeof issuerConfig["oidcServicePrivateKeySig"] === "string" &&
+          issuerConfig["oidcServicePrivateKeySig"].length > 0;
+
+        if (!isActivated || !hasKey) {
+          return {
+            content: [
+              {
+                type: "text" as const,
+                text: "Error: OIDC issuer is not enabled or signing keys are missing. Use llng_oidc_issuer_enable first.",
+              },
+            ],
+            isError: true,
+          };
+        }
+
+        const rpOptions: Record<string, string | number | boolean> = {
+          oidcRPMetaDataOptionsClientID: args.clientId,
+          oidcRPMetaDataOptionsRedirectUris: args.redirectUris,
+          oidcRPMetaDataOptionsIDTokenSignAlg: "RS256",
+          oidcRPMetaDataOptionsAccessTokenClaims: 1,
+          ...(args.options || {}),
+        };
+
+        if (args.clientSecret) {
+          rpOptions.oidcRPMetaDataOptionsClientSecret = args.clientSecret;
+        }
+        if (args.displayName) {
+          rpOptions.oidcRPMetaDataOptionsDisplayName = args.displayName;
+        }
+
+        const exportedVars = args.exportedVars || {
+          name: "cn",
+          preferred_username: "uid",
+          email: "mail",
+        };
+
+        const mergeData: Record<string, any> = {
+          oidcRPMetaDataOptions: {
+            [args.confKey]: rpOptions,
+          },
+          oidcRPMetaDataExportedVars: {
+            [args.confKey]: exportedVars,
+          },
+        };
+
+        if (args.extraClaims) {
+          mergeData.oidcRPMetaDataOptionsExtraClaims = {
+            [args.confKey]: args.extraClaims,
+          };
+        }
+
+        await transport.configMerge(JSON.stringify(mergeData));
+
+        return {
+          content: [
+            {
+              type: "text",
+              text: `OIDC RP '${args.confKey}' added successfully with clientId '${args.clientId}'.`,
+            },
+          ],
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+            },
+          ],
+          isError: true,
+        };
+      }
+    },
+  );
+
+  // 4. llng_oidc_rp_delete - Delete an OIDC RP
+  server.tool(
+    "llng_oidc_rp_delete",
+    "Delete an OIDC Relying Party by confKey",
+    {
+      confKey: z.string().describe("The RP configuration key to delete"),
+      instance: z.string().optional().describe("LLNG instance name (uses default if omitted)"),
+    },
+    async (args) => {
+      try {
+        const transport = registry.getTransport(args.instance, "manager");
+
+        for (const key of RP_CONFIG_KEYS) {
+          await transport.configDelKey(key, args.confKey);
+        }
+
+        return {
+          content: [
+            {
+              type: "text",
+              text: `OIDC RP '${args.confKey}' deleted successfully.`,
+            },
+          ],
+        };
+      } catch (error) {
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Error: ${error instanceof Error ? error.message : String(error)}`,
+            },
+          ],
+          isError: true,
+        };
+      }
+    },
+  );
+}