qa360 2.1.2 → 2.1.4

package/packages/mcp/src/security/manager.ts

@@ -0,0 +1,242 @@
+/**
+ * QA360 MCP Security Manager
+ * Handles authentication, authorization, rate limiting, and sandboxing
+ */
+
+import { resolve, normalize, relative } from 'path';
+import { existsSync } from 'fs';
+import { SecurityRedactor } from 'qa360-core';
+import { MCPServerConfig } from '../types/index.js';
+
+export class SecurityManager {
+  private config: MCPServerConfig;
+  private redactor: SecurityRedactor;
+  private rateLimitMap: Map<string, number[]> = new Map();
+
+  constructor(config: MCPServerConfig) {
+    this.config = config;
+    this.redactor = SecurityRedactor.forReports();
+  }
+
+  /**
+   * Validate tool call permissions and arguments
+   */
+  async validateToolCall(toolName: string, args: any): Promise<void> {
+    // Check tool permissions
+    if (toolName === 'qa360.run' && !this.config.allowRun) {
+      throw new Error('qa360.run tool requires --allow-run flag');
+    }
+
+    if (toolName.startsWith('qa360.secrets.') && !this.config.allowSecrets) {
+      throw new Error('Secrets tools require --allow-secrets flag');
+    }
+
+    // Validate file paths
+    if (args.packPath) {
+      this.validatePath(args.packPath);
+    }
+
+    if (args.bundlePath) {
+      this.validatePath(args.bundlePath);
+    }
+
+    if (args.path) {
+      this.validatePath(args.path);
+    }
+
+    // Check QA360 directory requirement
+    if (this.config.sandbox.requireQA360Dir) {
+      const qa360Dir = resolve(process.cwd(), '.qa360');
+      if (!existsSync(qa360Dir)) {
+        throw new Error('QA360 directory (.qa360) not found. Run a test first to initialize.');
+      }
+    }
+  }
+
+  /**
+   * Validate and normalize file paths
+   */
+  private validatePath(filePath: string): void {
+    const normalizedPath = normalize(resolve(filePath));
+    const cwd = process.cwd();
+
+    // Check if path is within allowed directories
+    const isAllowed = this.config.sandbox.allowedPaths.some(allowedPath => {
+      const resolvedAllowed = resolve(allowedPath);
+      const relativePath = relative(resolvedAllowed, normalizedPath);
+      return !relativePath.startsWith('..') && !relativePath.startsWith('/');
+    });
+
+    if (!isAllowed) {
+      throw new Error(`Path access denied: ${filePath}. Path must be within allowed directories.`);
+    }
+
+    // Prevent dangerous paths
+    const dangerousPaths = [
+      '/etc',
+      '/usr',
+      '/bin',
+      '/sbin',
+      '/System',
+      '/Library',
+      '/Windows',
+      '/Program Files'
+    ];
+
+    if (dangerousPaths.some(dangerous => normalizedPath.startsWith(dangerous))) {
+      throw new Error(`Access to system directory denied: ${filePath}`);
+    }
+
+    // Prevent traversal attacks
+    if (filePath.includes('..') || filePath.includes('~')) {
+      throw new Error(`Path traversal detected: ${filePath}`);
+    }
+  }
+
+  /**
+   * Check rate limiting
+   */
+  async checkRateLimit(): Promise<void> {
+    const now = Date.now();
+    const windowMs = this.config.rateLimit.window * 1000;
+    const key = 'global'; // Could be per-client in the future
+
+    if (!this.rateLimitMap.has(key)) {
+      this.rateLimitMap.set(key, []);
+    }
+
+    const requests = this.rateLimitMap.get(key)!;
+    
+    // Remove old requests outside the window
+    const validRequests = requests.filter(timestamp => now - timestamp < windowMs);
+    
+    if (validRequests.length >= this.config.rateLimit.requests) {
+      throw new Error(`Rate limit exceeded: ${this.config.rateLimit.requests} requests per ${this.config.rateLimit.window}s`);
+    }
+
+    // Add current request
+    validRequests.push(now);
+    this.rateLimitMap.set(key, validRequests);
+  }
+
+  /**
+   * Redact sensitive information from data
+   */
+  redactSensitiveData(data: any): any {
+    if (typeof data === 'string') {
+      return this.redactor.redact(data);
+    }
+
+    if (Array.isArray(data)) {
+      return data.map(item => this.redactSensitiveData(item));
+    }
+
+    if (data && typeof data === 'object') {
+      const redacted: any = {};
+      for (const [key, value] of Object.entries(data)) {
+        // Always redact known sensitive fields
+        if (this.isSensitiveField(key)) {
+          redacted[key] = '***';
+        } else {
+          redacted[key] = this.redactSensitiveData(value);
+        }
+      }
+      return redacted;
+    }
+
+    return data;
+  }
+
+  /**
+   * Check if field name indicates sensitive data
+   */
+  private isSensitiveField(fieldName: string): boolean {
+    const sensitiveFields = [
+      'password',
+      'secret',
+      'token',
+      'key',
+      'auth',
+      'credential',
+      'private',
+      'value' // For secrets.add
+    ];
+
+    const lowerField = fieldName.toLowerCase();
+    return sensitiveFields.some(sensitive => lowerField.includes(sensitive));
+  }
+
+  /**
+   * Validate tool arguments against schema
+   */
+  validateArguments(toolName: string, args: any): void {
+    // Basic validation - could be enhanced with JSON Schema
+    if (!args || typeof args !== 'object') {
+      throw new Error('Tool arguments must be an object');
+    }
+
+    // Tool-specific validation
+    switch (toolName) {
+      case 'qa360.run':
+        if (!args.packPath || typeof args.packPath !== 'string') {
+          throw new Error('qa360.run requires packPath string argument');
+        }
+        break;
+
+      case 'qa360.history.get':
+      case 'qa360.history.pin':
+      case 'qa360.history.unpin':
+        if (!args.runId || typeof args.runId !== 'string') {
+          throw new Error(`${toolName} requires runId string argument`);
+        }
+        if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(args.runId)) {
+          throw new Error('runId must be a valid UUID');
+        }
+        break;
+
+      case 'qa360.history.diff':
+        if (!args.runA || !args.runB || typeof args.runA !== 'string' || typeof args.runB !== 'string') {
+          throw new Error('qa360.history.diff requires runA and runB string arguments');
+        }
+        break;
+
+      case 'qa360.secrets.add':
+        if (!args.name || !args.value || typeof args.name !== 'string' || typeof args.value !== 'string') {
+          throw new Error('qa360.secrets.add requires name and value string arguments');
+        }
+        break;
+    }
+  }
+
+  /**
+   * Check if operation is allowed based on current concurrency
+   */
+  private concurrentOperations = 0;
+
+  async acquireConcurrencySlot(): Promise<void> {
+    if (this.concurrentOperations >= this.config.maxConcurrency) {
+      throw new Error(`Maximum concurrency reached: ${this.config.maxConcurrency}`);
+    }
+    this.concurrentOperations++;
+  }
+
+  releaseConcurrencySlot(): void {
+    if (this.concurrentOperations > 0) {
+      this.concurrentOperations--;
+    }
+  }
+
+  /**
+   * Get current security status
+   */
+  getSecurityStatus(): any {
+    return {
+      allowRun: this.config.allowRun,
+      allowSecrets: this.config.allowSecrets,
+      maxConcurrency: this.config.maxConcurrency,
+      currentConcurrency: this.concurrentOperations,
+      rateLimit: this.config.rateLimit,
+      auditEnabled: this.config.audit.enabled
+    };
+  }
+}

package/packages/mcp/src/server/full-server.ts

@@ -0,0 +1,212 @@
+import { fileURLToPath } from 'url';
+
+/**
+ * QA360 MCP Server - Real Implementation
+ * Model Context Protocol server exposing QA360 tools to LLMs and IDEs
+ */
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+  InitializeRequestSchema
+} from '@modelcontextprotocol/sdk/types.js';
+import { Command } from 'commander';
+import chalk from 'chalk';
+import { buildToolsRegistry } from '../tools/registry.js';
+
+interface MCPServerConfig {
+  allowRun: boolean;
+  allowSecrets: boolean;
+  maxConcurrency: number;
+  rateLimit: {
+    requests: number;
+    window: number;
+  };
+  audit: {
+    enabled: boolean;
+    logPath: string;
+  };
+}
+
+const DEFAULT_CONFIG: MCPServerConfig = {
+  allowRun: false,
+  allowSecrets: false,
+  maxConcurrency: 2,
+  rateLimit: {
+    requests: 5,
+    window: 1
+  },
+  audit: {
+    enabled: true,
+    logPath: '~/.qa360/mcp-audit.log'
+  }
+};
+
+class QA360MCPServer {
+  private server: Server;
+  private config: MCPServerConfig;
+  private toolRegistry: ReturnType<typeof buildToolsRegistry>;
+
+  constructor(config: MCPServerConfig) {
+    this.config = config;
+    this.toolRegistry = buildToolsRegistry({
+      allowRun: config.allowRun,
+      allowSecrets: config.allowSecrets
+    });
+
+    this.server = new Server({
+      name: 'qa360-mcp',
+      version: '0.9.0-mcp'
+    });
+
+    this.setupHandlers();
+  }
+
+  private setupHandlers() {
+    // Initialize handler
+    this.server.setRequestHandler(InitializeRequestSchema, async () => ({
+      protocolVersion: '2024-11-05',
+      capabilities: {
+        tools: {}
+      }
+    }));
+
+    // List tools handler
+    this.server.setRequestHandler(ListToolsRequestSchema, async () => ({
+      tools: this.toolRegistry.describe()
+    }));
+
+    // Call tool handler
+    this.server.setRequestHandler(CallToolRequestSchema, async (request) => {
+      const { name, arguments: args } = request.params;
+      
+      try {
+        const result = await this.toolRegistry.call(name, args);
+        return {
+          content: [
+            {
+              type: 'text',
+              text: JSON.stringify(result, null, 2)
+            }
+          ]
+        };
+      } catch (error) {
+        throw new Error(`Tool execution failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+      }
+    });
+  }
+
+  async start() {
+    const transport = new StdioServerTransport();
+    await this.server.connect(transport);
+    
+    console.error(chalk.green('[QA360 MCP Server] Started successfully'));
+    console.error(chalk.blue('[Config]'), JSON.stringify({
+      allowRun: this.config.allowRun,
+      allowSecrets: this.config.allowSecrets,
+      maxConcurrency: this.config.maxConcurrency,
+      rateLimit: this.config.rateLimit
+    }, null, 2));
+  }
+
+  async stop() {
+    await this.server.close();
+  }
+}
+
+// CLI Setup
+const program = new Command();
+
+program
+  .name('qa360-mcp')
+  .description('QA360 Model Context Protocol Server')
+  .version('0.9.0-mcp')
+  .option('--allow-run', 'Allow qa360.run tool execution', false)
+  .option('--allow-secrets', 'Allow secrets management tools', false)
+  .option('--max-concurrency <number>', 'Maximum concurrent operations', '2')
+  .option('--rate-limit <number>', 'Rate limit (requests per second)', '5')
+  .option('--no-audit', 'Disable audit logging')
+  .option('--audit-path <path>', 'Custom audit log path')
+  .option('--dry-run', 'Show configuration without starting server', false)
+  .option('--help-tools', 'Show available tools and exit', false);
+
+program.action(async (options) => {
+  const config: MCPServerConfig = {
+    ...DEFAULT_CONFIG,
+    allowRun: options.allowRun,
+    allowSecrets: options.allowSecrets,
+    maxConcurrency: parseInt(options.maxConcurrency) || DEFAULT_CONFIG.maxConcurrency,
+    rateLimit: {
+      requests: parseInt(options.rateLimit) || DEFAULT_CONFIG.rateLimit.requests,
+      window: DEFAULT_CONFIG.rateLimit.window
+    },
+    audit: {
+      enabled: !options.noAudit,
+      logPath: options.auditPath || DEFAULT_CONFIG.audit.logPath
+    }
+  };
+
+  if (options.dryRun) {
+    console.log(chalk.blue.bold('QA360 MCP Server Configuration:'));
+    console.log(JSON.stringify(config, null, 2));
+    return;
+  }
+
+  if (options.helpTools) {
+    const registry = buildToolsRegistry({
+      allowRun: config.allowRun,
+      allowSecrets: config.allowSecrets
+    });
+    
+    console.log(chalk.blue.bold('QA360 MCP Server - Available Tools:'));
+    console.log('');
+    
+    const tools = registry.describe();
+    tools.forEach(tool => {
+      console.log(chalk.cyan(`    ${(tool as any).name}`), chalk.white((tool as any).name), '-', (tool as any).description);
+    });
+    
+    console.log('');
+    console.log(chalk.yellow('Security flags:'));
+    console.log('  --allow-run Enable qa360.run (requires explicit opt-in)');
+    console.log('  --allow-secrets Enable secrets.* tools (requires explicit opt-in)');
+    console.log('');
+    return;
+  }
+
+  const server = new QA360MCPServer(config);
+
+  // Graceful shutdown
+  process.on('SIGINT', async () => {
+    console.error(chalk.yellow('\nShutting down...'));
+    await server.stop();
+    process.exit(0);
+  });
+
+  process.on('SIGTERM', async () => {
+    await server.stop();
+    process.exit(0);
+  });
+
+  try {
+    await server.start();
+  } catch (error) {
+    console.error(chalk.red('Failed to start MCP server:'), error);
+    process.exit(1);
+  }
+});
+
+// Handle unhandled rejections
+process.on('unhandledRejection', (reason, promise) => {
+  console.error(chalk.red('Unhandled Rejection at:'), promise, chalk.red('reason:'), reason);
+  process.exit(1);
+});
+
+// CLI entrypoint (CommonJS)
+
+/** ESM entrypoint (équivalent de require.main === module) */
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  program.parse();
+}

package/packages/mcp/src/server/minimal-server.ts

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+/**
+ * Minimal MCP Server for QA360 CLI
+ * Provides basic health check and validation tools
+ */
+
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema,
+} from '@modelcontextprotocol/sdk/types.js';
+
+// Create server instance
+const server = new Server(
+  {
+    name: 'qa360-mcp-minimal',
+    version: '1.0.0',
+  }
+);
+
+// Define available tools
+const tools = [
+  {
+    name: 'qa360.health',
+    description: 'Check QA360 system health',
+    inputSchema: {
+      type: 'object',
+      properties: {},
+    },
+  },
+  {
+    name: 'qa360.pack.validate',
+    description: 'Validate a QA360 test pack',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        packPath: {
+          type: 'string',
+          description: 'Path to the pack YAML file',
+        },
+      },
+      required: ['packPath'],
+    },
+  },
+  {
+    name: 'qa360.history.list',
+    description: 'List recent QA360 test runs',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        limit: {
+          type: 'number',
+          description: 'Maximum number of runs to return',
+          default: 10,
+        },
+      },
+    },
+  },
+];
+
+// Handle tool listing
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+  return { tools };
+});
+
+// Handle tool execution
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  const { name, arguments: args } = request.params;
+
+  switch (name) {
+    case 'qa360.health':
+      return {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({
+              status: 'healthy',
+              version: '1.0.0',
+              timestamp: new Date().toISOString(),
+              checks: {
+                server: 'ok',
+                tools: 'ok',
+              },
+            }, null, 2),
+          },
+        ],
+      };
+
+    case 'qa360.pack.validate':
+      return {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({
+              valid: true,
+              packPath: args?.packPath || 'unknown',
+              message: 'Pack validation successful (minimal server)',
+            }, null, 2),
+          },
+        ],
+      };
+
+    case 'qa360.history.list':
+      return {
+        content: [
+          {
+            type: 'text',
+            text: JSON.stringify({
+              runs: [],
+              message: 'No runs found (minimal server)',
+            }, null, 2),
+          },
+        ],
+      };
+
+    default:
+      throw new Error(`Unknown tool: ${name}`);
+  }
+});
+
+// Start server
+async function main() {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  
+  // Log to stderr (stdout is for MCP protocol)
+  console.error('QA360 MCP Minimal Server started');
+}
+
+main().catch((error) => {
+  console.error('Server error:', error);
+  process.exit(1);
+});