cloud-bicep-mcp-server 0.3.0__py3-none-any.whl

auth.py

@@ -0,0 +1,69 @@
+"""Authentication middleware for the MCP server."""
+
+import logging
+
+from starlette.middleware.base import BaseHTTPMiddleware
+from starlette.responses import JSONResponse
+
+from config import settings
+
+logger = logging.getLogger(__name__)
+
+
+class APIKeyAuthMiddleware(BaseHTTPMiddleware):
+    """Middleware to validate API Key for caller authentication."""
+
+    async def dispatch(self, request, call_next):
+        """Validate API Key for caller authentication. Returns 401 if validation fails."""
+        logger.debug(f"Auth middleware: {request.method} {request.url.path}")
+        if request.method == "GET" and request.url.path in ("/health", "/mcp/icon.png"):
+            return await call_next(request)
+
+        api_key_header = request.headers.get("X-API-Key", "")
+
+        # Check if request is from loopback (localhost)
+        client_host = request.client.host if request.client else ""
+        is_loopback = client_host in ("127.0.0.1", "::1", "localhost")
+        logger.debug(f"Client: {client_host} (loopback: {is_loopback}), API key header present: {bool(api_key_header)}")
+
+        # If API Key is not configured, only allow loopback requests
+        if not settings.MCP_API_KEY:
+            if is_loopback:
+                logger.warning(
+                    "MCP_API_KEY not configured, allowing unauthenticated loopback access "
+                    "- configure MCP_API_KEY for production"
+                )
+            else:
+                logger.error("MCP_API_KEY not configured and request is not from loopback - rejecting")
+                return JSONResponse(
+                    {"error": "Server configuration error: MCP_API_KEY not configured"},
+                    status_code=500
+                )
+        else:
+            if not api_key_header:
+                logger.warning("API Key header missing")
+                return JSONResponse(
+                    {"error": "Missing X-API-Key header"},
+                    status_code=401
+                )
+
+            if api_key_header != settings.MCP_API_KEY:
+                logger.warning("Invalid API Key provided")
+                return JSONResponse(
+                    {"error": "Invalid API Key"},
+                    status_code=401
+                )
+
+            logger.info("API Key validated successfully")
+
+        # Require GITHUB_TOKEN for accessing the private GitHub repository
+        if not settings.GITHUB_TOKEN:
+            logger.error("GITHUB_TOKEN is not configured")
+            return JSONResponse(
+                {"error": "Server configuration error: GITHUB_TOKEN is required"},
+                status_code=500
+            )
+
+        response = await call_next(request)
+        logger.debug(f"Response status: {getattr(response, 'status_code', response)}")
+        return response

cache.py

@@ -0,0 +1,230 @@
+"""Cache backends for the Cloud Bicep Modules MCP Server."""
+
+import json
+import logging
+import tempfile
+import threading
+import time
+from abc import ABC, abstractmethod
+from pathlib import Path
+from typing import Dict, Optional
+
+from config import settings
+
+logger = logging.getLogger(__name__)
+
+
+class CacheBackend(ABC):
+    """Abstract base class for cache backends."""
+
+    @abstractmethod
+    def get(self, key: str) -> Optional[Dict[str, str]]:
+        """Get cached data by key.
+
+        Args:
+            key: Cache key
+
+        Returns:
+            Cached data dict with "version" and "content", or None if not found
+        """
+        pass
+
+    @abstractmethod
+    def set(self, key: str, version: str, content: str):
+        """Set cached data with version.
+
+        Args:
+            key: Cache key
+            version: Module version
+            content: Extracted markdown content
+        """
+        pass
+
+    @abstractmethod
+    def delete(self, key: str):
+        """Delete cached data by key.
+
+        Args:
+            key: Cache key
+        """
+        pass
+
+
+class DiskCacheBackend(CacheBackend):
+    """Disk-based cache backend."""
+
+    def __init__(self, cache_dir: Optional[str] = None, ttl_seconds: Optional[int] = None):
+        """Initialize disk cache backend.
+
+        Args:
+            cache_dir: Custom cache directory path. If None, uses system temp directory.
+            ttl_seconds: Time-to-live for cache entries in seconds. If None or <= 0, entries never expire.
+        """
+        self.ttl = ttl_seconds
+        if cache_dir:
+            self.cache_dir = Path(cache_dir)
+        else:
+            self.cache_dir = Path(tempfile.gettempdir()) / "bicep-modules-mcp-cache"
+
+        self.cache_dir.mkdir(parents=True, exist_ok=True)
+        logger.info(f"Disk cache initialized: {self.cache_dir}")
+
+    def _get_cache_file(self, key: str) -> Path:
+        """Get cache file path for a key.
+
+        Args:
+            key: Cache key
+
+        Returns:
+            Path to cache file
+        """
+        safe_name = key.replace("/", "_").replace("\\", "_")
+        return self.cache_dir / f"{safe_name}.json"
+
+    def get(self, key: str) -> Optional[Dict[str, str]]:
+        """Get cached data from disk."""
+        cache_file = self._get_cache_file(key)
+
+        if not cache_file.exists():
+            logger.debug(f"Disk cache file not found: {cache_file}")
+            return None
+
+        try:
+            with open(cache_file, "r", encoding="utf-8") as f:
+                data = json.load(f)
+
+            if self.ttl and self.ttl > 0 and time.time() - data.get("cached_at", 0) > self.ttl:
+                logger.debug(f"Disk cache EXPIRED: {key}")
+                self.delete(key)
+                return None
+
+            logger.debug(f"Disk cache HIT: {key}")
+            return data
+        except Exception as e:
+            logger.warning(f"Error loading disk cache: {str(e)}")
+            return None
+
+    def set(self, key: str, version: str, content: str):
+        """Set cached data to disk."""
+        cache_file = self._get_cache_file(key)
+
+        try:
+            data = {
+                "version": version,
+                "content": content,
+                "cached_at": time.time()
+            }
+
+            with open(cache_file, "w", encoding="utf-8") as f:
+                json.dump(data, f, indent=2)
+
+            logger.debug(f"Disk cache SET: {key}")
+        except Exception as e:
+            logger.error(f"Error saving disk cache: {str(e)}")
+
+    def delete(self, key: str):
+        """Delete cached data from disk."""
+        cache_file = self._get_cache_file(key)
+        try:
+            if cache_file.exists():
+                cache_file.unlink()
+                logger.debug(f"Disk cache DELETE: {key}")
+        except Exception as e:
+            logger.warning(f"Error deleting disk cache: {str(e)}")
+
+
+# Global cache backend instance
+_cache_backend: Optional[CacheBackend] = None
+_cache_lock = threading.Lock()
+
+
+def get_cache_backend() -> CacheBackend:
+    """Get the configured cache backend instance.
+
+    Returns:
+        CacheBackend instance (initialized on first call)
+    """
+    global _cache_backend
+
+    with _cache_lock:
+        if _cache_backend is None:
+            _cache_backend = DiskCacheBackend(settings.MCP_CACHE_DIR, settings.MCP_CACHE_TTL_SECONDS)
+
+    return _cache_backend
+
+
+def get_cached_module_content(module_path: str, current_version: str) -> Optional[str]:
+    """Get module content from cache if version matches.
+
+    Args:
+        module_path: Module path (e.g., "modules/keyvault")
+        current_version: Current version from version.json
+
+    Returns:
+        Cached content if version matches, None otherwise
+    """
+    cache = get_cache_backend()
+    cached_data = cache.get(module_path)
+
+    if cached_data and cached_data.get("version") == current_version:
+        logger.info(f"Cache HIT for {module_path} (version {current_version})")
+        return cached_data.get("content")
+    elif cached_data:
+        logger.info(f"Cache MISS for {module_path}: version changed from {cached_data['version']} to {current_version}")
+    else:
+        logger.debug(f"Cache MISS for {module_path}: not in cache")
+
+    return None
+
+
+def update_module_cache(module_path: str, version: str, content: str):
+    """Update cache with new module content.
+
+    Args:
+        module_path: Module path (e.g., "modules/keyvault")
+        version: Module version
+        content: Extracted markdown content
+    """
+    cache = get_cache_backend()
+    cache.set(module_path, version, content)
+    logger.info(f"Cache updated for {module_path} (version {version})")
+
+
+INVENTORY_CACHE_KEY = "modules-inventory"
+
+
+def get_cached_inventory(fingerprint: str) -> Optional[str]:
+    """Get the cached module inventory if the fingerprint matches.
+
+    The fingerprint is derived from the module directory listing (names and
+    tree SHAs). Any content change inside a module folder (including version
+    bumps) changes its tree SHA, so a matching fingerprint guarantees the
+    cached inventory is still current.
+
+    Args:
+        fingerprint: Fingerprint of the current module directory listing
+
+    Returns:
+        Cached inventory JSON if the fingerprint matches, None otherwise
+    """
+    cache = get_cache_backend()
+    cached_data = cache.get(INVENTORY_CACHE_KEY)
+
+    if cached_data and cached_data.get("version") == fingerprint:
+        logger.info(f"Inventory cache HIT (fingerprint {fingerprint[:12]}...)")
+        return cached_data.get("content")
+
+    logger.debug("Inventory cache MISS: fingerprint changed or not in cache")
+    return None
+
+
+def update_inventory_cache(fingerprint: str, inventory_json: str):
+    """Update the cached module inventory.
+
+    Args:
+        fingerprint: Fingerprint of the module directory listing
+        inventory_json: Serialized module inventory (JSON)
+    """
+    cache = get_cache_backend()
+    cache.set(INVENTORY_CACHE_KEY, fingerprint, inventory_json)
+    logger.info("Inventory cache updated")