vikunja-mcp-ng 0.4.0

package/dist/middleware/direct-middleware.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Direct Middleware Application
+ * Simplified middleware functions without wrapper-on-wrapper patterns
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyRateLimiting = applyRateLimiting;
+exports.applyPermissions = applyPermissions;
+exports.applyBothMiddleware = applyBothMiddleware;
+const permissions_1 = require("../auth/permissions");
+const errors_1 = require("../types/errors");
+const logger_1 = require("../utils/logger");
+const simplified_rate_limit_1 = require("./simplified-rate-limit");
+// Direct rate limiting application
+function applyRateLimiting(toolName, handler) {
+    return (0, simplified_rate_limit_1.withRateLimit)(toolName, handler);
+}
+// Direct permission checking application
+function applyPermissions(toolName, authManager, handler) {
+    return async (...args) => {
+        // Get current session (null if not authenticated)
+        const session = authManager.isAuthenticated() ? authManager.getSession() : null;
+        // Check permissions
+        const permissionResult = permissions_1.PermissionManager.checkToolPermission(session, toolName);
+        if (!permissionResult.hasPermission) {
+            logger_1.logger.debug(`Permission denied for tool ${toolName}:`, {
+                authType: session?.authType,
+                missingPermissions: permissionResult.missingPermissions,
+                suggestedAuthType: permissionResult.suggestedAuthType,
+            });
+            // Use appropriate error code based on the issue
+            const errorCode = session
+                ? errors_1.ErrorCode.PERMISSION_DENIED
+                : errors_1.ErrorCode.AUTH_REQUIRED;
+            throw new errors_1.MCPError(errorCode, permissionResult.errorMessage || 'Permission denied');
+        }
+        // Permission granted - execute the tool
+        logger_1.logger.debug(`Permission granted for tool ${toolName}`, {
+            authType: session?.authType,
+        });
+        return handler(...args);
+    };
+}
+// Combined middleware application for tools that need both
+function applyBothMiddleware(toolName, authManager, handler) {
+    const withPermissions = applyPermissions(toolName, authManager, handler);
+    return applyRateLimiting(toolName, withPermissions);
+}
+//# sourceMappingURL=direct-middleware.js.map

package/dist/middleware/direct-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"direct-middleware.js","sourceRoot":"","sources":["../../src/middleware/direct-middleware.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AASH,8CAKC;AAGD,4CAkCC;AAGD,kDAOC;AA1DD,qDAAwD;AACxD,4CAAsD;AACtD,4CAAyC;AACzC,mEAAwD;AAExD,mCAAmC;AACnC,SAAgB,iBAAiB,CAC/B,QAAgB,EAChB,OAAmC;IAEnC,OAAO,IAAA,qCAAa,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,yCAAyC;AACzC,SAAgB,gBAAgB,CAC9B,QAAgB,EAChB,WAAwB,EACxB,OAAmC;IAEnC,OAAO,KAAK,EAAE,GAAG,IAAO,EAAc,EAAE;QACtC,kDAAkD;QAClD,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAEhF,oBAAoB;QACpB,MAAM,gBAAgB,GAAG,+BAAiB,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAElF,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC;YACpC,eAAM,CAAC,KAAK,CAAC,8BAA8B,QAAQ,GAAG,EAAE;gBACtD,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;gBACvD,iBAAiB,EAAE,gBAAgB,CAAC,iBAAiB;aACtD,CAAC,CAAC;YAEH,gDAAgD;YAChD,MAAM,SAAS,GAAG,OAAO;gBACvB,CAAC,CAAC,kBAAS,CAAC,iBAAiB;gBAC7B,CAAC,CAAC,kBAAS,CAAC,aAAa,CAAC;YAE5B,MAAM,IAAI,iBAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAC;QACtF,CAAC;QAED,wCAAwC;QACxC,eAAM,CAAC,KAAK,CAAC,+BAA+B,QAAQ,EAAE,EAAE;YACtD,QAAQ,EAAE,OAAO,EAAE,QAAQ;SAC5B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAgB,mBAAmB,CACjC,QAAgB,EAChB,WAAwB,EACxB,OAAmC;IAEnC,MAAM,eAAe,GAAG,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IACzE,OAAO,iBAAiB,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Middleware Exports
+ * Simplified middleware exports without wrapper-on-wrapper patterns
+ */
+export { SimplifiedRateLimitMiddleware, simplifiedRateLimitMiddleware, withRateLimit, TOOL_CATEGORIES, type RateLimitConfig, type ToolRateLimits, } from './simplified-rate-limit';
+export { rateLimitingMiddleware, RateLimitingMiddleware, } from './simplified-rate-limit';
+export { applyRateLimiting, applyPermissions, applyBothMiddleware, } from './direct-middleware';
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,aAAa,EACb,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Middleware Exports
+ * Simplified middleware exports without wrapper-on-wrapper patterns
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.applyBothMiddleware = exports.applyPermissions = exports.applyRateLimiting = exports.RateLimitingMiddleware = exports.rateLimitingMiddleware = exports.TOOL_CATEGORIES = exports.withRateLimit = exports.simplifiedRateLimitMiddleware = exports.SimplifiedRateLimitMiddleware = void 0;
+var simplified_rate_limit_1 = require("./simplified-rate-limit");
+Object.defineProperty(exports, "SimplifiedRateLimitMiddleware", { enumerable: true, get: function () { return simplified_rate_limit_1.SimplifiedRateLimitMiddleware; } });
+Object.defineProperty(exports, "simplifiedRateLimitMiddleware", { enumerable: true, get: function () { return simplified_rate_limit_1.simplifiedRateLimitMiddleware; } });
+Object.defineProperty(exports, "withRateLimit", { enumerable: true, get: function () { return simplified_rate_limit_1.withRateLimit; } });
+Object.defineProperty(exports, "TOOL_CATEGORIES", { enumerable: true, get: function () { return simplified_rate_limit_1.TOOL_CATEGORIES; } });
+// Backward compatibility exports
+var simplified_rate_limit_2 = require("./simplified-rate-limit");
+Object.defineProperty(exports, "rateLimitingMiddleware", { enumerable: true, get: function () { return simplified_rate_limit_2.rateLimitingMiddleware; } });
+Object.defineProperty(exports, "RateLimitingMiddleware", { enumerable: true, get: function () { return simplified_rate_limit_2.RateLimitingMiddleware; } });
+var direct_middleware_1 = require("./direct-middleware");
+Object.defineProperty(exports, "applyRateLimiting", { enumerable: true, get: function () { return direct_middleware_1.applyRateLimiting; } });
+Object.defineProperty(exports, "applyPermissions", { enumerable: true, get: function () { return direct_middleware_1.applyPermissions; } });
+Object.defineProperty(exports, "applyBothMiddleware", { enumerable: true, get: function () { return direct_middleware_1.applyBothMiddleware; } });
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,iEAOiC;AAN/B,sIAAA,6BAA6B,OAAA;AAC7B,sIAAA,6BAA6B,OAAA;AAC7B,sHAAA,aAAa,OAAA;AACb,wHAAA,eAAe,OAAA;AAKjB,iCAAiC;AACjC,iEAGiC;AAF/B,+HAAA,sBAAsB,OAAA;AACtB,+HAAA,sBAAsB,OAAA;AAGxB,yDAI6B;AAH3B,sHAAA,iBAAiB,OAAA;AACjB,qHAAA,gBAAgB,OAAA;AAChB,wHAAA,mBAAmB,OAAA"}

package/dist/middleware/simplified-rate-limit.d.ts

@@ -0,0 +1,147 @@
+/**
+ * SECURE Rate Limiting Middleware - Production Grade Implementation
+ *
+ * SECURITY FIXES IMPLEMENTED:
+ * ✅ ARCH-001: Eliminated dual source of truth race conditions
+ * ✅ ARCH-002: Fixed unbounded memory leak with TTL-based cleanup
+ * ✅ ARCH-004: Consistent session state management with single source of truth
+ * ✅ ARCH-005: Added circuit breaker for rate limiting failures
+ * ✅ Concurrent access protection with mutex-based critical sections
+ * ✅ Production-grade reliability with 99.9% SLA design
+ */
+/**
+ * Enhanced rate limit configuration with security options
+ */
+interface RateLimitConfig {
+    /** Requests per minute limit */
+    requestsPerMinute: number;
+    /** Requests per hour limit */
+    requestsPerHour: number;
+    /** Maximum request payload size in bytes */
+    maxRequestSize: number;
+    /** Maximum response size in bytes */
+    maxResponseSize: number;
+    /** Tool execution timeout in milliseconds */
+    executionTimeout: number;
+    /** Enable rate limiting (for testing) */
+    enabled: boolean;
+}
+/**
+ * Tool-specific rate limiting configurations
+ */
+interface ToolRateLimits {
+    default: RateLimitConfig;
+    expensive: RateLimitConfig;
+    bulk: RateLimitConfig;
+    export: RateLimitConfig;
+}
+/**
+ * Tool categorization for rate limiting (preserved from original implementation)
+ */
+export declare const TOOL_CATEGORIES: Record<string, keyof ToolRateLimits>;
+/**
+ * SECURE: Production-grade rate limiting middleware
+ *
+ * SECURITY IMPROVEMENTS:
+ * - Single source of truth: MemoryStore only (eliminates ARCH-001)
+ * - Bounded memory: TTL-based cleanup (eliminates ARCH-002)
+ * - Concurrent access protection: Mutex-based critical sections
+ * - Circuit breaker: Fail-safe operation (eliminates ARCH-005)
+ * - Consistent state: No dual sources (eliminates ARCH-004)
+ */
+export declare class SecureRateLimitMiddleware {
+    private config;
+    private minuteStore;
+    private hourStore;
+    private rateLimitMutex;
+    private minuteStoreBreaker;
+    private hourStoreBreaker;
+    constructor(config?: Partial<ToolRateLimits>, testingMode?: boolean);
+    /**
+     * SECURE: Check rate limits using MemoryStore as single source of truth
+     *
+     * SECURITY IMPROVEMENTS:
+     * - Eliminated dual source of truth race conditions (ARCH-001)
+     * - Uses MemoryStore for all operations (single source of truth)
+     * - Concurrent access protection with mutex
+     * - Circuit breaker protection for MemoryStore failures
+     */
+    private checkRateLimit;
+    /**
+     * SECURITY: Get current count from MemoryStore with proper error handling
+     */
+    private getCurrentCount;
+    /**
+     * Validate request size (preserved from original implementation)
+     */
+    private validateRequestSize;
+    /**
+     * Validate response size (preserved from original implementation)
+     */
+    private validateResponseSize;
+    /**
+     * SECURE: Wrap tool handler with rate limiting using single source of truth
+     */
+    withRateLimit<T extends unknown[], R>(toolName: string, handler: (...args: T) => Promise<R>): (...args: T) => Promise<R>;
+    /**
+     * Get configuration (preserved from original implementation)
+     */
+    getConfig(): ToolRateLimits;
+    /**
+     * TESTING COMPATIBILITY: Get rate limit status (sync for test compatibility)
+     *
+     * NOTE: This is a compatibility method for existing tests.
+     * The secure async version is getRateLimitStatusAsync().
+     */
+    getRateLimitStatus(_toolName?: string): {
+        sessionId: string;
+        requestsLastMinute: number;
+        requestsLastHour: number;
+        limits: ToolRateLimits;
+        circuitBreakerStatus: {
+            minuteStore: 'open' | 'half-open' | 'closed';
+            hourStore: 'open' | 'half-open' | 'closed';
+        };
+    };
+    /**
+     * SECURE: Get current rate limit status from MemoryStore (single source of truth)
+     */
+    getRateLimitStatusAsync(_toolName?: string): Promise<{
+        sessionId: string;
+        requestsLastMinute: number;
+        requestsLastHour: number;
+        limits: ToolRateLimits;
+        circuitBreakerStatus: {
+            minuteStore: 'open' | 'half-open' | 'closed';
+            hourStore: 'open' | 'half-open' | 'closed';
+        };
+    }>;
+    /**
+     * SECURE: Clear session data with proper cleanup
+     */
+    clearSession(_sessionId?: string): Promise<void>;
+    /**
+     * TESTING COMPATIBILITY: Clear all rate limit data (for testing)
+     */
+    clearAll(): Promise<void>;
+    /**
+     * TESTING COMPATIBILITY: Simulate time passing for tests
+     *
+     * SECURITY NOTE: This is only available in testing mode and simply clears the stores.
+     * This is MUCH more secure than the original implementation which compromised
+     * production security by using dual source of truth for test convenience.
+     */
+    testingSimulateTimePassing(): Promise<void>;
+}
+export declare const secureRateLimitMiddleware: SecureRateLimitMiddleware;
+export declare const simplifiedRateLimitMiddleware: SecureRateLimitMiddleware;
+export declare const rateLimitingMiddleware: SecureRateLimitMiddleware;
+export declare const RateLimitingMiddleware: typeof SecureRateLimitMiddleware;
+export declare const SimplifiedRateLimitMiddleware: typeof SecureRateLimitMiddleware;
+/**
+ * Convenience function to wrap tool handlers with rate limiting
+ * This replaces the original withRateLimit function
+ */
+export declare function withRateLimit<T extends unknown[], R>(toolName: string, handler: (...args: T) => Promise<R>): (...args: T) => Promise<R>;
+export type { RateLimitConfig, ToolRateLimits };
+//# sourceMappingURL=simplified-rate-limit.d.ts.map

package/dist/middleware/simplified-rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simplified-rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/simplified-rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH;;GAEG;AACH,UAAU,eAAe;IACvB,gCAAgC;IAChC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8BAA8B;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,eAAe,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,yCAAyC;IACzC,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;GAEG;AACH,UAAU,cAAc;IACtB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,eAAe,CAAC;CACzB;AAoDD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,cAAc,CAchE,CAAC;AASF;;;;;;;;;GASG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,SAAS,CAAc;IAG/B,OAAO,CAAC,cAAc,CAAe;IAGrC,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,gBAAgB,CAAqB;gBAEjC,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,WAAW,UAAQ;IAoEjE;;;;;;;;OAQG;YACW,cAAc;IA6G5B;;OAEG;YACW,eAAe;IAkB7B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA0B5B;;OAEG;IACI,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,EACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAClC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAsE7B;;OAEG;IACI,SAAS,IAAI,cAAc;IAIlC;;;;;OAKG;IACI,kBAAkB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG;QAC7C,SAAS,EAAE,MAAM,CAAC;QAClB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,cAAc,CAAC;QACvB,oBAAoB,EAAE;YACpB,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;YAC7C,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;SAC5C,CAAC;KACH;IAiBD;;OAEG;IACU,uBAAuB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAChE,SAAS,EAAE,MAAM,CAAC;QAClB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,MAAM,CAAC;QACzB,MAAM,EAAE,cAAc,CAAC;QACvB,oBAAoB,EAAE;YACpB,WAAW,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;YAC7C,SAAS,EAAE,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC;SAC5C,CAAC;KACH,CAAC;IA8CF;;OAEG;IACU,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB7D;;OAEG;IACU,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBtC;;;;;;OAMG;IACI,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC;CAInD;AAGD,eAAO,MAAM,yBAAyB,2BAAkC,CAAC;AAGzE,eAAO,MAAM,6BAA6B,2BAA4B,CAAC;AACvE,eAAO,MAAM,sBAAsB,2BAA4B,CAAC;AAChE,eAAO,MAAM,sBAAsB,kCAA4B,CAAC;AAGhE,eAAO,MAAM,6BAA6B,kCAA4B,CAAC;AAEvE;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,EAClD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAClC,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAE5B;AAGD,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}