embed-client-dev 4.0.78__py3-none-any.whl

embed_client/config_generator_cli.py

@@ -0,0 +1,151 @@
+"""
+CLI entry point for the embed-client configuration generator.
+
+This module provides the command-line interface for generating configuration
+files for all supported security modes using `ClientConfigGenerator`.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+
+from embed_client.config_generator import ClientConfigGenerator
+
+
+def main() -> None:
+    """CLI entry point for the configuration generator."""
+    parser = argparse.ArgumentParser(description="Generate embed-client configurations")
+    parser.add_argument(
+        "--mode",
+        choices=[
+            "http",
+            "http_token",
+            "http_token_roles",
+            "https",
+            "https_token",
+            "https_token_roles",
+            "mtls",
+            "mtls_roles",
+            "all",
+        ],
+        default="all",
+        help="Security mode to generate",
+    )
+    parser.add_argument("--host", default="localhost", help="Server host")
+    parser.add_argument("--port", type=int, default=8001, help="Server port")
+    parser.add_argument("--output", help="Output file path (for single mode)")
+    parser.add_argument(
+        "--output-dir", default="./configs", help="Output directory (for all modes)"
+    )
+    parser.add_argument("--cert-file", help="Client certificate file (for HTTPS/mTLS)")
+    parser.add_argument("--key-file", help="Client key file (for HTTPS/mTLS)")
+    parser.add_argument("--ca-cert-file", help="CA certificate file (for HTTPS/mTLS)")
+    parser.add_argument(
+        "--crl-file", help="CRL (Certificate Revocation List) file (optional)"
+    )
+    parser.add_argument("--api-key", help="API key for token modes")
+    parser.add_argument(
+        "--token", help="Authentication token (alternative to --api-key)"
+    )
+
+    args = parser.parse_args()
+
+    generator = ClientConfigGenerator()
+    output_dir = Path(args.output_dir) if args.output_dir else None
+
+    if args.mode == "all":
+        if output_dir:
+            output_dir.mkdir(parents=True, exist_ok=True)
+        configs = generator.generate_all_configs(
+            host=args.host,
+            port=args.port,
+            output_dir=output_dir,
+            cert_file=args.cert_file,
+            key_file=args.key_file,
+            ca_cert_file=args.ca_cert_file,
+            crl_file=getattr(args, "crl_file", None),
+            token=getattr(args, "token", None),
+        )
+        print(f"✅ Generated {len(configs)} configurations in {output_dir}")
+    else:
+        output_path = Path(args.output) if args.output else output_dir / f"{args.mode}.json"  # type: ignore[operator]
+        if output_path:
+            output_path.parent.mkdir(parents=True, exist_ok=True)
+
+        # Common parameters for all modes
+        common_params = {
+            "host": args.host,
+            "port": args.port,
+            "token": getattr(args, "token", None),
+            "crl_file": getattr(args, "crl_file", None),
+        }
+
+        if args.mode == "http":
+            generator.generate_http_config(
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "http_token":
+            generator.generate_http_token_config(
+                api_key=args.api_key,
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "http_token_roles":
+            generator.generate_http_token_roles_config(
+                api_key=args.api_key,
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "https":
+            generator.generate_https_config(
+                cert_file=args.cert_file,
+                key_file=args.key_file,
+                ca_cert_file=args.ca_cert_file,
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "https_token":
+            generator.generate_https_token_config(
+                api_key=args.api_key,
+                cert_file=args.cert_file,
+                key_file=args.key_file,
+                ca_cert_file=args.ca_cert_file,
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "https_token_roles":
+            generator.generate_https_token_roles_config(
+                api_key=args.api_key,
+                cert_file=args.cert_file,
+                key_file=args.key_file,
+                ca_cert_file=args.ca_cert_file,
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "mtls":
+            generator.generate_mtls_config(
+                cert_file=args.cert_file,
+                key_file=args.key_file,
+                ca_cert_file=args.ca_cert_file,
+                output_path=output_path,
+                **common_params,
+            )
+        elif args.mode == "mtls_roles":
+            generator.generate_mtls_roles_config(
+                cert_file=args.cert_file,
+                key_file=args.key_file,
+                ca_cert_file=args.ca_cert_file,
+                output_path=output_path,
+                **common_params,
+            )
+
+        print(f"✅ Generated {args.mode} configuration: {output_path}")
+
+
+if __name__ == "__main__":
+    main()

embed_client/config_presets.py

@@ -0,0 +1,245 @@
+"""
+Helper functions and presets for ClientConfig.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from __future__ import annotations
+
+import os
+from typing import TYPE_CHECKING, Any, Dict, List, Optional, Type
+
+if TYPE_CHECKING:
+    from embed_client.config import ClientConfig
+
+
+def convert_env_value(value: str) -> Any:
+    """Convert environment variable value to appropriate Python type."""
+    lowered = value.lower()
+    if lowered == "true":
+        return True
+    if lowered == "false":
+        return False
+    if value.isdigit():
+        return int(value)
+    try:
+        return float(value)
+    except ValueError:
+        return value
+
+
+def load_env_variables(
+    config_data: Dict[str, Any],
+    prefix: str = "EMBED_CLIENT_",
+) -> None:
+    """Load configuration overrides from environment variables into config_data."""
+    for key, value in os.environ.items():
+        if not key.startswith(prefix):
+            continue
+        parts = key[len(prefix) :].lower().split("_", 1)
+        if len(parts) != 2:
+            continue
+        section, param = parts
+        if section not in config_data or not isinstance(config_data[section], dict):
+            config_data[section] = {}
+        section_dict = config_data[section]
+        section_dict[param] = convert_env_value(value)
+
+
+def validate_client_config(config: "ClientConfig") -> List[str]:
+    """Validate configuration and return list of human-readable error messages."""
+    errors: List[str] = []
+
+    # Validate server configuration
+    host = config.get("server.host")
+    port = config.get("server.port")
+    if not host:
+        errors.append("Server host is required")
+    if not port or not isinstance(port, int) or port <= 0:
+        errors.append("Server port must be a positive integer")
+
+    # Validate authentication configuration
+    auth_method = config.get("auth.method", "none")
+    if auth_method == "api_key":
+        if not config.get("auth.api_key.key"):
+            errors.append("API key is required for api_key authentication")
+    elif auth_method == "jwt":
+        if not all(
+            [
+                config.get("auth.jwt.username"),
+                config.get("auth.jwt.password"),
+                config.get("auth.jwt.secret"),
+            ]
+        ):
+            errors.append(
+                "Username, password, and secret are required for JWT authentication"
+            )
+    elif auth_method == "certificate":
+        if not all(
+            [
+                config.get("auth.certificate.cert_file"),
+                config.get("auth.certificate.key_file"),
+            ]
+        ):
+            errors.append(
+                "Certificate and key files are required for certificate authentication"
+            )
+    elif auth_method == "basic":
+        if not all(
+            [config.get("auth.basic.username"), config.get("auth.basic.password")]
+        ):
+            errors.append("Username and password are required for basic authentication")
+
+    # Validate SSL configuration
+    if config.get("ssl.enabled", False):
+        cert_file = config.get("ssl.cert_file")
+        key_file = config.get("ssl.key_file")
+        ca_cert_file = config.get("ssl.ca_cert_file")
+
+        if cert_file and not os.path.exists(cert_file):
+            errors.append(f"SSL certificate file not found: {cert_file}")
+        if key_file and not os.path.exists(key_file):
+            errors.append(f"SSL key file not found: {key_file}")
+        if ca_cert_file and not os.path.exists(ca_cert_file):
+            errors.append(f"SSL CA certificate file not found: {ca_cert_file}")
+
+    return errors
+
+
+def create_minimal_config_dict(config: "ClientConfig") -> Dict[str, Any]:
+    """Create minimal configuration dictionary with only essential features."""
+    minimal_config = config.get_all()
+
+    # Disable all optional features
+    minimal_config["ssl"]["enabled"] = False
+    minimal_config["security"]["enabled"] = False
+    minimal_config["auth"]["method"] = "none"
+    minimal_config["logging"]["enabled"] = False
+
+    return minimal_config
+
+
+def create_secure_config_dict(config: "ClientConfig") -> Dict[str, Any]:
+    """Create secure configuration dictionary with all security features enabled."""
+    secure_config = config.get_all()
+
+    # Enable all security features
+    secure_config["ssl"]["enabled"] = True
+    secure_config["security"]["enabled"] = True
+    secure_config["auth"]["method"] = "certificate"
+    secure_config["ssl"]["verify"] = True
+    secure_config["ssl"]["check_hostname"] = True
+    secure_config["ssl"]["client_cert_required"] = True
+
+    return secure_config
+
+
+def create_http_config_for_class(
+    config_cls: Type["ClientConfig"],
+    host: str = "localhost",
+    port: int = 8001,
+) -> "ClientConfig":
+    """Factory helper for HTTP config without authentication."""
+    config = config_cls()
+    config.configure_server(host, port)
+    config.configure_auth_mode("none")
+    config.configure_ssl(False)
+    return config
+
+
+def create_http_token_config_for_class(
+    config_cls: Type["ClientConfig"],
+    host: str = "localhost",
+    port: int = 8001,
+    api_key: Optional[str] = None,
+) -> "ClientConfig":
+    """Factory helper for HTTP config with API key authentication."""
+    config = config_cls()
+    config.configure_server(host, port)
+    config.configure_auth_mode("api_key", key=api_key)
+    config.configure_ssl(False)
+    return config
+
+
+def create_https_config_for_class(
+    config_cls: Type["ClientConfig"],
+    host: str = "localhost",
+    port: int = 8443,
+    cert_file: Optional[str] = None,
+    key_file: Optional[str] = None,
+    ca_cert_file: Optional[str] = None,
+) -> "ClientConfig":
+    """Factory helper for HTTPS config without authentication."""
+    config = config_cls()
+    config.configure_ssl(
+        True,
+        cert_file=cert_file,
+        key_file=key_file,
+        ca_cert_file=ca_cert_file,
+    )
+    config.configure_server(host, port)
+    config.configure_auth_mode("none")
+    return config
+
+
+def create_https_token_config_for_class(
+    config_cls: Type["ClientConfig"],
+    host: str = "localhost",
+    port: int = 8443,
+    api_key: Optional[str] = None,
+    cert_file: Optional[str] = None,
+    key_file: Optional[str] = None,
+    ca_cert_file: Optional[str] = None,
+) -> "ClientConfig":
+    """Factory helper for HTTPS config with API key authentication."""
+    config = config_cls()
+    config.configure_ssl(
+        True,
+        cert_file=cert_file,
+        key_file=key_file,
+        ca_cert_file=ca_cert_file,
+    )
+    config.configure_server(host, port)
+    config.configure_auth_mode("api_key", key=api_key)
+    return config
+
+
+def create_mtls_config_for_class(
+    config_cls: Type["ClientConfig"],
+    host: str = "localhost",
+    port: int = 8443,
+    cert_file: Optional[str] = None,
+    key_file: Optional[str] = None,
+    ca_cert_file: Optional[str] = None,
+) -> "ClientConfig":
+    """Factory helper for mTLS config with client certificates."""
+    config = config_cls()
+    config.configure_ssl(
+        True,
+        cert_file=cert_file,
+        key_file=key_file,
+        ca_cert_file=ca_cert_file,
+        client_cert_required=True,
+    )
+    config.configure_server(host, port)
+    config.configure_auth_mode(
+        "certificate",
+        cert_file=cert_file,
+        key_file=key_file,
+        ca_cert_file=ca_cert_file,
+    )
+    return config
+
+
+__all__ = [
+    "load_env_variables",
+    "validate_client_config",
+    "create_minimal_config_dict",
+    "create_secure_config_dict",
+    "create_http_config_for_class",
+    "create_http_token_config_for_class",
+    "create_https_config_for_class",
+    "create_https_token_config_for_class",
+    "create_mtls_config_for_class",
+]

embed_client/config_validator.py

@@ -0,0 +1,246 @@
+"""
+Configuration Validator for embed-client.
+
+Uses mcp_proxy_adapter.core.validation.config_validator.ConfigValidator as base.
+Normalizes client config to adapter format, runs adapter validation, maps errors
+back to embed-client section/key names. Keeps legacy ClientConfig checks for compatibility.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from embed_client.config import ClientConfig
+from embed_client.config_presets import validate_client_config
+from embed_client.adapter_config_normalizer import (
+    client_to_adapter_format,
+    map_adapter_errors_to_client,
+)
+
+try:
+    from mcp_proxy_adapter.core.validation.config_validator import (  # type: ignore[import-untyped]
+        ConfigValidator as AdapterConfigValidator,
+    )
+
+    _ADAPTER_AVAILABLE = True
+except ImportError:
+    _ADAPTER_AVAILABLE = False
+    AdapterConfigValidator = None  # type: ignore[misc, assignment]
+
+
+class ConfigValidator:
+    """
+    Validator for embed-client configuration files.
+
+    Uses adapter ConfigValidator as base: normalizes client config to adapter
+    format, runs adapter validation, maps errors to embed-client names.
+    """
+
+    def __init__(self) -> None:
+        """Initialize configuration validator."""
+        pass
+
+    def _validate_via_adapter(
+        self, config_data: Dict[str, Any], config_path: Optional[Path] = None
+    ) -> List[str]:
+        """Run adapter ConfigValidator on normalized config; return list of error strings."""
+        if not _ADAPTER_AVAILABLE or AdapterConfigValidator is None:
+            return []
+        normalized = client_to_adapter_format(
+            config_data, config_path=str(config_path) if config_path else None
+        )
+        validator = AdapterConfigValidator(
+            config_path=str(config_path) if config_path else None
+        )
+        results = validator.validate_config(normalized)
+        errors = map_adapter_errors_to_client(
+            [r for r in results if getattr(r, "level", "") == "error"]
+        )
+        return errors
+
+    def validate_json_structure(
+        self,
+        config_data: Dict[str, Any],
+        config_path: Optional[Path] = None,
+    ) -> Tuple[bool, List[str]]:
+        """
+        Validate JSON structure and required fields.
+
+        Uses adapter ConfigValidator as base (normalize -> validate -> map errors).
+        Then runs legacy ClientConfig validation for embed-client specific checks.
+        config_path: optional path to config file (for resolving relative cert paths).
+        """
+        errors: List[str] = []
+
+        # Base validation via adapter
+        adapter_errors = self._validate_via_adapter(config_data, config_path)
+        errors.extend(adapter_errors)
+
+        # Legacy checks for sections adapter may not require
+        if "server" not in config_data:
+            errors.append("Missing required section: server")
+        else:
+            server = config_data["server"]
+            if "host" not in server:
+                errors.append("server.host is required")
+            if "port" not in server:
+                errors.append("server.port is required")
+            elif not isinstance(server["port"], int) or server["port"] <= 0:
+                errors.append("server.port must be a positive integer")
+
+        protocol = config_data.get(
+            "protocol", config_data.get("server", {}).get("protocol", "http")
+        )
+        if protocol not in ("http", "https", "mtls"):
+            errors.append(
+                f"Invalid protocol: {protocol}. Must be 'http', 'https', or 'mtls'"
+            )
+
+        if "auth" in config_data:
+            auth = config_data["auth"]
+            auth_method = auth.get("method", "none")
+            if auth_method == "api_key":
+                if "api_key" not in auth or "key" not in auth["api_key"]:
+                    errors.append(
+                        "auth.api_key.key is required for api_key authentication"
+                    )
+            elif auth_method == "jwt":
+                jwt = auth.get("jwt", {})
+                if not all(key in jwt for key in ["username", "password", "secret"]):
+                    errors.append(
+                        "auth.jwt.username, auth.jwt.password, and auth.jwt.secret "
+                        "are required for JWT authentication"
+                    )
+            elif auth_method == "certificate":
+                cert = auth.get("certificate", {})
+                if not all(key in cert for key in ["cert_file", "key_file"]):
+                    errors.append(
+                        "auth.certificate.cert_file and auth.certificate.key_file "
+                        "are required for certificate authentication"
+                    )
+            elif auth_method == "basic":
+                basic = auth.get("basic", {})
+                if not all(key in basic for key in ["username", "password"]):
+                    errors.append(
+                        "auth.basic.username and auth.basic.password "
+                        "are required for basic authentication"
+                    )
+
+        return len(errors) == 0, errors
+
+    def validate_config_file(self, config_path: Path) -> Tuple[bool, str, List[str]]:
+        """
+        Validate a single configuration file.
+
+        Args:
+            config_path: Path to configuration file
+
+        Returns:
+            Tuple of (is_valid, status_message, list_of_errors)
+        """
+        try:
+            if not config_path.exists():
+                return False, "File not found", []
+
+            with open(config_path, "r", encoding="utf-8") as f:
+                config_data = json.load(f)
+
+            # Validate JSON structure (pass path for relative cert resolution)
+            is_valid, errors = self.validate_json_structure(config_data, config_path)
+
+            if not is_valid:
+                return False, f"{len(errors)} error(s) in structure", errors
+
+            # Validate using ClientConfig validator
+            try:
+                client_config = ClientConfig(str(config_path))
+                config_errors = validate_client_config(client_config)
+
+                if config_errors:
+                    errors.extend(config_errors)
+                    return False, f"{len(errors)} error(s) found", errors
+
+                return True, "OK", []
+            except Exception as e:
+                errors.append(f"Error loading config: {str(e)}")
+                return False, f"Config loading failed: {str(e)}", errors
+
+        except json.JSONDecodeError as e:
+            return False, f"JSON decode error: {str(e)}", []
+        except Exception as e:
+            return False, f"Unexpected error: {str(e)}", []
+
+    def validate_config_dict(
+        self, config_data: Dict[str, Any]
+    ) -> Tuple[bool, List[str]]:
+        """
+        Validate configuration dictionary.
+
+        Args:
+            config_data: Configuration dictionary
+
+        Returns:
+            Tuple of (is_valid, list_of_errors)
+        """
+        # Validate JSON structure (no path for dict)
+        is_valid, errors = self.validate_json_structure(config_data, None)
+
+        if not is_valid:
+            return False, errors
+
+        # Create temporary ClientConfig to validate
+        try:
+            # Create a temporary config file
+            import tempfile
+
+            with tempfile.NamedTemporaryFile(
+                mode="w", suffix=".json", delete=False
+            ) as f:
+                json.dump(config_data, f, indent=2)
+                temp_path = f.name
+
+            try:
+                client_config = ClientConfig(temp_path)
+                config_errors = validate_client_config(client_config)
+                if config_errors:
+                    errors.extend(config_errors)
+                    return False, errors
+                return True, []
+            finally:
+                os.unlink(temp_path)
+        except Exception as e:
+            errors.append(f"Error validating config: {str(e)}")
+            return False, errors
+
+    def validate_config_directory(
+        self, config_dir: Path
+    ) -> Dict[str, Tuple[bool, str, List[str]]]:
+        """
+        Validate all configuration files in a directory.
+
+        Args:
+            config_dir: Directory containing configuration files
+
+        Returns:
+            Dictionary mapping file names to (is_valid, status_message, list_of_errors)
+        """
+        results: Dict[str, Tuple[bool, str, List[str]]] = {}
+
+        if not config_dir.exists():
+            return results
+
+        config_files = list(config_dir.glob("*.json"))
+
+        for config_file in sorted(config_files):
+            results[config_file.name] = self.validate_config_file(config_file)
+
+        return results
+
+
+__all__ = ["ConfigValidator"]