mcp-creatio 0.3.10 → 0.4.1

package/src/log.ts

@@ -1,183 +0,0 @@
-export type LogLevel = 'info' | 'warn' | 'error';
-export type LogVerbosity = LogLevel | 'silent';
-export type CreatioAuthKind = 'legacy' | 'oauth2' | 'oauth2_code';
-
-export interface LogConfig {
-	level?: LogLevel;
-}
-
-let _correlationId: string | undefined;
-let _stderrOnly = false;
-
-function resolveLogVerbosity(): LogVerbosity {
-	const raw = (process.env.MCP_CREATIO_LOG_LEVEL || 'silent').toLowerCase();
-	if (raw === 'info') {
-		return 'info';
-	}
-	if (raw === 'warn' || raw === 'warning') {
-		return 'warn';
-	}
-	if (raw === 'error') {
-		return 'error';
-	}
-	return 'silent';
-}
-
-function shouldLog(level: LogLevel): boolean {
-	const verbosity = resolveLogVerbosity();
-	if (verbosity === 'silent') {
-		return false;
-	}
-	if (verbosity === 'error') {
-		return level === 'error';
-	}
-	if (verbosity === 'warn') {
-		return level === 'warn' || level === 'error';
-	}
-	return true;
-}
-
-export function setCorrelationId(correlationId: string) {
-	_correlationId = correlationId;
-}
-
-export function getCorrelationId(): string | undefined {
-	return _correlationId;
-}
-
-export function clearCorrelationId() {
-	_correlationId = undefined;
-}
-
-function timestamp() {
-	return new Date().toISOString();
-}
-
-function output(level: LogLevel, msg: string, meta?: Record<string, any>) {
-	if (!shouldLog(level)) {
-		return;
-	}
-	const entry: any = { ts: timestamp(), level, msg };
-	if (_correlationId) {
-		entry.correlationId = _correlationId;
-	}
-	if (meta && Object.keys(meta).length) {
-		entry.meta = meta;
-	}
-	const line = JSON.stringify(entry);
-	if (_stderrOnly) {
-		process.stderr.write(line + '\n');
-		return;
-	}
-	if (level === 'error') {
-		console.error(line);
-	} else if (level === 'warn') {
-		console.warn(line);
-	} else {
-		console.log(line);
-	}
-}
-
-export function useStderrOnlyLogs() {
-	_stderrOnly = true;
-}
-
-export function info(msg: string, meta?: Record<string, any>) {
-	output('info', msg, meta);
-}
-export function warn(msg: string, meta?: Record<string, any>) {
-	output('warn', msg, meta);
-}
-export function error(msg: string, meta?: Record<string, any>) {
-	output('error', msg, meta);
-}
-export function appStart(meta?: Record<string, any>) {
-	info('app.start', meta);
-}
-export function appStop(meta?: Record<string, any>) {
-	info('app.stop', meta);
-}
-export function serverStart(name?: string, version?: string, meta?: Record<string, any>) {
-	info('mcp.server.start', { name, version, ...meta });
-}
-export function serverStop(name?: string, version?: string, meta?: Record<string, any>) {
-	info('mcp.server.stop', { name, version, ...meta });
-}
-export function httpStart(port: number, meta?: Record<string, any>) {
-	info('http.server.start', { port, ...meta });
-}
-export function httpStop(port: number, meta?: Record<string, any>) {
-	info('http.server.stop', { port, ...meta });
-}
-export function sessionConnect(sessionId: string, ip?: string, meta?: Record<string, any>) {
-	info('session.connect', { sessionId, ip, ...meta });
-}
-export function sessionDisconnect(sessionId: string, ip?: string, meta?: Record<string, any>) {
-	info('session.disconnect', { sessionId, ip, ...meta });
-}
-export function creatioAuthStart(baseUrl: string, authKind?: CreatioAuthKind) {
-	info('creatio.auth.start', { baseUrl, authKind });
-}
-export function creatioAuthOk(baseUrl: string, authKind?: CreatioAuthKind) {
-	info('creatio.auth.ok', { baseUrl, authKind });
-}
-export function creatioAuthFailed(baseUrl: string, error: string, authKind?: CreatioAuthKind) {
-	warn('creatio.auth.failed', { baseUrl, error, authKind });
-}
-export function httpRequest(method: string, url: string, meta?: Record<string, any>) {
-	info('http.request', { method, url, ...meta });
-}
-export function httpResponse(
-	method: string,
-	url: string,
-	status: number,
-	duration?: number,
-	meta?: Record<string, any>,
-) {
-	info('http.response', { method, url, status, duration, ...meta });
-}
-export function httpError(
-	method: string,
-	url: string,
-	errorMsg: string,
-	meta?: Record<string, any>,
-) {
-	error('http.error', { method, url, error: errorMsg, ...meta });
-}
-export function logOperation(
-	operation: string,
-	duration: number,
-	success: boolean,
-	meta?: Record<string, any>,
-) {
-	info(`operation.${success ? 'success' : 'failed'}`, {
-		operation,
-		duration,
-		...meta,
-	});
-}
-
-export default {
-	info,
-	warn,
-	error,
-	useStderrOnlyLogs,
-	appStart,
-	appStop,
-	serverStart,
-	serverStop,
-	httpStart,
-	httpStop,
-	sessionConnect,
-	sessionDisconnect,
-	creatioAuthStart,
-	creatioAuthOk,
-	creatioAuthFailed,
-	httpRequest,
-	httpResponse,
-	httpError,
-	logOperation,
-	setCorrelationId,
-	getCorrelationId,
-	clearCorrelationId,
-};

package/src/server/http/creatio-oauth-handlers.ts

@@ -1,146 +0,0 @@
-import log from '../../log';
-import { SessionContext } from '../../services';
-import { runWithContext } from '../../utils';
-
-import type { Server } from '../mcp';
-import type { OAuthServer } from '../oauth';
-import type { Request, Response } from 'express';
-
-export class CreatioOAuthHandlers {
-	private readonly _sessionContext = SessionContext.instance;
-	private readonly _server: Server;
-	private readonly _oauthServer: OAuthServer;
-
-	constructor(server: Server, oauthServer: OAuthServer) {
-		this._server = server;
-		this._oauthServer = oauthServer;
-	}
-
-	private _mapAllSessionsToUser(userKey: string): void {
-		const sessions = this._sessionContext.getAllSessions();
-		const sessionIds = sessions.map((s) => s.id);
-		log.info('mapping_all_sessions', { userKey, sessionCount: sessionIds.length, sessionIds });
-		for (const sessionId of sessionIds) {
-			this._sessionContext.setSessionUserKey(sessionId, userKey);
-		}
-	}
-
-	public async handleOAuthStart(req: Request, res: Response): Promise<void> {
-		try {
-			const userKey = req.query.userKey as string;
-			const authKey = req.query.authKey as string;
-			const effectiveUserKey = userKey || authKey;
-			if (!effectiveUserKey) {
-				res.status(400).send(
-					'Missing userKey parameter. Add ?userKey=your_user_key to URL',
-				);
-				return;
-			}
-			const state = this._sessionContext.createOAuthState(effectiveUserKey);
-			const url = await this._server.authProvider.getAuthorizeUrl(state);
-			const mcpParams = req.query as any;
-			if (mcpParams.client_id && mcpParams.redirect_uri) {
-				const urlObj = new URL(url);
-				const stateWithMcp = `${state}&client_id=${mcpParams.client_id}&redirect_uri=${encodeURIComponent(mcpParams.redirect_uri)}&code_challenge=${mcpParams.code_challenge}&code_challenge_method=${mcpParams.code_challenge_method}&mcp_state=${mcpParams.state || ''}`;
-				urlObj.searchParams.set('state', stateWithMcp);
-				return res.redirect(302, urlObj.toString());
-			}
-			res.redirect(302, url);
-		} catch (err: any) {
-			log.error('oauth.start.error', { error: String(err?.message ?? err) });
-			res.status(500).send('OAuth start failed');
-		}
-	}
-
-	public async handleOAuthCallback(req: Request, res: Response): Promise<void> {
-		try {
-			const code = String(req.query?.code ?? '') || String((req as any).body?.code ?? '');
-			const state = String(req.query?.state ?? '') || String((req as any).body?.state ?? '');
-			log.info('oauth.callback.start', {
-				code: code ? '***' + code.slice(-4) : 'missing',
-				state: state ? state.substring(0, 50) + '...' : 'missing',
-				fullState: state,
-			});
-			if (!code || !state) {
-				res.status(400).send('Missing code or state');
-				return;
-			}
-			const stateParts = state.split('&');
-			const creatioState = stateParts[0];
-			log.info('oauth.callback.state_parse', {
-				originalState: state,
-				creatioState,
-				hasMcpParams: stateParts.length > 1,
-			});
-			if (!creatioState) {
-				log.error('oauth.callback.no_creatio_state', { originalState: state });
-				res.status(400).send('Invalid state format');
-				return;
-			}
-			const userKey = this._sessionContext.validateAndConsumeOAuthState(creatioState);
-			if (!userKey) {
-				log.error('oauth.callback.creatio_state_invalid', { creatioState });
-				res.status(400).send('Unknown or expired state');
-				return;
-			}
-			await runWithContext({ userKey }, async () =>
-				this._server.authProvider.finishAuthorization(code),
-			);
-			this._mapAllSessionsToUser(userKey);
-			const stateParams = new URLSearchParams(state);
-			const clientId = stateParams.get('client_id');
-			const redirectUri = stateParams.get('redirect_uri');
-			const codeChallenge = stateParams.get('code_challenge');
-			if (clientId && redirectUri && codeChallenge) {
-				const mcpState = stateParams.get('mcp_state');
-				log.info('oauth.callback.state_validation', {
-					mcpState,
-					clientId,
-					hasState: !!mcpState,
-				});
-				if (mcpState && !this._oauthServer.validateState(mcpState, clientId)) {
-					log.error('oauth.callback.state_invalid', { mcpState, clientId });
-					const errorUrl = new URL(redirectUri);
-					errorUrl.searchParams.set('error', 'invalid_request');
-					errorUrl.searchParams.set('error_description', 'Unknown or expired state');
-					if (mcpState) {
-						errorUrl.searchParams.set('state', mcpState);
-					}
-					return res.redirect(errorUrl.toString());
-				}
-				const authCode = this._oauthServer.generateAuthorizationCode(
-					clientId,
-					redirectUri,
-					codeChallenge,
-					stateParams.get('code_challenge_method') || 'S256',
-					userKey,
-				);
-				const redirectUrl = new URL(redirectUri);
-				redirectUrl.searchParams.set('code', authCode);
-				if (mcpState) {
-					redirectUrl.searchParams.set('state', mcpState);
-				}
-				return res.redirect(redirectUrl.toString());
-			}
-			res.status(200).send('Authorization successful. You can close this window.');
-		} catch (err: any) {
-			log.error('oauth.callback.error', { error: String(err?.message ?? err) });
-			res.status(500).send('OAuth callback failed');
-		}
-	}
-
-	public async handleOAuthRevoke(req: Request, res: Response): Promise<void> {
-		try {
-			const userKey = (req.query.userKey as string) || (req.body?.userKey as string);
-			if (!userKey) {
-				res.status(400).send('Missing userKey parameter');
-				return;
-			}
-			await runWithContext({ userKey }, async () => this._server.authProvider.revoke());
-			res.status(200).send('Revoked');
-		} catch (err: any) {
-			log.error('oauth.revoke.error', { error: String(err?.message ?? err) });
-			res.status(500).send('OAuth revoke failed');
-		}
-	}
-}

package/src/server/http/httpServer.ts

@@ -1,150 +0,0 @@
-import * as http from 'http';
-import { Socket } from 'node:net';
-
-import express from 'express';
-
-import { AuthProviderType } from '../../creatio/';
-import log from '../../log';
-import { SessionContext } from '../../services';
-import { OAuthServer } from '../oauth';
-
-import { CreatioOAuthHandlers } from './creatio-oauth-handlers';
-import { McpHandlers } from './mcp-handlers';
-import { MCPOAuthHandlers } from './mcp-oauth-handlers';
-import { HttpMiddleware } from './middleware';
-
-import type { Server } from '../mcp';
-
-export class HttpServer {
-	private readonly _server: Server;
-	private readonly _app = express();
-	private readonly _connections = new Set<Socket>();
-	private _srv!: http.Server;
-	private readonly _sessionContext = SessionContext.instance;
-	private readonly _oauthServer: OAuthServer;
-	private readonly _middleware: HttpMiddleware;
-	private readonly _mcpHandlers: McpHandlers;
-	private readonly _creatioOauthHandlers: CreatioOAuthHandlers;
-	private readonly _mcpOauthHandlers: MCPOAuthHandlers;
-
-	constructor(server: Server) {
-		this._server = server;
-		this._oauthServer = new OAuthServer();
-		this._middleware = new HttpMiddleware(this._oauthServer);
-		this._mcpHandlers = new McpHandlers(this._server);
-		this._creatioOauthHandlers = new CreatioOAuthHandlers(this._server, this._oauthServer);
-		this._mcpOauthHandlers = new MCPOAuthHandlers(this._oauthServer);
-		this._setupMiddleware();
-		this._setupRoutes();
-	}
-
-	private _setupMiddleware(): void {
-		this._app.use(this._middleware.correlationId());
-		this._app.use(this._middleware.requestLogging());
-		this._app.use(express.json());
-		this._app.use(express.urlencoded({ extended: true }));
-		if (this._isNeedMCPOAuth()) {
-			this._app.use('/mcp', this._middleware.bearerAuth());
-		}
-		this._app.use(this._middleware.errorHandler());
-	}
-
-	private _setupRoutes(): void {
-		this._setupMCPEndpoints();
-		if (this._isNeedMCPOAuth()) {
-			this._setupCreatioOAuthEndpoints();
-			this._setupMCPOAuthEndpoints();
-		}
-	}
-
-	private _setupMCPEndpoints(): void {
-		this._app.post('/mcp', (req, res) => this._mcpHandlers.handleMcpPost(req, res));
-		this._app.get('/mcp', (req, res) => this._mcpHandlers.handleSessionRequest(req, res));
-		this._app.delete('/mcp', (req, res) => this._mcpHandlers.handleSessionRequest(req, res));
-	}
-
-	private _isNeedMCPOAuth(): boolean {
-		return this._server.authProvider.type === AuthProviderType.OAuth2Code;
-	}
-
-	private _setupCreatioOAuthEndpoints(): void {
-		this._app.get('/oauth/start', (req, res) =>
-			this._creatioOauthHandlers.handleOAuthStart(req, res),
-		);
-		this._app.get('/oauth/callback', (req, res) =>
-			this._creatioOauthHandlers.handleOAuthCallback(req, res),
-		);
-		this._app.post('/oauth/revoke', (req, res) =>
-			this._creatioOauthHandlers.handleOAuthRevoke(req, res),
-		);
-	}
-
-	private _setupMCPOAuthEndpoints(): void {
-		this._app.get('/.well-known/oauth-authorization-server', (req, res) =>
-			this._mcpOauthHandlers.handleMetadata(req, res),
-		);
-		this._app.post('/register', (req, res) =>
-			this._mcpOauthHandlers.handleClientRegistration(req, res),
-		);
-		this._app.get('/authorize', (req, res) =>
-			this._mcpOauthHandlers.handleAuthorization(req, res),
-		);
-		this._app.post('/token', (req, res) =>
-			this._mcpOauthHandlers.handleTokenExchange(req, res),
-		);
-	}
-
-	public start(port: number) {
-		return new Promise<void>((resolve, reject) => {
-			this._srv = this._app.listen(port, () => {
-				log.httpStart(port);
-				resolve();
-			});
-			this._srv.keepAliveTimeout = 5000;
-			this._srv.headersTimeout = Math.max(this._srv.keepAliveTimeout + 1000, 6000);
-			this._srv.on('error', (err) => {
-				log.error('http.start.error', { error: String(err), port });
-				reject(err);
-			});
-			this._srv.on('connection', (socket: Socket) => {
-				this._connections.add(socket);
-				socket.once('close', () => this._connections.delete(socket));
-			});
-		});
-	}
-
-	public async stop() {
-		try {
-			if (this._server.authProvider && 'cancelAllRefresh' in this._server.authProvider) {
-				(this._server.authProvider as any).cancelAllRefresh();
-			}
-		} catch (err) {
-			log.warn('token_refresh_cleanup_failed', { error: String(err) });
-		}
-		if (this._srv) {
-			try {
-				await this._server.stopMcp();
-				await new Promise<void>((resolve) => {
-					this._srv.close(() => resolve());
-				});
-			} catch (err) {
-				log.error('http.stop.error', { error: String(err) });
-			}
-		}
-		for (const socket of Array.from(this._connections)) {
-			try {
-				socket.destroy();
-			} catch {}
-		}
-		this._connections.clear();
-		const sessions = this._sessionContext.getAllSessions();
-		for (const session of sessions) {
-			try {
-				session.transport?.close();
-			} catch (err) {
-				log.warn('transport.close.failed', { sessionId: session.id, error: String(err) });
-			}
-			this._sessionContext.deleteSession(session.id);
-		}
-	}
-}

package/src/server/http/index.ts

@@ -1,5 +0,0 @@
-export * from './httpServer';
-export * from './mcp-handlers';
-export * from './middleware';
-export * from './creatio-oauth-handlers';
-export * from './mcp-oauth-handlers';

package/src/server/http/mcp-handlers.ts

@@ -1,92 +0,0 @@
-import { randomUUID } from 'node:crypto';
-
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
-
-import log from '../../log';
-import { SessionContext } from '../../services';
-import {
-	getClientIp,
-	getSessionIdFromRequest,
-	getUserKeyFromRequest,
-	runWithContext,
-} from '../../utils';
-
-import type { Server } from '../mcp';
-import type { Request, Response } from 'express';
-
-export class McpHandlers {
-	private readonly _sessionContext = SessionContext.instance;
-	private readonly _server: Server;
-
-	constructor(server: Server) {
-		this._server = server;
-	}
-
-	public async handleMcpPost(req: Request, res: Response): Promise<void> {
-		const sessionId = getSessionIdFromRequest(req);
-		const bearerUserKey = (req as any).userKey;
-		let transport: StreamableHTTPServerTransport | undefined;
-		const remoteIp = getClientIp(req);
-		if (sessionId && this._sessionContext.hasSession(sessionId)) {
-			const session = this._sessionContext.getSession(sessionId);
-			transport = session?.transport;
-			if (session && !session.isLogged) {
-				this._sessionContext.markSessionAsLogged(sessionId);
-				log.sessionConnect(sessionId, String(remoteIp));
-			}
-		} else if (!sessionId && isInitializeRequest(req.body)) {
-			transport = new StreamableHTTPServerTransport({
-				sessionIdGenerator: () => randomUUID(),
-				onsessioninitialized: (sid) => {
-					if (transport) {
-						const session = this._sessionContext.createSession(
-							sid,
-							bearerUserKey,
-							remoteIp,
-						);
-						this._sessionContext.setSessionTransport(sid, transport);
-						this._sessionContext.markSessionAsLogged(sid);
-						log.sessionConnect(sid, String(remoteIp));
-					}
-				},
-			});
-			transport.onclose = () => {
-				if (transport?.sessionId) {
-					log.sessionDisconnect(transport.sessionId, String(remoteIp));
-					this._sessionContext.deleteSession(transport.sessionId);
-				}
-			};
-			const mcp = await this._server.startMcp();
-			await mcp.connect(transport as any);
-		} else {
-			res.status(400).json({
-				jsonrpc: '2.0',
-				error: { code: -32000, message: 'Bad Request: No valid session ID provided' },
-				id: null,
-			});
-			return;
-		}
-		const session = this._sessionContext.getSession(sessionId);
-		const userKey = bearerUserKey || session?.userKey;
-		await runWithContext({ userKey, sessionId }, async () =>
-			transport!.handleRequest(req, res, req.body),
-		);
-	}
-
-	public async handleSessionRequest(req: Request, res: Response): Promise<void> {
-		const sessionId = req.headers['mcp-session-id'] as string | undefined;
-		if (!sessionId || !this._sessionContext.hasSession(sessionId)) {
-			res.status(400).send('Invalid or missing session ID');
-			return;
-		}
-		const session = this._sessionContext.getSession(sessionId);
-		const transport = session?.transport;
-		if (!transport) {
-			res.status(400).send('Session has no transport');
-			return;
-		}
-		const userKey = getUserKeyFromRequest(req as any);
-		await runWithContext({ userKey, sessionId }, async () => transport.handleRequest(req, res));
-	}
-}

package/src/server/http/mcp-oauth-handlers.ts

@@ -1,108 +0,0 @@
-import { randomUUID } from 'node:crypto';
-
-import log from '../../log';
-import { OAuthValidators } from '../oauth/validators';
-
-import type { OAuthServer } from '../oauth';
-import type { Request, Response } from 'express';
-
-export class MCPOAuthHandlers {
-	private readonly _oauthServer: OAuthServer;
-
-	constructor(oauthServer: OAuthServer) {
-		this._oauthServer = oauthServer;
-	}
-
-	public handleMetadata(req: Request, res: Response): void {
-		const metadata = this._oauthServer.getAuthorizationServerMetadata();
-		res.json(metadata);
-	}
-
-	public handleClientRegistration(req: Request, res: Response): Response | void {
-		try {
-			const { redirect_uris } = req.body;
-			const validationError = OAuthValidators.validateClientRegistration(redirect_uris);
-			if (validationError) {
-				return res.status(400).json({
-					error: 'invalid_request',
-					error_description: validationError,
-				});
-			}
-			const client = this._oauthServer.registerClient(redirect_uris);
-			res.status(201).json(client);
-		} catch (error) {
-			log.error('oauth.register.error', { error: String(error) });
-			res.status(500).json({
-				error: 'server_error',
-				error_description: 'Failed to register client',
-			});
-		}
-	}
-
-	public async handleAuthorization(req: Request, res: Response): Promise<void> {
-		try {
-			const params = {
-				client_id: req.query.client_id as string,
-				redirect_uri: req.query.redirect_uri as string,
-				response_type: req.query.response_type as string,
-				state: req.query.state as string,
-				code_challenge: req.query.code_challenge as string,
-				code_challenge_method: req.query.code_challenge_method as string,
-				scope: req.query.scope as string,
-			};
-			const validationError = this._oauthServer.validateAuthorizationRequest(params);
-			if (validationError) {
-				const errorUrl = new URL(params.redirect_uri);
-				errorUrl.searchParams.set('error', validationError.error);
-				if (validationError.error_description) {
-					errorUrl.searchParams.set(
-						'error_description',
-						validationError.error_description,
-					);
-				}
-				if (params.state) {
-					errorUrl.searchParams.set('state', params.state);
-				}
-				return res.redirect(errorUrl.toString());
-			}
-			if (params.state) {
-				this._oauthServer.storeState(params.state, params.client_id);
-			}
-			const authKey = randomUUID();
-			const creatioAuthUrl = `/oauth/start?authKey=${authKey}&client_id=${params.client_id}&redirect_uri=${encodeURIComponent(params.redirect_uri)}&code_challenge=${params.code_challenge}&code_challenge_method=${params.code_challenge_method}&state=${params.state || ''}`;
-			res.redirect(creatioAuthUrl);
-		} catch (error) {
-			log.error('oauth.authorize.error', { error: String(error) });
-			res.status(500).send('Authorization failed');
-		}
-	}
-
-	public async handleTokenExchange(req: Request, res: Response): Promise<Response | void> {
-		try {
-			const tokenParams = req.body || {};
-			log.info('oauth.token.request', {
-				contentType: req.headers['content-type'],
-				hasBody: !!req.body,
-				bodyKeys: req.body ? Object.keys(req.body) : [],
-				params: {
-					grant_type: tokenParams.grant_type,
-					code: tokenParams.code ? '***' + tokenParams.code.slice(-4) : 'missing',
-					client_id: tokenParams.client_id,
-					redirect_uri: tokenParams.redirect_uri,
-					has_code_verifier: !!tokenParams.code_verifier,
-				},
-			});
-			const result = await this._oauthServer.exchangeCodeForToken(tokenParams);
-			if ('error' in result) {
-				return res.status(400).json(result);
-			}
-			res.json(result);
-		} catch (error) {
-			log.error('oauth.token.error', { error: String(error) });
-			res.status(500).json({
-				error: 'server_error',
-				error_description: 'Failed to exchange token',
-			});
-		}
-	}
-}