mcp-wordpress 2.4.2 → 2.5.1

package/src/client/managers/RequestManager.ts

@@ -4,13 +4,9 @@
  */
 
 // Use native fetch in Node.js 18+
-import type {
-  HTTPMethod,
-  RequestOptions,
-  ClientStats,
-  WordPressClientConfig,
-} from "../../types/client.js";
+import type { HTTPMethod, RequestOptions, ClientStats, WordPressClientConfig } from "../../types/client.js";
 import { WordPressAPIError, RateLimitError } from "../../types/client.js";
+import { config } from "../../config/Config.js";
 import { BaseManager } from "./BaseManager.js";
 import { AuthenticationManager } from "./AuthenticationManager.js";
 import { debug, startTimer } from "../../utils/debug.js";
@@ -21,14 +17,11 @@ export class RequestManager extends BaseManager {
   private requestInterval: number;
   private authManager: AuthenticationManager;
 
-  constructor(
-    config: WordPressClientConfig,
-    authManager: AuthenticationManager,
-  ) {
-    super(config);
+  constructor(clientConfig: WordPressClientConfig, authManager: AuthenticationManager) {
+    super(clientConfig);
 
     this.authManager = authManager;
-    this.requestInterval = 60000 / parseInt(process.env.RATE_LIMIT || "60");
+    this.requestInterval = 60000 / config().security.rateLimit;
     this.stats = {
       totalRequests: 0,
       successfulRequests: 0,
@@ -42,23 +35,13 @@ export class RequestManager extends BaseManager {
   /**
    * Make HTTP request with retry logic and rate limiting
    */
-  async request<T>(
-    method: HTTPMethod,
-    endpoint: string,
-    data?: any,
-    options: RequestOptions = {},
-  ): Promise<T> {
+  async request<T>(method: HTTPMethod, endpoint: string, data?: unknown, options: RequestOptions = {}): Promise<T> {
     const timer = startTimer();
 
     try {
       await this.enforceRateLimit();
 
-      const response = await this.makeRequestWithRetry(
-        method,
-        endpoint,
-        data,
-        options,
-      );
+      const response = await this.makeRequestWithRetry(method, endpoint, data, options);
 
       this.stats.successfulRequests++;
       this.updateAverageResponseTime(timer.end());
@@ -78,27 +61,30 @@ export class RequestManager extends BaseManager {
   private async makeRequestWithRetry<T>(
     method: HTTPMethod,
     endpoint: string,
-    data?: any,
+    data?: unknown,
     options: RequestOptions = {},
   ): Promise<T> {
-    let lastError: any;
+    let lastError: unknown;
     const maxRetries = options.retries ?? this.config.maxRetries ?? 3;
 
     for (let attempt = 1; attempt <= maxRetries; attempt++) {
       try {
         return await this.makeRequest<T>(method, endpoint, data, options);
-      } catch (error: any) {
+      } catch (error: unknown) {
         lastError = error;
 
+        // Type guard for error-like objects
+        const isErrorLike = (err: unknown): err is { statusCode?: number; message?: string } => {
+          return typeof err === "object" && err !== null;
+        };
+
         // Don't retry on authentication errors or client errors
-        if (error.statusCode < 500 || attempt === maxRetries) {
+        if ((isErrorLike(error) && error.statusCode && error.statusCode < 500) || attempt === maxRetries) {
           throw error;
         }
 
-        debug.log(
-          `Request failed (attempt ${attempt}/${maxRetries}):`,
-          error.message,
-        );
+        const errorMessage = isErrorLike(error) && error.message ? error.message : String(error);
+        debug.log(`Request failed (attempt ${attempt}/${maxRetries}):`, errorMessage);
 
         // Exponential backoff
         const delay = Math.min(1000 * Math.pow(2, attempt - 1), 5000);
@@ -115,7 +101,7 @@ export class RequestManager extends BaseManager {
   private async makeRequest<T>(
     method: HTTPMethod,
     endpoint: string,
-    data?: any,
+    data?: unknown,
     options: RequestOptions = {},
   ): Promise<T> {
     const url = this.buildUrl(endpoint);
@@ -128,7 +114,7 @@ export class RequestManager extends BaseManager {
       // Get authentication headers
       const authHeaders = await this.authManager.getAuthHeaders();
 
-      const fetchOptions: any = {
+      const fetchOptions: RequestInit = {
         method,
         headers: {
           "Content-Type": "application/json",
@@ -142,11 +128,17 @@ export class RequestManager extends BaseManager {
       if (data && method !== "GET") {
         if (
           data instanceof FormData ||
-          (data && typeof data.append === "function")
+          (typeof data === "object" && data && "append" in data && typeof data.append === "function")
         ) {
           // For FormData, don't set Content-Type (let fetch set it with boundary)
-          delete fetchOptions.headers["Content-Type"];
-          fetchOptions.body = data;
+          if (
+            fetchOptions.headers &&
+            typeof fetchOptions.headers === "object" &&
+            "Content-Type" in fetchOptions.headers
+          ) {
+            delete (fetchOptions.headers as Record<string, string>)["Content-Type"];
+          }
+          fetchOptions.body = data as FormData;
         } else if (Buffer.isBuffer(data)) {
           // For Buffer data, keep Content-Type from headers
           fetchOptions.body = data;
@@ -175,18 +167,22 @@ export class RequestManager extends BaseManager {
   /**
    * Handle HTTP error responses
    */
-  private async handleErrorResponse(response: any): Promise<never> {
-    let errorData: any = {};
+  private async handleErrorResponse(response: Response): Promise<never> {
+    let errorData: Record<string, unknown> = {};
 
     try {
-      errorData = await response.json();
+      const jsonData = await response.json();
+      if (typeof jsonData === "object" && jsonData !== null) {
+        errorData = jsonData as Record<string, unknown>;
+      }
     } catch {
       // Ignore JSON parsing errors
     }
 
     const message =
-      errorData.message || `HTTP ${response.status}: ${response.statusText}`;
-    const code = errorData.code || "http_error";
+      (typeof errorData.message === "string" ? errorData.message : undefined) ||
+      `HTTP ${response.status}: ${response.statusText}`;
+    const code = (typeof errorData.code === "string" ? errorData.code : undefined) || "http_error";
 
     if (response.status === 429) {
       this.stats.rateLimitHits++;
@@ -233,8 +229,7 @@ export class RequestManager extends BaseManager {
     const totalRequests = this.stats.successfulRequests;
     const currentAverage = this.stats.averageResponseTime;
 
-    this.stats.averageResponseTime =
-      (currentAverage * (totalRequests - 1) + responseTime) / totalRequests;
+    this.stats.averageResponseTime = (currentAverage * (totalRequests - 1) + responseTime) / totalRequests;
   }
 
   /**

package/src/config/Config.ts

@@ -0,0 +1,308 @@
+/**
+ * Centralized Configuration Management
+ *
+ * Provides typed access to all environment variables and configuration options.
+ * Centralizes configuration logic and eliminates scattered process.env access.
+ */
+
+export interface AppConfig {
+  // WordPress Connection
+  readonly wordpress: {
+    readonly siteUrl: string | undefined;
+    readonly username: string | undefined;
+    readonly appPassword: string | undefined;
+    readonly password: string | undefined;
+    readonly authMethod: string;
+    readonly timeout: number;
+    readonly maxRetries: number;
+    readonly jwtSecret: string | undefined;
+    readonly apiKey: string | undefined;
+    readonly cookieNonce: string | undefined;
+    readonly jwtPassword: string | undefined;
+  };
+
+  // Application Environment
+  readonly app: {
+    readonly nodeEnv: string;
+    readonly isDevelopment: boolean;
+    readonly isProduction: boolean;
+    readonly isTest: boolean;
+    readonly isDXT: boolean;
+    readonly isCI: boolean;
+  };
+
+  // Debug & Logging
+  readonly debug: {
+    readonly enabled: boolean;
+    readonly logLevel: string;
+  };
+
+  // Caching
+  readonly cache: {
+    readonly disabled: boolean;
+    readonly ttl: number;
+    readonly maxItems: number;
+    readonly maxMemoryMB: number;
+  };
+
+  // Security
+  readonly security: {
+    readonly rateLimitEnabled: boolean;
+    readonly rateLimitRequests: number;
+    readonly rateLimitWindow: number;
+    readonly rateLimit: number;
+    readonly strictMode: boolean;
+  };
+
+  // Error Handling & Logging
+  readonly error: {
+    readonly legacyLogsEnabled: boolean;
+  };
+
+  // Testing & Coverage
+  readonly testing: {
+    readonly coverageTolerance: number;
+    readonly skipPactTests: boolean;
+    readonly performanceTest: boolean;
+  };
+
+  // CI/CD Environment Detection
+  readonly ci: {
+    readonly isCI: boolean;
+    readonly provider: string | null;
+    readonly isGitHubActions: boolean;
+    readonly isTravis: boolean;
+    readonly isCircleCI: boolean;
+  };
+}
+
+/**
+ * Centralized Configuration Class
+ *
+ * Singleton that provides type-safe access to all configuration values.
+ * Replaces scattered process.env access throughout the codebase.
+ */
+export class Config {
+  private static instance: Config | null = null;
+  private readonly config: AppConfig;
+
+  private constructor() {
+    this.config = this.loadConfiguration();
+  }
+
+  /**
+   * Get singleton instance
+   */
+  public static getInstance(): Config {
+    if (!Config.instance) {
+      Config.instance = new Config();
+    }
+    return Config.instance;
+  }
+
+  /**
+   * Get configuration object (read-only)
+   */
+  public get(): AppConfig {
+    return this.config;
+  }
+
+  /**
+   * Load and validate all configuration from environment
+   */
+  private loadConfiguration(): AppConfig {
+    const nodeEnv = process.env.NODE_ENV || "development";
+
+    return {
+      wordpress: {
+        siteUrl: process.env.WORDPRESS_SITE_URL,
+        username: process.env.WORDPRESS_USERNAME,
+        appPassword: process.env.WORDPRESS_APP_PASSWORD,
+        password: process.env.WORDPRESS_PASSWORD,
+        authMethod: process.env.WORDPRESS_AUTH_METHOD || "app-password",
+        timeout: parseInt(process.env.WORDPRESS_TIMEOUT || "30000", 10),
+        maxRetries: parseInt(process.env.WORDPRESS_MAX_RETRIES || "3", 10),
+        jwtSecret: process.env.WORDPRESS_JWT_SECRET,
+        apiKey: process.env.WORDPRESS_API_KEY,
+        cookieNonce: process.env.WORDPRESS_COOKIE_NONCE,
+        jwtPassword: process.env.WORDPRESS_JWT_PASSWORD,
+      },
+
+      app: {
+        nodeEnv,
+        isDevelopment: nodeEnv === "development",
+        isProduction: nodeEnv === "production",
+        isTest: nodeEnv === "test",
+        isDXT: nodeEnv === "dxt",
+        isCI: this.detectCIEnvironment(),
+      },
+
+      debug: {
+        enabled: process.env.DEBUG === "true",
+        logLevel: process.env.LOG_LEVEL || "info",
+      },
+
+      cache: {
+        disabled: this.isTruthy(process.env.CACHE_DISABLED) || this.isTruthy(process.env.DISABLE_CACHE),
+        ttl: parseInt(process.env.CACHE_TTL || "300", 10), // 5 minutes default
+        maxItems: parseInt(process.env.CACHE_MAX_ITEMS || "1000", 10),
+        maxMemoryMB: parseInt(process.env.CACHE_MAX_MEMORY_MB || "50", 10),
+      },
+
+      security: {
+        rateLimitEnabled: process.env.RATE_LIMIT_ENABLED !== "false",
+        rateLimitRequests: parseInt(process.env.RATE_LIMIT_REQUESTS || "100", 10),
+        rateLimitWindow: parseInt(process.env.RATE_LIMIT_WINDOW || "60000", 10), // 1 minute
+        rateLimit: parseInt(process.env.RATE_LIMIT || "60", 10),
+        strictMode: process.env.SECURITY_STRICT_MODE === "true",
+      },
+
+      error: {
+        legacyLogsEnabled: process.env.LEGACY_ERROR_LOGS !== "0",
+      },
+
+      testing: {
+        coverageTolerance: parseFloat(process.env.COVERAGE_TOLERANCE || "1.0"),
+        skipPactTests: process.env.SKIP_PACT_TESTS === "true",
+        performanceTest: process.env.PERFORMANCE_TEST === "true",
+      },
+
+      ci: {
+        isCI: this.detectCIEnvironment(),
+        provider: this.detectCIProvider(),
+        isGitHubActions: process.env.GITHUB_ACTIONS === "true",
+        isTravis: process.env.TRAVIS === "true",
+        isCircleCI: process.env.CIRCLECI === "true",
+      },
+    };
+  }
+
+  /**
+   * Check if a string value should be considered truthy
+   * Accepts common truthy string representations
+   */
+  private isTruthy(value: string | undefined): boolean {
+    if (!value) return false;
+    const lowerValue = value.trim().toLowerCase();
+    return ["true", "1", "yes", "on", "enable", "enabled"].includes(lowerValue);
+  }
+
+  /**
+   * Detect if running in CI environment
+   */
+  private detectCIEnvironment(): boolean {
+    return (
+      process.env.CI === "true" ||
+      process.env.NODE_ENV === "ci" ||
+      process.env.GITHUB_ACTIONS === "true" ||
+      process.env.TRAVIS === "true" ||
+      process.env.CIRCLECI === "true"
+    );
+  }
+
+  /**
+   * Detect CI provider
+   */
+  private detectCIProvider(): string | null {
+    if (process.env.GITHUB_ACTIONS === "true") return "github-actions";
+    if (process.env.TRAVIS === "true") return "travis";
+    if (process.env.CIRCLECI === "true") return "circleci";
+    if (process.env.CI === "true") return "generic";
+    return null;
+  }
+
+  // Convenience methods for common checks
+
+  /**
+   * Should log debug information?
+   */
+  public shouldDebug(): boolean {
+    return this.config.debug.enabled && !this.config.app.isDXT;
+  }
+
+  /**
+   * Should use caching?
+   */
+  public shouldUseCache(): boolean {
+    return !this.config.cache.disabled;
+  }
+
+  /**
+   * Should log info messages? (not in test or DXT mode)
+   */
+  public shouldLogInfo(): boolean {
+    return !this.config.app.isTest && !this.config.app.isDXT;
+  }
+
+  /**
+   * Is WordPress configuration complete?
+   */
+  public hasWordPressConfig(): boolean {
+    const wp = this.config.wordpress;
+    return !!(wp.siteUrl && wp.username && wp.appPassword);
+  }
+
+  /**
+   * Get environment-appropriate timeout for operations
+   */
+  public getOperationTimeout(): number {
+    if (this.config.app.isTest) return 5000; // 5 seconds in tests
+    if (this.config.app.isCI) return 30000; // 30 seconds in CI
+    return 60000; // 1 minute in development/production
+  }
+
+  /**
+   * Reset singleton (for testing)
+   */
+  public static reset(): void {
+    Config.instance = null;
+  }
+}
+
+/**
+ * Global configuration instance getter
+ * Use this throughout the application instead of process.env
+ */
+export const config = () => Config.getInstance().get();
+
+/**
+ * Configuration helper utilities
+ */
+export const ConfigHelpers = {
+  /**
+   * Get config instance
+   */
+  get: () => Config.getInstance(),
+
+  /**
+   * Quick environment checks
+   */
+  isDev: () => config().app.isDevelopment,
+  isProd: () => config().app.isProduction,
+  isTest: () => config().app.isTest,
+  isDXT: () => config().app.isDXT,
+  isCI: () => config().app.isCI,
+
+  /**
+   * Quick feature flags
+   */
+  shouldDebug: () => Config.getInstance().shouldDebug(),
+  shouldUseCache: () => Config.getInstance().shouldUseCache(),
+  shouldLogInfo: () => Config.getInstance().shouldLogInfo(),
+  hasWordPressConfig: () => Config.getInstance().hasWordPressConfig(),
+
+  /**
+   * Get timeout for different operation types
+   */
+  getTimeout: (type: "operation" | "upload" | "test" = "operation") => {
+    const instance = Config.getInstance();
+    switch (type) {
+      case "upload":
+        return instance.getOperationTimeout() * 5; // 5x longer for uploads
+      case "test":
+        return config().app.isCI ? 30000 : 10000;
+      default:
+        return instance.getOperationTimeout();
+    }
+  },
+};

package/src/config/ConfigurationSchema.ts

@@ -6,7 +6,7 @@ import { z } from "zod";
 const AuthMethodSchema = z.enum(["app-password", "jwt", "basic", "api-key", "cookie"] as const);
 
 /**
- * Zod schema for URL validation
+ * Zod schema for URL validation with security checks
  */
 const UrlSchema = z
   .string()
@@ -14,7 +14,28 @@ const UrlSchema = z
   .refine((url) => {
     const parsed = new URL(url);
     return parsed.protocol === "http:" || parsed.protocol === "https:";
-  }, "URL must use http or https protocol");
+  }, "URL must use http or https protocol")
+  .refine((url) => {
+    // Additional security checks
+    const parsed = new URL(url);
+    const hostname = parsed.hostname.toLowerCase();
+
+    // In production, block localhost and private IPs
+    if (process.env.NODE_ENV === "production") {
+      if (
+        hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "::1" ||
+        hostname.match(/^10\./) ||
+        hostname.match(/^172\.(1[6-9]|2[0-9]|3[01])\./) ||
+        hostname.match(/^192\.168\./)
+      ) {
+        return false;
+      }
+    }
+
+    return true;
+  }, "Private/localhost URLs not allowed in production");
 
 /**
  * Zod schema for WordPress site configuration