rhombus-node-mcp 0.1.34 → 0.1.36

package/dist/api/get-accessible-apps.js

@@ -0,0 +1,40 @@
+import { logger } from "../logger.js";
+import { postApi } from "../network/network.js";
+/**
+ * Fetches `user.accessibleRhombusApps` from getCurrentUser for the given session.
+ * Successful results are cached in-memory for the lifetime of the session;
+ * failures are NOT cached so transient errors don't poison the session.
+ * Returns null on error or missing session; callers should fall back to a
+ * permissive default.
+ */
+const cache = new Map();
+export async function resolveAccessibleApps(sessionId) {
+    if (!sessionId)
+        return null;
+    const cached = cache.get(sessionId);
+    if (cached !== undefined)
+        return cached;
+    try {
+        const res = await postApi({
+            route: "/customer/getCurrentUser",
+            body: {},
+            sessionId,
+        });
+        if (res.error) {
+            logger.warn(`resolveAccessibleApps: getCurrentUser failed for session ${sessionId}`);
+            return null;
+        }
+        const apps = (res.user?.accessibleRhombusApps ?? []).filter((a) => a !== null && a !== undefined);
+        cache.set(sessionId, apps);
+        logger.info(`resolveAccessibleApps: session ${sessionId} -> [${apps.join(", ")}]`);
+        return apps;
+    }
+    catch (e) {
+        logger.warn(`resolveAccessibleApps: error for session ${sessionId}: ${String(e)}`);
+        return null;
+    }
+}
+/** Drop the cached entry — call when a session ends. */
+export function clearAccessibleAppsCache(sessionId) {
+    cache.delete(sessionId);
+}

package/dist/createServer.js

@@ -1,29 +1,93 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import path from "path";
+import { resolveAccessibleApps } from "./api/get-accessible-apps.js";
 import { logger } from "./logger.js";
 import { createFilteringProxy } from "./util.js";
 import getResources from "./resources/getResources.js";
-import getTools from "./tools/getTools.js";
+import { getConsoleTools, getPartnerTools, getSharedTools, } from "./tools/getTools.js";
+import { RhombusAppEnum } from "./types/schema.js";
 let initiated = false;
 let resources;
-let tools;
+let sharedTools;
+let consoleTools;
+let partnerTools;
 export async function serverInit() {
     resources = await getResources();
     logger.info(`📚 Found ${resources.length} resources`);
     for (const resource of resources) {
         logger.debug(`📕 - ${resource.name}`);
     }
-    tools = await getTools();
-    logger.info(`🛠️ Found ${tools.length} tools`);
-    for (const tool of tools) {
-        logger.debug(`🔧 - ${tool.name}`);
-    }
+    sharedTools = await getSharedTools();
+    consoleTools = await getConsoleTools();
+    partnerTools = await getPartnerTools();
+    logger.info(`🛠️ Found ${sharedTools.length} shared, ${consoleTools.length} console, ${partnerTools.length} partner tools`);
+    for (const tool of sharedTools)
+        logger.debug(`🔧 shared - ${tool.name}`);
+    for (const tool of consoleTools)
+        logger.debug(`🔧 console - ${tool.name}`);
+    for (const tool of partnerTools)
+        logger.debug(`🔧 partner - ${tool.name}`);
     initiated = true;
 }
-export default async function createServer() {
+/**
+ * Compose the tool set to register based on the caller's accessibleRhombusApps.
+ * Shared tools are always included.
+ *
+ * If **PARTNER** is among the caller's apps (including alongside CONSOLE), only
+ * **partner** tools are added — never the console-only set (partner capability
+ * is stricter).
+ *
+ * Else if **CONSOLE** is present, add **console** tools only.
+ *
+ * Otherwise (unresolved session, empty apps, or only other enums like
+ * RHOMBUS_KEY), fall back to the permissive union of console + partner sets.
+ */
+function pickToolsForSession(apps) {
+    if (apps !== null && apps.length > 0 && apps.includes(RhombusAppEnum.PARTNER)) {
+        return [...sharedTools, ...partnerTools];
+    }
+    if (apps !== null && apps.length > 0 && apps.includes(RhombusAppEnum.CONSOLE)) {
+        return [...sharedTools, ...consoleTools];
+    }
+    return [...sharedTools, ...consoleTools, ...partnerTools];
+}
+function isNodeDevEnvironment() {
+    return process.env.NODE_ENV === "development";
+}
+/**
+ * Human-readable caller + tool-set summary for dev logs (must stay aligned with
+ * {@link pickToolsForSession}).
+ */
+function describeCallerForDevLogs(apps) {
+    if (apps === null) {
+        return "caller=unknown (no session or unresolved apps); tool sets=shared + console + partner (permissive)";
+    }
+    if (apps.length === 0) {
+        return "caller=unknown (empty accessibleRhombusApps); tool sets=shared + console + partner (permissive)";
+    }
+    if (apps.includes(RhombusAppEnum.PARTNER)) {
+        const alsoConsole = apps.includes(RhombusAppEnum.CONSOLE);
+        return alsoConsole
+            ? `caller=partner (PARTNER in [${apps.join(", ")}], console tools suppressed); tool sets=shared + partner`
+            : "caller=partner user; tool sets=shared + partner";
+    }
+    if (apps.includes(RhombusAppEnum.CONSOLE)) {
+        return "caller=console user; tool sets=shared + console";
+    }
+    return `caller=other (accessibleRhombusApps=[${apps.join(", ")}]); tool sets=shared + console + partner (permissive)`;
+}
+function logDevToolRegistration(sessionId, apps, toolsToRegister) {
+    if (!isNodeDevEnvironment())
+        return;
+    const names = toolsToRegister.map((t) => path.basename(t.name, ".js")).sort();
+    logger.info(`[dev MCP tools] session=${sessionId ?? "(none)"} — ${describeCallerForDevLogs(apps)} — registering ${names.length} tools`);
+    logger.info(`[dev MCP tools] tool names: ${names.join(", ")}`);
+}
+export default async function createServer({ sessionId } = {}) {
     if (!initiated) {
         await serverInit();
     }
-    logger.info(`🖥️ Creating Server`);
+    logger.info(`🖥️ Creating Server for session ${sessionId ?? "(stateless)"}`);
     const server = new McpServer({
         name: "rhombus-node-mcp",
         version: "1.0.0",
@@ -36,9 +100,13 @@ export default async function createServer() {
     for (const resource of resources) {
         resource.create(server);
     }
-    logger.info(`🛠️ Registered ${resources.length} resources`);
+    logger.info(`📚 Registered ${resources.length} resources`);
+    const apps = await resolveAccessibleApps(sessionId);
+    const toolsToRegister = pickToolsForSession(apps);
+    logDevToolRegistration(sessionId, apps, toolsToRegister);
+    logger.info(`🔒 Session ${sessionId ?? "(none)"}: apps=[${apps?.join(", ") ?? "unknown"}] — registering ${toolsToRegister.length} tools`);
     const filteredServer = createFilteringProxy(server, new Set(["time-tool", "count-tool", "time-conversion-tool"]));
-    for (const tool of tools) {
+    for (const tool of toolsToRegister) {
         try {
             await tool.create(filteredServer);
         }
@@ -47,7 +115,7 @@ export default async function createServer() {
             // Continue with other tools instead of failing completely
         }
     }
-    logger.info(`🛠️ Registered ${tools.length} tools`);
+    logger.info(`🛠️ Registered ${toolsToRegister.length} tools`);
     logger.info(`✅ Server created`);
     return server;
 }

package/dist/filtering-utils.js

@@ -168,6 +168,17 @@ export function applyFilterBy(obj, conditions) {
             result[topKey] = result[topKey].filter((item) => keyConds.every((c) => matchesCondition(item, c)));
         }
     }
+    // If the result has a sibling `count: number` and exactly one top-level
+    // array, sync count to the (now-filtered) array length. This makes `count`
+    // reflect what the model is looking at — pre-filter total when no filterBy
+    // was applied (handler computed it), post-filter total when one was. Any
+    // tool returning {count, items[]} gets this for free.
+    if (typeof result.count === "number") {
+        const arrayKeys = Object.keys(result).filter((k) => Array.isArray(result[k]));
+        if (arrayKeys.length === 1) {
+            result.count = result[arrayKeys[0]].length;
+        }
+    }
     return result;
 }
 // ---------------------------------------------------------------------------

package/dist/tools/getTools.js

@@ -1,22 +1,45 @@
-import { fileURLToPath } from "node:url";
 import path from "path";
+import { fileURLToPath } from "node:url";
 import { getFilePathsInDirectory } from "../util.js";
-async function getTools() {
-    const currentDir = path.dirname(fileURLToPath(import.meta.url));
-    const filePaths = getFilePathsInDirectory(currentDir);
+const SELF_BASENAME = "getTools.js";
+async function loadFrom(dir) {
+    let filePaths;
+    try {
+        filePaths = getFilePathsInDirectory(dir);
+    }
+    catch {
+        // Directory doesn't exist (e.g. an empty `tools-partner` for a project that
+        // hasn't filled it in yet) — return empty list rather than failing.
+        return [];
+    }
     const tools = [];
     for (const filePath of filePaths) {
-        // ensure it's a js file
         if (!filePath.endsWith(".js"))
             continue;
+        if (path.basename(filePath) === SELF_BASENAME)
+            continue;
         const imported = (await import(filePath));
         if (imported.createTool !== undefined) {
-            tools.push({
-                name: filePath,
-                create: imported.createTool,
-            });
+            tools.push({ name: filePath, create: imported.createTool });
         }
     }
     return tools;
 }
-export default getTools;
+/** Tools visible to every caller (shared / universal — time, identity, lookups). */
+export async function getSharedTools() {
+    // This file lives in `src/tools/`, so its directory IS the shared tools dir.
+    return loadFrom(path.dirname(fileURLToPath(import.meta.url)));
+}
+/** Tools visible only to console (non-partner) callers. From `src/tools-console/`. */
+export async function getConsoleTools() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return loadFrom(path.resolve(here, "..", "tools-console"));
+}
+/** Tools visible only to partner callers. From `src/tools-partner/`. */
+export async function getPartnerTools() {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return loadFrom(path.resolve(here, "..", "tools-partner"));
+}
+// Backwards-compatible default — returns the shared set so existing callers
+// don't break, but new code should pick the explicit functions.
+export default getSharedTools;

package/dist/transports/streamable-http.js

@@ -1,8 +1,9 @@
+import crypto from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import cors from "cors";
 import express from "express";
-import crypto from "node:crypto";
+import { clearAccessibleAppsCache } from "../api/get-accessible-apps.js";
 import createServer from "../createServer.js";
 import { logger } from "../logger.js";
 var AuthScheme;
@@ -14,6 +15,54 @@ var AuthScheme;
 })(AuthScheme || (AuthScheme = {}));
 export const authStore = new Map();
 const transports = new Map();
+/**
+ * Populate authStore for the given sessionId based on the request headers.
+ * Done up-front (before createServer) so resolveAccessibleApps can read auth
+ * during tool registration. Returns true on success.
+ */
+function populateAuthStore(req, sessionId) {
+    const oauthToken = req.headers["x-auth-access-token"];
+    const authScheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN;
+    if (oauthToken && typeof oauthToken === "string") {
+        authStore.set(sessionId, { oauthToken, createdMs: Date.now() });
+        logger.info(`🔒 MCP request authenticated with oauth token (session ${sessionId})`);
+        return true;
+    }
+    if (authScheme === AuthScheme.API_TOKEN) {
+        const apiKey = "x-auth-apikey" in req.headers
+            ? req.headers["x-auth-apikey"]
+            : process.env.RHOMBUS_API_KEY;
+        if (!apiKey) {
+            logger.warn("populateAuthStore: API_TOKEN scheme but no api key found");
+            return false;
+        }
+        logger.info(`🔒 MCP request authenticated with api key (session ${sessionId})`);
+        authStore.set(sessionId, { apiKey, createdMs: Date.now() });
+        return true;
+    }
+    if (authScheme === AuthScheme.CHATBOT &&
+        "x-auth-session" in req.headers &&
+        "x-auth-chat" in req.headers) {
+        logger.info(`🔒 MCP request authenticated with x-auth-session: ${req.headers["x-auth-session"]} and x-auth-chat: ${req.headers["x-auth-chat"]}`);
+        authStore.set(sessionId, {
+            sessionId: req.headers["x-auth-session"],
+            latestRecordUuid: req.headers["x-auth-chat"],
+            createdMs: Date.now(),
+        });
+        return true;
+    }
+    if (authScheme === AuthScheme.WEB2 && "x-auth-cookie" in req.headers) {
+        logger.info(`🔒 MCP request authenticated with x-auth-cookie (session ${sessionId})`);
+        authStore.set(sessionId, {
+            cookie: req.headers["x-auth-cookie"],
+            sessionAlias: req.headers["x-auth-session-alias"],
+            createdMs: Date.now(),
+        });
+        return true;
+    }
+    logger.warn(`populateAuthStore: invalid auth scheme. x-auth-scheme: ${req.headers["x-auth-scheme"]}, x-auth-session: ${req.headers["x-auth-session"]}, x-auth-chat: ${req.headers["x-auth-chat"]}`);
+    return false;
+}
 export default function streamableHttpTransport() {
     const app = express();
     app.use(express.json());
@@ -26,7 +75,6 @@ export default function streamableHttpTransport() {
     /**
      * STATEFUL ENDPOINT
      */
-    const authRequired = ["tools/call"];
     app.post("/mcp", async (req, res) => {
         logger.info(`Received MCP request`, JSON.stringify(req.body, null, 2));
         // Check for existing session ID
@@ -41,76 +89,29 @@ export default function streamableHttpTransport() {
             transport = _transport;
         }
         else if (!sessionId && isInitializeRequest(req.body)) {
-            // New initialization request
+            // New initialization request — mint our sessionId up front so we can
+            // populate authStore and gate tool registration BEFORE the SDK calls
+            // onsessioninitialized.
+            const newSessionId = crypto.randomUUID();
+            const authOk = populateAuthStore(req, newSessionId);
+            // Reject the initialize itself when auth couldn't be populated. Letting
+            // the session through without an authStore entry only defers the failure:
+            // any later /customer/getCurrentUser (during tool registration) or tool
+            // call will throw "No auth found for sessionId" from network.ts, which
+            // is harder to diagnose than an upfront 401 here.
+            if (!authOk) {
+                logger.error(`Auth could not be populated for ${req.body.method}; rejecting`);
+                res
+                    .status(401)
+                    .setHeader("WWW-Authenticate", `Bearer realm="${process.env.REALM}", error="invalid_token", error_description="The access token is missing or invalid"`)
+                    .send("Unauthorized");
+                return;
+            }
             transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: crypto.randomUUID,
+                sessionIdGenerator: () => newSessionId,
                 onsessioninitialized: sessionId => {
-                    // Store the transport by session ID
                     transports.set(sessionId, transport);
                     logger.info(`🔒 MCP request initialized with sessionId: ${sessionId}`);
-                    try {
-                        const oauthToken = req.headers["x-auth-access-token"];
-                        const authScheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN; // otherwise, read 'x-auth-scheme'
-                        // if oauth token is provided
-                        if (oauthToken && typeof oauthToken === "string") {
-                            authStore.set(sessionId, {
-                                oauthToken: oauthToken,
-                                createdMs: Date.now(),
-                            });
-                            logger.info(`🔒 MCP request authenticated with oauth token: ${oauthToken}`);
-                        }
-                        else if (authScheme === AuthScheme.API_TOKEN) {
-                            const apiKey = "x-auth-apikey" in req.headers
-                                ? req.headers["x-auth-apikey"]
-                                : process.env.RHOMBUS_API_KEY;
-                            if (!apiKey) {
-                                throw new Error("Invalid API Key provided! Please check the headers or environment variables");
-                            }
-                            logger.info(`🔒 MCP request authenticated with api key: ${apiKey}`);
-                            authStore.set(sessionId, {
-                                apiKey: apiKey,
-                                createdMs: Date.now(),
-                            });
-                        }
-                        else if (authScheme === AuthScheme.CHATBOT &&
-                            "x-auth-session" in req.headers &&
-                            "x-auth-chat" in req.headers) {
-                            logger.info(`🔒 MCP request authenticated with x-auth-session: ${req.headers["x-auth-session"]} and x-auth-chat: ${req.headers["x-auth-chat"]}`);
-                            // otherwise, store the sessionId and latestRecordUuid in authStore
-                            authStore.set(sessionId, {
-                                sessionId: req.headers["x-auth-session"],
-                                latestRecordUuid: req.headers["x-auth-chat"],
-                                createdMs: Date.now(),
-                            });
-                        }
-                        else if (authScheme === AuthScheme.WEB2 && "x-auth-cookie" in req.headers) {
-                            authStore.set(sessionId, {
-                                cookie: req.headers["x-auth-cookie"],
-                                sessionAlias: req.headers["x-auth-session-alias"],
-                                createdMs: Date.now(),
-                            });
-                        }
-                        else {
-                            throw new Error(`Invalid auth scheme provided! x-auth-scheme: ${req.headers["x-auth-scheme"]}, x-auth-session: ${req.headers["x-auth-session"]}, x-auth-chat: ${req.headers["x-auth-chat"]}`);
-                        }
-                    }
-                    catch (e) {
-                        // only throw if this is an auth required call
-                        if (authRequired.includes(req.body.method)) {
-                            if (e instanceof Error) {
-                                logger.error(e.message);
-                                res
-                                    .status(401)
-                                    .setHeader("WWW-Authenticate", `Bearer realm="${process.env.REALM}", error="invalid_token", error_description="The access token is missing or invalid"`)
-                                    .send(e.message);
-                                return;
-                            }
-                            else {
-                                logger.error(e);
-                                throw e;
-                            }
-                        }
-                    }
                 },
                 // DNS rebinding protection is disabled by default for backwards compatibility. If you are running this server
                 // locally, make sure to set:
@@ -122,12 +123,15 @@ export default function streamableHttpTransport() {
                 if (transport.sessionId) {
                     transports.delete(transport.sessionId);
                     authStore.delete(transport.sessionId);
+                    clearAccessibleAppsCache(transport.sessionId);
                 }
             };
-            const server = await createServer();
+            // newSessionId is already in authStore; createServer can resolve
+            // accessibleRhombusApps and pick the right tool set.
+            const server = await createServer({ sessionId: newSessionId });
             // Connect to the MCP server
             await server.connect(transport);
-            logger.info(`🔗 Transport connected with sessionId: ${sessionId}`);
+            logger.info(`🔗 Transport connected with sessionId: ${newSessionId}`);
         }
         else {
             // Invalid request

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",