opalserve 0.1.0 → 0.1.2

package/src/identity/manager.ts

@@ -1,207 +0,0 @@
-import jwt from 'jsonwebtoken';
-import type { Identity, Role, Permission, IdentityContext } from './types.js';
-
-export class IdentityManager {
-  private identities: Map<string, Identity> = new Map();
-  private roles: Map<string, Role> = new Map();
-  private jwtSecret: string;
-
-  constructor(jwtSecret: string) {
-    this.jwtSecret = jwtSecret;
-    this.initializeDefaultRoles();
-  }
-
-  private initializeDefaultRoles(): void {
-    const defaultRoles: Role[] = [
-      {
-        id: 'admin',
-        name: 'Administrator',
-        description: 'Full access to all resources',
-        permissions: ['admin', 'tools:read', 'tools:write', 'tools:execute', 'servers:read', 'servers:write', 'workflows:read', 'workflows:write', 'workflows:execute'],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-      },
-      {
-        id: 'developer',
-        name: 'Developer',
-        description: 'Can read and execute tools, manage workflows',
-        permissions: ['tools:read', 'tools:execute', 'servers:read', 'workflows:read', 'workflows:write', 'workflows:execute'],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-      },
-      {
-        id: 'viewer',
-        name: 'Viewer',
-        description: 'Read-only access to tools and workflows',
-        permissions: ['tools:read', 'servers:read', 'workflows:read'],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-      },
-      {
-        id: 'service',
-        name: 'Service Account',
-        description: 'Automated service with limited permissions',
-        permissions: ['tools:read', 'tools:execute', 'workflows:read', 'workflows:execute'],
-        createdAt: new Date().toISOString(),
-        updatedAt: new Date().toISOString(),
-      },
-    ];
-
-    for (const role of defaultRoles) {
-      this.roles.set(role.id, role);
-    }
-  }
-
-  registerIdentity(identity: Identity): void {
-    this.identities.set(identity.id, identity);
-  }
-
-  getIdentity(id: string): Identity | undefined {
-    return this.identities.get(id);
-  }
-
-  getAllIdentities(): Identity[] {
-    return Array.from(this.identities.values());
-  }
-
-  deleteIdentity(id: string): boolean {
-    return this.identities.delete(id);
-  }
-
-  registerRole(role: Role): void {
-    this.roles.set(role.id, role);
-  }
-
-  getRole(id: string): Role | undefined {
-    return this.roles.get(id);
-  }
-
-  getAllRoles(): Role[] {
-    return Array.from(this.roles.values());
-  }
-
-  getEffectivePermissions(identityId: string): Permission[] {
-    const identity = this.identities.get(identityId);
-    if (!identity) return [];
-
-    const permissions = new Set<Permission>(identity.permissions);
-
-    for (const roleId of identity.roleIds) {
-      const role = this.roles.get(roleId);
-      if (role) {
-        for (const permission of role.permissions) {
-          permissions.add(permission);
-        }
-      }
-    }
-
-    return Array.from(permissions);
-  }
-
-  hasPermission(identityId: string, permission: Permission): boolean {
-    const permissions = this.getEffectivePermissions(identityId);
-    if (permissions.includes('admin')) return true;
-    return permissions.includes(permission);
-  }
-
-  canAccessTool(identityId: string, toolId: string): boolean {
-    const identity = this.identities.get(identityId);
-    if (!identity) return false;
-
-    if (identity.constraints.allowedTools?.length) {
-      return identity.constraints.allowedTools.some(pattern => 
-        toolId === pattern || toolId.includes(pattern.replace('*', ''))
-      );
-    }
-
-    if (identity.constraints.deniedTools?.length) {
-      return !identity.constraints.deniedTools.some(pattern =>
-        toolId === pattern || toolId.includes(pattern.replace('*', ''))
-      );
-    }
-
-    return true;
-  }
-
-  canAccessServer(identityId: string, serverId: string): boolean {
-    const identity = this.identities.get(identityId);
-    if (!identity) return false;
-
-    if (identity.constraints.allowedServers?.length) {
-      return identity.constraints.allowedServers.includes(serverId);
-    }
-
-    if (identity.constraints.deniedServers?.length) {
-      return !identity.constraints.deniedServers.includes(serverId);
-    }
-
-    return true;
-  }
-
-  createContext(identityId: string, options?: { sessionId?: string; requestId?: string }): IdentityContext | null {
-    const identity = this.identities.get(identityId);
-    if (!identity) return null;
-
-    const permissions = this.getEffectivePermissions(identityId);
-    const now = new Date().toISOString();
-
-    return {
-      agentId: identity.id,
-      agentName: identity.name,
-      agentType: identity.type,
-      requestId: options?.requestId || `req-${Date.now()}`,
-      permissions,
-      constraints: identity.constraints as IdentityContext['constraints'],
-      metadata: identity.metadata,
-      issuedAt: now,
-      expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
-    };
-  }
-
-  generateToken(identityId: string, options?: { sessionId?: string; expiresInSeconds?: number }): string | null {
-    const context = this.createContext(identityId, { sessionId: options?.sessionId });
-    if (!context) return null;
-
-    const expiresIn = options?.expiresInSeconds || 86400;
-
-    return jwt.sign(
-      {
-        agentId: context.agentId,
-        agentName: context.agentName,
-        agentType: context.agentType,
-        permissions: context.permissions,
-        constraints: context.constraints,
-        metadata: context.metadata,
-      },
-      this.jwtSecret,
-      { expiresIn }
-    );
-  }
-
-  verifyToken(token: string): IdentityContext | null {
-    try {
-      const payload = jwt.verify(token, this.jwtSecret) as jwt.JwtPayload & {
-        agentId: string;
-        agentName: string;
-        agentType: 'user' | 'agent' | 'service' | 'system';
-        permissions: Permission[];
-        constraints: Record<string, unknown>;
-        metadata: Record<string, unknown>;
-      };
-
-      return {
-      agentId: payload.agentId,
-      agentName: payload.agentName,
-      agentType: payload.agentType,
-      requestId: payload.iat ? `req-${payload.iat}` : `req-${Date.now()}`,
-      permissions: payload.permissions,
-      constraints: payload.constraints as IdentityContext['constraints'],
-      metadata: payload.metadata,
-      issuedAt: new Date(payload.iat! * 1000).toISOString(),
-        expiresAt: new Date(payload.exp! * 1000).toISOString(),
-    };
-    } catch {
-      return null;
-    }
-  }
-}

package/src/identity/types.ts

@@ -1,91 +0,0 @@
-import { z } from 'zod';
-
-export const PermissionSchema = z.enum([
-  'tools:read',
-  'tools:write',
-  'tools:execute',
-  'servers:read',
-  'servers:write',
-  'workflows:read',
-  'workflows:write',
-  'workflows:execute',
-  'admin',
-]);
-
-export const RoleSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  description: z.string(),
-  permissions: z.array(PermissionSchema).default([]),
-  parentRoleId: z.string().optional(),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-});
-
-export const AgentIdentitySchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  type: z.enum(['user', 'agent', 'service', 'system']),
-  description: z.string().optional(),
-  roleIds: z.array(z.string()).default([]),
-  permissions: z.array(PermissionSchema).default([]),
-  constraints: z.object({
-    maxToolsPerRequest: z.number().default(10),
-    maxConcurrentExecutions: z.number().default(5),
-    allowedServers: z.array(z.string()).optional(),
-    deniedServers: z.array(z.string()).optional(),
-    allowedTools: z.array(z.string()).optional(),
-    deniedTools: z.array(z.string()).optional(),
-    rateLimitPerMinute: z.number().optional(),
-    rateLimitPerHour: z.number().optional(),
-  }).default({}),
-  metadata: z.record(z.any()).default({}),
-  trustLevel: z.enum(['untrusted', 'low', 'medium', 'high', 'fully-trusted']).default('medium'),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-  lastActiveAt: z.string().optional(),
-});
-
-export const IdentityContextSchema = z.object({
-  agentId: z.string(),
-  agentName: z.string(),
-  agentType: z.enum(['user', 'agent', 'service', 'system']),
-  sessionId: z.string().optional(),
-  requestId: z.string(),
-  permissions: z.array(PermissionSchema).default([]),
-  constraints: z.record(z.any()).default({}),
-  metadata: z.record(z.any()).default({}),
-  issuedAt: z.string(),
-  expiresAt: z.string().optional(),
-});
-
-export type Permission = z.infer<typeof PermissionSchema>;
-export type Role = z.infer<typeof RoleSchema>;
-export type AgentIdentity = z.infer<typeof IdentitySchema>;
-export type IdentityContext = z.infer<typeof IdentityContextSchema>;
-
-export const IdentitySchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  type: z.enum(['user', 'agent', 'service', 'system']),
-  description: z.string().optional(),
-  roleIds: z.array(z.string()).default([]),
-  permissions: z.array(PermissionSchema).default([]),
-  constraints: z.object({
-    maxToolsPerRequest: z.number().default(10),
-    maxConcurrentExecutions: z.number().default(5),
-    allowedServers: z.array(z.string()).optional(),
-    deniedServers: z.array(z.string()).optional(),
-    allowedTools: z.array(z.string()).optional(),
-    deniedTools: z.array(z.string()).optional(),
-    rateLimitPerMinute: z.number().optional(),
-    rateLimitPerHour: z.number().optional(),
-  }).default({}),
-  metadata: z.record(z.any()).default({}),
-  trustLevel: z.enum(['untrusted', 'low', 'medium', 'high', 'fully-trusted']).default('medium'),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-  lastActiveAt: z.string().optional(),
-});
-
-export type Identity = z.infer<typeof IdentitySchema>;

package/src/index.ts

@@ -1,16 +0,0 @@
-export { ToolRegistry } from './core/registry.js';
-export { AuthService, type AuthContext, type JWTPayload } from './core/auth.js';
-export { TokenCounter } from './core/tokenizer.js';
-export { RegistryServer } from './registry/server.js';
-
-export { WorkflowEngine, WORKFLOW_TEMPLATES, createWorkflowFromTemplate } from './workflow/index.js';
-export type { Workflow, Node, Edge, WorkflowExecution, WorkflowTemplate, ExecutionLog, NodeType } from './workflow/types.js';
-
-export { IdentityManager, AccessControl, type AccessDecision } from './identity/index.js';
-export type { Identity, Role, Permission, IdentityContext } from './identity/types.js';
-
-export { AuditLogger, PolicyEngine, RateLimiter } from './governance/index.js';
-export type { AuditEvent, GovernancePolicy, PolicyRule, ComplianceReport } from './governance/types.js';
-
-export * from './types/index.js';
-export * from './connectors/index.js';

package/src/registry/server.ts

@@ -1,195 +0,0 @@
-import express from 'express';
-import type { Request, Response, NextFunction } from 'express';
-import cors from 'cors';
-import helmet from 'helmet';
-import { ToolRegistry } from '../core/registry.js';
-import { AuthService } from '../core/auth.js';
-import { DiscoveryQuerySchema } from '../types/index.js';
-import { createAllConnectors, createServerFromConnector } from '../connectors/index.js';
-import type { RegistryConfig } from '../types/index.js';
-
-export class RegistryServer {
-  private app: express.Application;
-  private registry: ToolRegistry;
-  private auth: AuthService;
-  private config: RegistryConfig;
-
-  constructor(config: RegistryConfig) {
-    this.config = config;
-    this.registry = new ToolRegistry(config.contextTokenBudget);
-    this.auth = new AuthService(config.jwtSecret, config.apiKey);
-    this.app = express();
-    this.setupMiddleware();
-    this.setupRoutes();
-    this.initializeConnectors();
-  }
-
-  private setupMiddleware(): void {
-    this.app.use(helmet());
-    this.app.use(cors());
-    this.app.use(express.json());
-
-    this.app.use((req: Request, _res: Response, next: NextFunction) => {
-      console.log(`${new Date().toISOString()} ${req.method} ${req.path}`);
-      next();
-    });
-  }
-
-  private setupRoutes(): void {
-    this.app.get('/api/v1/health', (_req: Request, res: Response) => {
-      res.json({
-        name: 'OpalServe',
-        status: 'healthy',
-        version: '1.0.0',
-        timestamp: new Date().toISOString(),
-        uptime: process.uptime(),
-      });
-    });
-
-    this.app.get('/api/v1/discover', async (req: Request, res: Response) => {
-      try {
-        const queryResult = DiscoveryQuerySchema.safeParse(req.query);
-        if (!queryResult.success) {
-          res.status(400).json({ error: 'Invalid query', details: queryResult.error.issues });
-          return;
-        }
-
-        const result = await this.registry.discover(queryResult.data);
-        res.json(result);
-      } catch (error) {
-        console.error('Discovery error:', error);
-        res.status(500).json({ error: 'Discovery failed' });
-      }
-    });
-
-    this.app.get('/api/v1/tools', (_req: Request, res: Response) => {
-      const tools = this.registry.getAllTools();
-      res.json({
-        tools,
-        total: tools.length,
-      });
-    });
-
-    this.app.get('/api/v1/tools/:id', (req: Request, res: Response) => {
-      const toolId = String(req.params.id || '');
-      const tool = this.registry.getTool(toolId);
-      if (!tool) {
-        res.status(404).json({ error: 'Tool not found' });
-        return;
-      }
-      res.json(tool);
-    });
-
-    this.app.get('/api/v1/servers', (_req: Request, res: Response) => {
-      const servers = this.registry.getAllServers();
-      res.json({
-        servers,
-        total: servers.length,
-      });
-    });
-
-    this.app.get('/api/v1/servers/:id', (req: Request, res: Response) => {
-      const serverId = String(req.params.id || '');
-      const server = this.registry.getServer(serverId);
-      if (!server) {
-        res.status(404).json({ error: 'Server not found' });
-        return;
-      }
-      res.json(server);
-    });
-
-    this.app.post('/api/v1/servers/:id/refresh', async (req: Request, res: Response) => {
-      try {
-        const serverId = String(req.params.id || '');
-        await this.registry.refreshServer(serverId);
-        const server = this.registry.getServer(serverId);
-        res.json(server);
-      } catch {
-        res.status(500).json({ error: 'Refresh failed' });
-      }
-    });
-
-    this.app.post('/api/v1/servers/register', async (req: Request, res: Response) => {
-      try {
-        const { server, tools } = req.body;
-        if (server) {
-          this.registry.registerServer(server);
-        }
-        if (tools && Array.isArray(tools)) {
-          for (const tool of tools) {
-            this.registry.registerTool(tool);
-          }
-        }
-        res.json({ success: true });
-      } catch {
-        res.status(500).json({ error: 'Registration failed' });
-      }
-    });
-
-    if (this.config.enableAuth) {
-      this.app.post('/api/v1/auth/token', (req: Request, res: Response) => {
-        const { agentId, permissions, context } = req.body;
-        if (!agentId) {
-          res.status(400).json({ error: 'agentId required' });
-          return;
-        }
-        const token = this.auth.generateToken({
-          agentId,
-          permissions: permissions || ['read', 'discover'],
-          context: context || {},
-        });
-        res.json({ token });
-      });
-
-      this.app.use('/api/v1/discover', this.auth.middleware());
-      this.app.use('/api/v1/tools', this.auth.middleware());
-      this.app.use('/api/v1/servers', this.auth.middleware());
-    }
-  }
-
-  private async initializeConnectors(): Promise<void> {
-    const connectors = createAllConnectors();
-
-    for (const [id, connector] of connectors) {
-      try {
-        await connector.connect();
-        const server = createServerFromConnector(connector);
-        this.registry.registerServer(server);
-        this.registry.registerServerInstance(connector);
-
-        const tools = connector.getTools();
-        for (const tool of tools) {
-          this.registry.registerTool(tool);
-        }
-
-        console.log(`[${id}] Connected with ${tools.length} tools`);
-      } catch (error) {
-        console.error(`[${id}] Connection failed:`, error);
-      }
-    }
-  }
-
-  async start(): Promise<void> {
-    return new Promise((resolve) => {
-      this.app.listen(this.config.port, this.config.host, () => {
-        console.log(`
-╔══════════════════════════════════════════════════════════════╗
-║                 OpalServe Registry Server                   ║
-╠══════════════════════════════════════════════════════════════╣
-║  Name:       OpalServe MCP Registry                        ║
-║  HTTP:       http://${this.config.host}:${this.config.port}                              ║
-║  Health:     http://${this.config.host}:${this.config.port}/api/v1/health           ║
-║  Discover:   http://${this.config.host}:${this.config.port}/api/v1/discover        ║
-║  Tools API:  http://${this.config.host}:${this.config.port}/api/v1/tools           ║
-║  Servers API:http://${this.config.host}:${this.config.port}/api/v1/servers        ║
-╚══════════════════════════════════════════════════════════════╝
-        `);
-        resolve();
-      });
-    });
-  }
-
-  async stop(): Promise<void> {
-    console.log('Shutting down OpalServe registry...');
-  }
-}

package/src/types/index.ts

@@ -1,128 +0,0 @@
-import { z } from 'zod';
-
-export const ToolSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  description: z.string(),
-  serverId: z.string(),
-  serverName: z.string(),
-  inputSchema: z.record(z.any()),
-  outputSchema: z.record(z.any()).optional(),
-  tags: z.array(z.string()).default([]),
-  capabilities: z.array(z.string()).default([]),
-  authRequirements: z.object({
-    required: z.array(z.string()).default([]),
-    optional: z.array(z.string()).default([]),
-  }).default({}),
-  rateLimits: z.object({
-    requestsPerMinute: z.number().optional(),
-    requestsPerHour: z.number().optional(),
-  }).optional(),
-  contextRequirements: z.object({
-    minTokens: z.number().default(0),
-    maxTokens: z.number().default(1000),
-  }).default({}),
-  metadata: z.record(z.any()).default({}),
-  createdAt: z.string(),
-  updatedAt: z.string(),
-});
-
-export type Tool = z.infer<typeof ToolSchema>;
-
-export const ServerSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  type: z.enum(['github', 'slack', 'postgres', 'google-drive', 'custom', 'http']),
-  status: z.enum(['active', 'inactive', 'error', 'connecting']),
-  endpoint: z.string().optional(),
-  localCommand: z.string().optional(),
-  description: z.string(),
-  version: z.string().default('1.0.0'),
-  capabilities: z.array(z.string()).default([]),
-  tags: z.array(z.string()).default([]),
-  health: z.object({
-    status: z.enum(['healthy', 'degraded', 'unhealthy']),
-    lastChecked: z.string(),
-    responseTimeMs: z.number().optional(),
-    errorCount: z.number().default(0),
-  }).default({ status: 'healthy', lastChecked: new Date().toISOString() }),
-  auth: z.object({
-    type: z.enum(['none', 'api-key', 'oauth', 'jwt', 'basic']),
-    configured: z.boolean().default(false),
-  }).default({ type: 'none', configured: false }),
-  metadata: z.record(z.any()).default({}),
-  registeredAt: z.string(),
-  lastSeen: z.string(),
-});
-
-export type Server = z.infer<typeof ServerSchema>;
-
-export const DiscoveryQuerySchema = z.object({
-  query: z.string().optional(),
-  capabilities: z.array(z.string()).optional(),
-  tags: z.array(z.string()).optional(),
-  limit: z.coerce.number().min(1).max(100).default(20),
-  offset: z.coerce.number().min(0).default(0),
-  contextBudget: z.coerce.number().min(1000).max(200000).default(128000),
-  includeServers: z.coerce.boolean().default(true),
-});
-
-export type DiscoveryQuery = z.infer<typeof DiscoveryQuerySchema>;
-
-export const DiscoveryResultSchema = z.object({
-  tools: z.array(z.object({
-    tool: ToolSchema,
-    relevanceScore: z.number().min(0).max(1),
-    matchReasons: z.array(z.string()).default([]),
-    tokenEstimate: z.number(),
-  })),
-  servers: z.array(ServerSchema),
-  totalMatches: z.number(),
-  contextUsed: z.number(),
-  contextBudget: z.number(),
-  suggestions: z.array(z.string()).default([]),
-  queryInterpretation: z.string(),
-});
-
-export type DiscoveryResult = z.infer<typeof DiscoveryResultSchema>;
-
-export interface MCPServer {
-  id: string;
-  name: string;
-  type: string;
-  getTools(): Tool[];
-  connect(): Promise<void>;
-  disconnect(): Promise<void>;
-  healthCheck(): Promise<{ healthy: boolean; latencyMs?: number }>;
-}
-
-export interface ConnectorConfig {
-  serverId: string;
-  endpoint?: string;
-  auth?: {
-    type: 'none' | 'api-key' | 'oauth' | 'jwt' | 'basic';
-    credentials?: Record<string, string>;
-  };
-  options?: Record<string, unknown>;
-}
-
-export interface RegistryConfig {
-  port: number;
-  host: string;
-  jwtSecret: string;
-  apiKey?: string;
-  maxToolsPerResponse: number;
-  contextTokenBudget: number;
-  enableAuth: boolean;
-}
-
-export interface ToolDefinition {
-  name: string;
-  description: string;
-  inputSchema: Record<string, unknown>;
-  tags?: string[];
-  capabilities?: string[];
-  authRequirements?: { required?: string[]; optional?: string[] };
-  contextRequirements?: { minTokens?: number; maxTokens?: number };
-  metadata?: Record<string, unknown>;
-}