tdoms-mcp 0.6.1

package/src/secret-store.js

@@ -0,0 +1,109 @@
+import crypto from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { atomicWriteFile, ensurePrivateDirectory, withFileLock } from "./storage-utils.js";
+
+const KEY_FILE = "local.key";
+const SECRET_FILE = "secrets.json";
+const ALGORITHM = "aes-256-gcm";
+
+export class SecretStore {
+  constructor(dir, { env = process.env } = {}) {
+    this.dir = dir;
+    this.env = env;
+    this.keyPath = path.join(dir, KEY_FILE);
+    this.secretPath = path.join(dir, SECRET_FILE);
+  }
+
+  async getSecret(name) {
+    const secrets = await this.#readSecrets();
+    const encrypted = secrets[name];
+    if (!encrypted) {
+      return undefined;
+    }
+
+    const key = await this.#getKey();
+    const iv = Buffer.from(encrypted.iv, "base64");
+    const tag = Buffer.from(encrypted.tag, "base64");
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(tag);
+    const decrypted = Buffer.concat([
+      decipher.update(Buffer.from(encrypted.ciphertext, "base64")),
+      decipher.final()
+    ]);
+    return decrypted.toString("utf8");
+  }
+
+  async setSecret(name, value) {
+    await withFileLock(this.secretPath, async () => {
+      const secrets = await this.#readSecrets();
+      const key = await this.#getKey();
+      const iv = crypto.randomBytes(12);
+      const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+      const ciphertext = Buffer.concat([cipher.update(String(value), "utf8"), cipher.final()]);
+      secrets[name] = {
+        iv: iv.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+        updatedAt: new Date().toISOString()
+      };
+      await this.#writeSecrets(secrets);
+    });
+  }
+
+  async deleteSecret(name) {
+    await withFileLock(this.secretPath, async () => {
+      const secrets = await this.#readSecrets();
+      delete secrets[name];
+      await this.#writeSecrets(secrets);
+    });
+  }
+
+  async #getKey() {
+    const configuredKey = parseMasterKey(this.env.TDOMS_MCP_MASTER_KEY);
+    if (configuredKey) return configuredKey;
+
+    await ensurePrivateDirectory(this.dir);
+    return withFileLock(this.keyPath, async () => {
+      try {
+        const stored = Buffer.from((await fs.readFile(this.keyPath, "utf8")).trim(), "base64");
+        return validateKey(stored, "local.key");
+      } catch (error) {
+        if (error.code !== "ENOENT") throw error;
+      }
+
+      const key = crypto.randomBytes(32);
+      await atomicWriteFile(this.keyPath, key.toString("base64"), { mode: 0o600 });
+      return key;
+    });
+  }
+
+  async #readSecrets() {
+    try {
+      return JSON.parse(await fs.readFile(this.secretPath, "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        return {};
+      }
+      throw error;
+    }
+  }
+
+  async #writeSecrets(secrets) {
+    await atomicWriteFile(this.secretPath, `${JSON.stringify(secrets, null, 2)}\n`, { mode: 0o600 });
+  }
+}
+
+export function parseMasterKey(value) {
+  if (!value) return undefined;
+  const normalized = String(value).trim();
+  const encoding = /^[a-f0-9]{64}$/i.test(normalized) ? "hex" : "base64";
+  return validateKey(Buffer.from(normalized, encoding), "TDOMS_MCP_MASTER_KEY");
+}
+
+function validateKey(key, source) {
+  if (key.length !== 32) {
+    throw new Error(`${source} must contain exactly 32 bytes encoded as base64 or 64 hexadecimal characters.`);
+  }
+  return key;
+}

package/src/storage-utils.js

@@ -0,0 +1,176 @@
+import crypto from "node:crypto";
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+export async function ensurePrivateDirectory(dir) {
+  await fs.mkdir(dir, { recursive: true, mode: 0o700 });
+  if (process.platform !== "win32") {
+    await fs.chmod(dir, 0o700);
+  }
+}
+
+export async function atomicWriteFile(filePath, data, { mode = 0o600 } = {}) {
+  const dir = path.dirname(filePath);
+  await ensurePrivateDirectory(dir);
+  const temporaryPath = path.join(dir, `.${path.basename(filePath)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  let handle;
+
+  try {
+    handle = await fs.open(temporaryPath, "wx", mode);
+    await handle.writeFile(data, "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = undefined;
+    await renameWithRetry(temporaryPath, filePath);
+    if (process.platform !== "win32") {
+      await fs.chmod(filePath, mode);
+    }
+    await syncDirectory(dir);
+  } finally {
+    await handle?.close().catch(() => {});
+    await fs.rm(temporaryPath, { force: true }).catch(() => {});
+  }
+}
+
+export async function withFileLock(filePath, operation, {
+  timeoutMs = 10000,
+  staleMs = 30000,
+  retryMs = 20
+} = {}) {
+  const lockPath = `${filePath}.lock`;
+  const token = `${process.pid}:${crypto.randomUUID()}`;
+  const startedAt = Date.now();
+  await ensurePrivateDirectory(path.dirname(filePath));
+
+  while (true) {
+    try {
+      const handle = await fs.open(lockPath, "wx", 0o600);
+      await handle.writeFile(token, "utf8");
+      await handle.close();
+      break;
+    } catch (error) {
+      const transientWindowsContention = process.platform === "win32" && ["EACCES", "EPERM"].includes(error.code);
+      if (error.code !== "EEXIST" && !transientWindowsContention) {
+        throw error;
+      }
+
+      if (error.code === "EEXIST") {
+        await removeStaleLock(lockPath, staleMs);
+      }
+      if (Date.now() - startedAt >= timeoutMs) {
+        throw new Error(`Timed out waiting for local storage lock: ${lockPath}`);
+      }
+      await delay(retryMs);
+    }
+  }
+
+  try {
+    return await operation();
+  } finally {
+    await releaseOwnedLock(lockPath, token);
+  }
+}
+
+export async function hardenDataDirectory(dir, { platform = process.platform } = {}) {
+  await ensurePrivateDirectory(dir);
+  if (platform !== "win32") {
+    await fs.chmod(dir, 0o700);
+    for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+      if (entry.isFile()) {
+        await fs.chmod(path.join(dir, entry.name), 0o600);
+      }
+    }
+    return { platform, directoryMode: "0700", fileMode: "0600" };
+  }
+
+  const script = String.raw`
+$target = $env:TDOMS_ACL_TARGET
+$acl = New-Object System.Security.AccessControl.DirectorySecurity
+$acl.SetAccessRuleProtection($true, $false)
+$inheritance = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+$propagation = [System.Security.AccessControl.PropagationFlags]::None
+$allow = [System.Security.AccessControl.AccessControlType]::Allow
+$sids = @(
+  [System.Security.Principal.WindowsIdentity]::GetCurrent().User,
+  (New-Object System.Security.Principal.SecurityIdentifier('S-1-5-18')),
+  (New-Object System.Security.Principal.SecurityIdentifier('S-1-5-32-544'))
+)
+foreach ($sid in $sids) {
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', $inheritance, $propagation, $allow)
+  $acl.AddAccessRule($rule)
+}
+[System.IO.Directory]::SetAccessControl($target, $acl)
+`;
+  await execFileAsync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+    windowsHide: true,
+    env: { ...process.env, TDOMS_ACL_TARGET: dir }
+  });
+  return { platform, acl: "current-user, SYSTEM, Administrators" };
+}
+
+async function removeStaleLock(lockPath, staleMs) {
+  try {
+    const stat = await fs.stat(lockPath);
+    if (Date.now() - stat.mtimeMs > staleMs) {
+      await fs.unlink(lockPath).catch((error) => {
+        if (error.code !== "ENOENT") throw error;
+      });
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT" && !isTransientWindowsError(error)) {
+      throw error;
+    }
+  }
+}
+
+async function releaseOwnedLock(lockPath, token) {
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    try {
+      if ((await fs.readFile(lockPath, "utf8")) === token) {
+        await fs.unlink(lockPath);
+      }
+      return;
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      if (!isTransientWindowsError(error) || attempt === 19) throw error;
+      await delay(10 + attempt * 5);
+    }
+  }
+}
+
+function isTransientWindowsError(error) {
+  return process.platform === "win32" && ["EACCES", "EBUSY", "EPERM"].includes(error.code);
+}
+
+async function renameWithRetry(source, target) {
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    try {
+      await fs.rename(source, target);
+      return;
+    } catch (error) {
+      if (!isTransientWindowsError(error) || attempt === 19) throw error;
+      await delay(10 + attempt * 5);
+    }
+  }
+}
+
+async function syncDirectory(dir) {
+  if (process.platform === "win32") return;
+  let handle;
+  try {
+    handle = await fs.open(dir, "r");
+    await handle.sync();
+  } catch {
+    // Some filesystems do not support syncing directory handles.
+  } finally {
+    await handle?.close().catch(() => {});
+  }
+}
+
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/src/tdoms-client.js

@@ -0,0 +1,172 @@
+import fs from "node:fs/promises";
+import http from "node:http";
+import https from "node:https";
+import nodePath from "node:path";
+import tls from "node:tls";
+import { normalizeBaseUrl } from "./config.js";
+
+export class TdomsClient {
+  constructor(connection, {
+    httpRequest = http.request,
+    httpsRequest = https.request,
+    readFile = fs.readFile,
+    env = process.env
+  } = {}) {
+    this.connection = connection;
+    this.baseUrl = normalizeBaseUrl(connection);
+    this.httpRequest = httpRequest;
+    this.httpsRequest = httpsRequest;
+    this.readFile = readFile;
+    this.env = env;
+  }
+
+  async login(password = this.connection.password) {
+    if (!this.connection.username) {
+      throw new Error("TD/OMS username is required.");
+    }
+
+    if (password === undefined) {
+      throw new Error("TD/OMS password is required for login.");
+    }
+
+    const response = await this.request("OMGAUTH", "/login", {
+      method: "POST",
+      body: {
+        email_or_username: this.connection.username,
+        password
+      },
+      token: this.connection.token
+    });
+
+    if (!response?.token) {
+      throw new Error("TD/OMS login response did not include a token.");
+    }
+
+    return response.token;
+  }
+
+  async getSystemInfo(token = this.connection.token, applications) {
+    const suffix = applications ? `/system?applications=${encodeURIComponent(applications)}` : "/system";
+    return this.request("OMSINFO", suffix, {
+      method: "GET",
+      token
+    });
+  }
+
+  async getLicenseInfo() {
+    return this.request("OMSINFO", "/license", {
+      method: "GET"
+    });
+  }
+
+  async get(service, path, token = this.connection.token) {
+    return this.request(service, path, {
+      method: "GET",
+      token
+    });
+  }
+
+  async post(service, path, body, token = this.connection.token) {
+    return this.request(service, path, {
+      method: "POST",
+      body,
+      token
+    });
+  }
+
+  async request(service, path, { method = "GET", body, token } = {}) {
+    const url = new URL(`${this.baseUrl}/${service}${path}`);
+    const payload = body === undefined ? undefined : JSON.stringify(body);
+    const headers = {
+      accept: "application/json"
+    };
+
+    if (payload !== undefined) {
+      headers["content-type"] = "application/json";
+      headers["content-length"] = Buffer.byteLength(payload);
+    }
+
+    if (token) {
+      headers.authorization = `Bearer ${token}`;
+    }
+
+    const options = {
+      method,
+      headers
+    };
+
+    if (url.protocol === "https:") {
+      options.rejectUnauthorized = this.connection.verifyTls !== false;
+      const caFile = this.connection.caFile || this.env.TDOMS_MCP_CA_FILE;
+      if (caFile) {
+        const customCa = await this.readFile(nodePath.resolve(caFile), "utf8");
+        options.ca = [...tls.rootCertificates, customCa];
+      }
+    }
+
+    const response = await sendRequest(
+      url.protocol === "https:" ? this.httpsRequest : this.httpRequest,
+      url,
+      options,
+      payload,
+      Number.parseInt(this.env.TDOMS_MCP_HTTP_TIMEOUT_MS || "60000", 10)
+    );
+    const text = response.text;
+    const parsed = text ? parseJsonResponse(text) : undefined;
+
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      const detail = typeof parsed === "object" ? JSON.stringify(parsed) : text;
+      throw new Error(`TD/OMS ${method} ${url.pathname} failed with ${response.statusCode}: ${detail}`);
+    }
+
+    return parsed;
+  }
+}
+
+function sendRequest(request, url, options, payload, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const req = request(url, options, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+      response.on("end", () => resolve({
+        statusCode: response.statusCode || 0,
+        text: Buffer.concat(chunks).toString("utf8")
+      }));
+      response.on("error", reject);
+    });
+    req.on("error", reject);
+    req.setTimeout(timeoutMs, () => req.destroy(new Error(`TD/OMS request timed out after ${timeoutMs}ms.`)));
+    if (payload !== undefined) req.write(payload);
+    req.end();
+  });
+}
+
+function parseJsonResponse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
+export function summarizeSystemInfo(systemInfo) {
+  const applications = Array.isArray(systemInfo?.applications) ? systemInfo.applications : [];
+  return {
+    isOMSManager: Boolean(systemInfo?.isOMSManager),
+    isSecurityManager: Boolean(systemInfo?.isSecurityManager),
+    isExitManager: Boolean(systemInfo?.isExitManager),
+    applicationCount: applications.length,
+    applications: applications.map((application) => ({
+      applicationCode: application.applicationCode,
+      applicationName: application.applicationName,
+      canCreateTasks: application.canCreateTasks,
+      canCreateRequests: application.canCreateRequests,
+      isUser: application.isUser,
+      isProgrammer: application.isProgrammer,
+      isManager: application.isManager,
+      developmentEnvironment: application.developmentEnvironment,
+      productionEnvironment: application.productionEnvironment,
+      emergencyEnvironment: application.emergencyEnvironment
+    }))
+  };
+}