mcp-deploy 0.1.0

package/src/lib/test-runner.ts

@@ -0,0 +1,110 @@
+import type { TestSpec } from "./types";
+
+export interface TestResult {
+  success: boolean;
+  message?: string;
+  error?: string;
+}
+
+/**
+ * Substitute placeholders in a string with values.
+ * {{value}} is replaced with the current field value.
+ * {{FIELD_KEY}} is replaced with the value of that field from allValues.
+ */
+function substitutePlaceholders(
+  template: string,
+  value: string,
+  allValues: Record<string, string>,
+  urlEncode: boolean = false
+): string {
+  let result = template.replace(
+    "{{value}}",
+    urlEncode ? encodeURIComponent(value) : value
+  );
+
+  for (const [key, val] of Object.entries(allValues)) {
+    result = result.replace(
+      `{{${key}}}`,
+      urlEncode ? encodeURIComponent(val) : val
+    );
+  }
+
+  return result;
+}
+
+/**
+ * Run a test spec against an external API.
+ *
+ * @param spec - The test specification from mcp-deploy.json
+ * @param value - The current field's value (substituted for {{value}})
+ * @param allValues - All form values (for {{FIELD_KEY}} substitution)
+ */
+export async function runTest(
+  spec: TestSpec,
+  value: string,
+  allValues: Record<string, string>
+): Promise<TestResult> {
+  try {
+    // Substitute placeholders in URL (with URL encoding)
+    const url = substitutePlaceholders(spec.url, value, allValues, true);
+
+    // Substitute placeholders in headers (no URL encoding)
+    const headers: Record<string, string> = {};
+    if (spec.headers) {
+      for (const [headerKey, headerVal] of Object.entries(spec.headers)) {
+        headers[headerKey] = substitutePlaceholders(
+          headerVal,
+          value,
+          allValues,
+          false
+        );
+      }
+    }
+
+    // Substitute placeholders in body if present
+    let body: string | undefined;
+    if (spec.body) {
+      body = substitutePlaceholders(spec.body, value, allValues, false);
+    }
+
+    // Make the request with a 10-second timeout
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 10_000);
+    let response: Response;
+    try {
+      response = await fetch(url, {
+        method: spec.method,
+        headers,
+        body,
+        signal: controller.signal,
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+
+    // Check for success
+    if (spec.success.includes(response.status)) {
+      return { success: true, message: "Connection successful" };
+    }
+
+    // Check for known error
+    const errorMessage = spec.errors?.[response.status];
+    if (errorMessage) {
+      return { success: false, error: errorMessage };
+    }
+
+    // Unknown error
+    return {
+      success: false,
+      error: `API returned status ${response.status}`,
+    };
+  } catch (err) {
+    if (err instanceof DOMException && err.name === "AbortError") {
+      return { success: false, error: "Connection timed out (10s)" };
+    }
+    return {
+      success: false,
+      error: err instanceof Error ? err.message : "Connection failed",
+    };
+  }
+}

package/src/lib/types.ts

@@ -0,0 +1,147 @@
+// Schema-driven test specification for validating external APIs
+export interface TestSpec {
+  url: string; // URL to test, can include {{FIELD_KEY}} placeholders
+  method: "GET" | "POST"; // HTTP method
+  headers?: Record<string, string>; // Headers, can include {{value}} for current field
+  body?: string; // Optional body for POST requests
+  success: number[]; // HTTP status codes that indicate success
+  errors?: Record<number, string>; // Custom error messages by status code
+}
+
+export interface SecretField {
+  key: string;
+  label: string;
+  required: boolean;
+  type?: "text" | "password" | "email";
+  placeholder?: string;
+  helpText?: string;
+  helpUrl?: string;
+  // Schema-driven test specification (replaces testConnection string)
+  test?: TestSpec;
+  // If set, only show this field when this platform is enabled in ENABLED_PLATFORMS config
+  forPlatform?: string;
+}
+
+export interface ConfigField {
+  key: string;
+  label: string;
+  type: "text" | "select" | "multiselect";
+  options?: { value: string; label: string }[];
+  default?: string;
+  helpText?: string;
+}
+
+// Worker-specific metadata (from mcp-deploy.json)
+export interface WorkerConfig {
+  name: string;
+  durableObjectBinding: string;
+  durableObjectClassName: string;
+  compatibilityDate: string;
+  compatibilityFlags: string[];
+  migrationTag: string;
+}
+
+// Remote MCP metadata schema (fetched from GitHub releases)
+export interface McpMetadata {
+  name: string;
+  description: string;
+  version: string;
+  worker: WorkerConfig;
+  secrets: SecretField[];
+  config: ConfigField[];
+  autoSecrets: string[];
+}
+
+// Registry entry - all MCPs come from GitHub releases
+export interface McpRegistryEntry {
+  slug: string;
+  githubRepo: string; // e.g., "upascal/paper-search-mcp-remote"
+  releaseTag?: string; // e.g., "v0.2.0" or "latest" (defaults to latest)
+}
+
+// MCP stored in KV (all MCPs are stored this way now)
+export interface StoredMcpEntry {
+  slug: string;
+  githubRepo: string;
+  releaseTag: string;
+  addedAt: string;
+  isDefault?: boolean; // true if this was seeded from defaults
+}
+
+// Resolved MCP entry with all metadata loaded from GitHub
+export interface ResolvedMcpEntry {
+  slug: string;
+  githubRepo: string;
+  releaseTag?: string;
+  isDefault?: boolean;
+
+  // Metadata from mcp-deploy.json
+  name: string;
+  description: string;
+  version: string;
+
+  // Worker config
+  workerName: string;
+  durableObjectBinding: string;
+  durableObjectClassName: string;
+  compatibilityDate: string;
+  compatibilityFlags: string[];
+  migrationTag: string;
+
+  // Bundle URL from GitHub release
+  bundleUrl: string;
+
+  // Config schema
+  secrets: SecretField[];
+  config: ConfigField[];
+  autoSecrets: string[];
+}
+
+export interface DeploymentRecord {
+  slug: string;
+  status: "deployed" | "failed" | "not_deployed";
+  workerUrl: string | null;
+  bearerToken: string | null; // encrypted
+  oauthPassword?: string | null; // encrypted
+  authMode?: "bearer" | "oauth" | "open";
+  deployedAt: string | null;
+  version: string;
+  error?: string;
+}
+
+export interface McpSecretsRecord {
+  [key: string]: string; // encrypted values
+}
+
+// ─── Operation types (shared between GUI routes and CLI) ───
+
+export interface DeployOptions {
+  authMode: "bearer" | "oauth" | "open";
+  secrets: Record<string, string>;
+  config: Record<string, string>;
+  regenerateToken?: boolean;
+  regenerateOAuthPassword?: boolean;
+}
+
+export interface DeployResult {
+  workerUrl: string;
+  mcpUrl: string;
+  mcpUrlWithToken?: string;
+  bearerToken: string | null;
+  oauthPassword: string | null;
+  authMode: "bearer" | "oauth" | "open";
+  oauthEnabled: boolean;
+  version: string;
+}
+
+export interface AddMcpResult {
+  slug: string;
+  name: string;
+  version: string;
+  githubRepo: string;
+}
+
+export interface UpdateSecretsResult {
+  updatedKeys: string[];
+  deletedKeys: string[];
+}

package/src/lib/validation.ts

@@ -0,0 +1,85 @@
+/**
+ * Input validation utilities for API routes.
+ */
+
+/**
+ * Validates a slug parameter (alphanumeric, hyphens, underscores only, 1-100 chars)
+ */
+export function isValidSlug(slug: unknown): slug is string {
+  if (typeof slug !== "string") return false;
+  if (slug.length < 1 || slug.length > 100) return false;
+  return /^[a-zA-Z0-9_-]+$/.test(slug);
+}
+
+/**
+ * Validates a GitHub repository format (owner/repo)
+ */
+export function isValidGithubRepo(repo: unknown): repo is string {
+  if (typeof repo !== "string") return false;
+  if (repo.length < 3 || repo.length > 200) return false;
+  const parts = repo.split("/");
+  if (parts.length !== 2) return false;
+  const [owner, name] = parts;
+  if (!owner || !name) return false;
+  // GitHub allows alphanumeric, hyphens, underscores, dots
+  return /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(repo);
+}
+
+/**
+ * Validates a release tag (alphanumeric, dots, hyphens, v prefix)
+ */
+export function isValidReleaseTag(tag: unknown): tag is string {
+  if (typeof tag !== "string") return false;
+  if (tag === "latest") return true;
+  if (tag.length < 1 || tag.length > 100) return false;
+  return /^v?[a-zA-Z0-9._-]+$/.test(tag);
+}
+
+/**
+ * Validates a secret key (alphanumeric, underscores only, 1-100 chars)
+ */
+export function isValidSecretKey(key: unknown): key is string {
+  if (typeof key !== "string") return false;
+  if (key.length < 1 || key.length > 100) return false;
+  return /^[A-Z0-9_]+$/.test(key);
+}
+
+/**
+ * Validates a secret value (any string, 1-10000 chars)
+ */
+export function isValidSecretValue(value: unknown): value is string {
+  if (typeof value !== "string") return false;
+  return value.length >= 1 && value.length <= 10000;
+}
+
+/**
+ * Validates a URL
+ */
+export function isValidUrl(url: unknown): url is string {
+  if (typeof url !== "string") return false;
+  try {
+    new URL(url);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Validates an object has only valid secret key-value pairs
+ */
+export function isValidSecretsObject(
+  obj: unknown
+): obj is Record<string, string> {
+  if (typeof obj !== "object" || obj === null || Array.isArray(obj)) {
+    return false;
+  }
+
+  for (const [key, value] of Object.entries(obj)) {
+    if (!isValidSecretKey(key) || !isValidSecretValue(value)) {
+      return false;
+    }
+  }
+
+  return true;
+}

package/src/lib/worker-bearer-wrapper.ts

@@ -0,0 +1,110 @@
+/**
+ * Generates a bearer token authentication wrapper for MCP worker bundles.
+ *
+ * This wrapper sits in front of the actual MCP worker and validates bearer tokens
+ * using two methods (matching the reference implementation pattern):
+ *   1. Token in URL path: /mcp/t/{token}
+ *   2. Token in Authorization header: Bearer {token}
+ *
+ * Based on the reference implementation from zotero-assistant-mcp-remote.
+ */
+
+/**
+ * Generate the bearer token wrapper module code.
+ *
+ * @param durableObjectClassName - The DO class to re-export (e.g., "ZoteroMCP")
+ */
+export function generateBearerTokenWrapper(
+    durableObjectClassName: string
+): string {
+    return `
+// ─── Bearer Token Authentication Wrapper ───
+// Auto-generated by mcp-deploy. Do not edit.
+
+import OriginalWorker from './original.mjs';
+export { ${durableObjectClassName} } from './original.mjs';
+
+// ─── Constant-time comparison ───
+
+function constantTimeEqual(a, b) {
+  const len = Math.max(a.length, b.length);
+  let result = a.length ^ b.length;
+  for (let i = 0; i < len; i++) {
+    const aChar = a.charCodeAt(i) || 0;
+    const bChar = b.charCodeAt(i) || 0;
+    result |= aChar ^ bChar;
+  }
+  return result === 0;
+}
+
+// ─── Worker fetch handler ───
+
+export default {
+  fetch(request, env, ctx) {
+    const url = new URL(request.url);
+
+    // Health check — no secrets exposed
+    if (url.pathname === '/') {
+      return new Response(
+        JSON.stringify({
+          name: 'mcp-server',
+          status: 'ok',
+        }),
+        { headers: { 'content-type': 'application/json' } }
+      );
+    }
+
+    // -----------------------------------------------------------------------
+    // Authentication — supports two methods:
+    //   1. URL token:    /mcp/t/{token}  (for Claude Desktop UI connector)
+    //   2. Bearer header: Authorization: Bearer {token}  (for API/CLI)
+    // -----------------------------------------------------------------------
+
+    // Method 1: Token in URL path — /mcp/t/{token} or /mcp/t/{token}/...
+    const tokenMatch = url.pathname.match(/^\\/mcp\\/t\\/([^/]+)(\\/.*)?$/);
+    if (tokenMatch) {
+      const urlToken = tokenMatch[1];
+      if (!env.BEARER_TOKEN || !constantTimeEqual(urlToken, env.BEARER_TOKEN)) {
+        return new Response(
+          JSON.stringify({ error: 'Unauthorized' }),
+          { status: 401, headers: { 'content-type': 'application/json' } }
+        );
+      }
+      // Rewrite URL: strip /t/{token} so the MCP handler sees /mcp
+      // Add Authorization header so the original worker's auth also passes
+      const rewrittenPath = '/mcp' + (tokenMatch[2] || '');
+      const rewrittenUrl = new URL(rewrittenPath, url.origin);
+      rewrittenUrl.search = url.search;
+      const rewrittenHeaders = new Headers(request.headers);
+      rewrittenHeaders.set('Authorization', \`Bearer \${env.BEARER_TOKEN}\`);
+      const rewrittenRequest = new Request(rewrittenUrl.toString(), {
+        method: request.method,
+        headers: rewrittenHeaders,
+        body: request.body,
+        duplex: 'half',
+      });
+      return OriginalWorker.fetch(rewrittenRequest, env, ctx);
+    }
+
+    // Method 2: Bearer header on /mcp
+    if (url.pathname.startsWith('/mcp')) {
+      const auth = request.headers.get('Authorization');
+      if (!env.BEARER_TOKEN || !auth || !constantTimeEqual(auth, \`Bearer \${env.BEARER_TOKEN}\`)) {
+        return new Response(
+          JSON.stringify({ error: 'Unauthorized' }),
+          {
+            status: 401,
+            headers: {
+              'content-type': 'application/json',
+              'WWW-Authenticate': 'Bearer',
+            },
+          }
+        );
+      }
+    }
+
+    return OriginalWorker.fetch(request, env, ctx);
+  },
+};
+`.trim();
+}