mcp-apollo 0.1.0__py3-none-any.whl

mcp_apollo/__init__.py

@@ -0,0 +1,6 @@
+"""Apollo MCP Server
+
+提供与 Apollo 配置中心交互的 MCP 工具。
+"""
+
+__version__ = "0.1.0"

mcp_apollo/__main__.py

@@ -0,0 +1,6 @@
+"""允许通过 python -m mcp_apollo 运行"""
+
+from .server import main
+
+if __name__ == "__main__":
+    main()

mcp_apollo/auth.py

@@ -0,0 +1,109 @@
+"""HTTP 传输的简单 Bearer Token 认证中间件（纯 ASGI 实现）。
+
+仅用于保护 sse / streamable-http 两种 HTTP 传输的接口，stdio 传输不受影响。
+认证方式：请求头携带 `Authorization: Bearer <token>`，
+兼容 `X-Auth-Token: <token>` 与 `X-MCP-Token: <token>`。
+
+设计为纯 ASGI 中间件，避免依赖具体版本的 Starlette 中间件 API，
+可直接包裹 FastMCP 返回的 sse_app() / streamable_http_app()。
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Any, Awaitable, Callable
+
+logger = logging.getLogger(__name__)
+
+Scope = dict[str, Any]
+Message = dict[str, Any]
+Receive = Callable[[], Awaitable[Message]]
+Send = Callable[[Message], Awaitable[None]]
+ASGIApp = Callable[[Scope, Receive, Send], Awaitable[None]]
+
+
+class TokenAuthMiddleware:
+    """基于固定 Token 的 ASGI 认证中间件。
+
+    - 非 HTTP 请求（如 lifespan、websocket）直接放行，保证应用生命周期正常。
+    - 健康检查路径（默认 /health）免鉴权，方便容器探活。
+    - 其余 HTTP 请求必须携带正确 Token，否则返回 401。
+    """
+
+    def __init__(
+        self,
+        app: ASGIApp,
+        token: str,
+        health_path: str = "/health",
+    ) -> None:
+        self.app = app
+        self._token = token
+        self._health_path = health_path
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope.get("type") != "http":
+            # lifespan / websocket 等直接透传，确保 session manager 生命周期正常
+            await self.app(scope, receive, send)
+            return
+
+        path = scope.get("path", "")
+        if path == self._health_path:
+            await self._respond_ok(send)
+            return
+
+        if not self._is_authorized(scope):
+            await self._respond_unauthorized(send)
+            return
+
+        await self.app(scope, receive, send)
+
+    def _is_authorized(self, scope: Scope) -> bool:
+        headers = {k.lower(): v for k, v in scope.get("headers", [])}
+
+        auth = headers.get(b"authorization", b"").decode("latin-1").strip()
+        if auth.lower().startswith("bearer "):
+            if _constant_equals(auth[7:].strip(), self._token):
+                return True
+
+        for name in (b"x-auth-token", b"x-mcp-token"):
+            value = headers.get(name, b"").decode("latin-1").strip()
+            if value and _constant_equals(value, self._token):
+                return True
+
+        return False
+
+    async def _respond_unauthorized(self, send: Send) -> None:
+        body = b'{"error":"unauthorized","message":"missing or invalid MCP auth token"}'
+        await send(
+            {
+                "type": "http.response.start",
+                "status": 401,
+                "headers": [
+                    (b"content-type", b"application/json"),
+                    (b"www-authenticate", b'Bearer realm="mcp"'),
+                    (b"content-length", str(len(body)).encode("latin-1")),
+                ],
+            }
+        )
+        await send({"type": "http.response.body", "body": body})
+
+    async def _respond_ok(self, send: Send) -> None:
+        body = b'{"status":"ok"}'
+        await send(
+            {
+                "type": "http.response.start",
+                "status": 200,
+                "headers": [
+                    (b"content-type", b"application/json"),
+                    (b"content-length", str(len(body)).encode("latin-1")),
+                ],
+            }
+        )
+        await send({"type": "http.response.body", "body": body})
+
+
+def _constant_equals(a: str, b: str) -> bool:
+    """常量时间比较，降低时序攻击风险。"""
+    import hmac
+
+    return hmac.compare_digest(a, b)

mcp_apollo/client.py

@@ -0,0 +1,5 @@
+"""Apollo 客户端导出"""
+
+from .clients import get_apollo_client
+
+__all__ = ["get_apollo_client"]

mcp_apollo/clients/__init__.py

@@ -0,0 +1,6 @@
+"""Apollo 客户端实现"""
+
+from .base import ApolloClientProtocol
+from .factory import get_apollo_client
+
+__all__ = ["ApolloClientProtocol", "get_apollo_client"]

mcp_apollo/clients/base.py

@@ -0,0 +1,231 @@
+"""Apollo 客户端基础实现"""
+
+import os
+from typing import Any, Optional, Protocol
+
+
+class ApolloClientProtocol(Protocol):
+    """Apollo 客户端协议"""
+
+    default_env: str
+    default_app_id: str
+    default_cluster: str
+    default_namespace: str
+
+    # ---- 读取/查询（只读，对应 3.2 查询类接口）----
+    async def get_config(
+        self,
+        namespace_name: Optional[str] = None,
+        key: Optional[str] = None,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        page: Optional[int] = None,
+        page_size: Optional[int] = None,
+    ) -> dict[str, Any]: ...
+
+    async def get_app_env_clusters(
+        self,
+        app_id: Optional[str] = None,
+        env: Optional[str] = None,
+    ) -> list[dict[str, Any]]: ...
+
+    async def get_apps(
+        self,
+        app_ids: Optional[str] = None,
+    ) -> list[dict[str, Any]]: ...
+
+    async def get_cluster(
+        self,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def list_namespaces(
+        self,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+    ) -> list[dict[str, Any]]: ...
+
+    async def get_namespace_lock(
+        self,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        namespace_name: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def get_latest_release(
+        self,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        namespace_name: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def list_items(
+        self,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        namespace_name: Optional[str] = None,
+        page: Optional[int] = None,
+        size: Optional[int] = None,
+    ) -> dict[str, Any]: ...
+
+    # ---- 写入/变更（写，对应 3.2 变更类接口）----
+    async def create_item(
+        self,
+        key: str,
+        value: str,
+        namespace_name: Optional[str] = None,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        comment: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def update_item(
+        self,
+        key: str,
+        value: str,
+        namespace_name: Optional[str] = None,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        comment: Optional[str] = None,
+        create_if_not_exists: bool = False,
+    ) -> dict[str, Any]: ...
+
+    async def releases(
+        self,
+        namespace_name: Optional[str] = None,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        release_title: Optional[str] = None,
+        release_comment: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def create_cluster(
+        self,
+        name: str,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def create_namespace(
+        self,
+        name: str,
+        format: str,
+        is_public: bool,
+        app_id: Optional[str] = None,
+        comment: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def delete_item(
+        self,
+        key: str,
+        env: Optional[str] = None,
+        app_id: Optional[str] = None,
+        cluster_name: Optional[str] = None,
+        namespace_name: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def rollback_release(
+        self,
+        release_id: int,
+        env: Optional[str] = None,
+    ) -> dict[str, Any]: ...
+
+    async def create_app(
+        self,
+        name: str,
+        app_id: str,
+        org_id: str,
+        org_name: str,
+        owner_name: str,
+        owner_email: str,
+        admins: Optional[list[str]] = None,
+        assign_app_role_to_self: bool = True,
+    ) -> dict[str, Any]: ...
+
+
+class ApolloOpenApiBase:
+    """Apollo OpenAPI 客户端基类。
+
+    负责从环境变量读取连接信息、组装认证头、以及把「工具参数 > 环境变量默认值」
+    的优先级解析逻辑集中在一处。
+    """
+
+    def __init__(self) -> None:
+        self.portal_url = os.getenv("APOLLO_PORTAL_URL", "http://localhost:8070").rstrip("/")
+        self.token = os.getenv("APOLLO_TOKEN", "")
+        self.operator = os.getenv("APOLLO_OPERATOR", "apollo")
+
+        self.default_env = os.getenv("APOLLO_ENV", "DEV")
+        self.default_app_id = os.getenv("APOLLO_APP_ID", "")
+        self.default_cluster = os.getenv("APOLLO_CLUSTER", "default")
+        self.default_namespace = os.getenv("APOLLO_NAMESPACE", "application")
+
+    @property
+    def auth_headers(self) -> dict[str, str]:
+        """OpenAPI 认证头。
+
+        Apollo OpenAPI 使用第三方应用 Token，直接放在 Authorization 头（不带 Bearer 前缀），
+        写操作要求 Content-Type 为 application/json;charset=UTF-8。
+        """
+        headers = {"Content-Type": "application/json;charset=UTF-8"}
+        if self.token:
+            headers["Authorization"] = self.token
+        return headers
+
+    def _resolve_env(self, env: Optional[str]) -> str:
+        return env or self.default_env
+
+    def _resolve_app_id(self, app_id: Optional[str]) -> str:
+        resolved = app_id or self.default_app_id
+        if not resolved:
+            raise ValueError("缺少 appId，请通过工具参数 app_id 或环境变量 APOLLO_APP_ID 指定")
+        return resolved
+
+    def _resolve_cluster(self, cluster_name: Optional[str]) -> str:
+        return cluster_name or self.default_cluster
+
+    def _resolve_namespace(self, namespace_name: Optional[str]) -> str:
+        return namespace_name or self.default_namespace
+
+    # ---- URL 构造辅助 ----
+    def _apps_base_url(self) -> str:
+        """/openapi/v1/apps —— 应用级（不带 env）"""
+        return f"{self.portal_url}/openapi/v1/apps"
+
+    def _env_apps_base_url(self, env: str, app_id: str) -> str:
+        """/openapi/v1/envs/{env}/apps/{appId}"""
+        return f"{self.portal_url}/openapi/v1/envs/{env}/apps/{app_id}"
+
+    def _cluster_base_url(self, env: str, app_id: str, cluster_name: str) -> str:
+        """/openapi/v1/envs/{env}/apps/{appId}/clusters/{clusterName}"""
+        return (
+            f"{self.portal_url}/openapi/v1/envs/{env}"
+            f"/apps/{app_id}/clusters/{cluster_name}"
+        )
+
+    def _namespace_base_url(
+        self, env: str, app_id: str, cluster_name: str, namespace_name: str
+    ) -> str:
+        """命名空间级别的 OpenAPI 基础 URL"""
+        return (
+            f"{self.portal_url}/openapi/v1/envs/{env}"
+            f"/apps/{app_id}/clusters/{cluster_name}/namespaces/{namespace_name}"
+        )
+
+    def _appnamespaces_base_url(self, app_id: str) -> str:
+        """/openapi/v1/apps/{appId}/appnamespaces —— 创建命名空间（不带 env）"""
+        return f"{self.portal_url}/openapi/v1/apps/{app_id}/appnamespaces"
+
+    def _releases_base_url(self, env: str) -> str:
+        """/openapi/v1/envs/{env}/releases —— 回滚等发布级操作"""
+        return f"{self.portal_url}/openapi/v1/envs/{env}/releases"

mcp_apollo/clients/factory.py

@@ -0,0 +1,23 @@
+"""Apollo 客户端工厂"""
+
+from typing import Optional
+
+from .base import ApolloClientProtocol
+from .openapi import ApolloOpenApiClient
+
+_cached_client: Optional[ApolloClientProtocol] = None
+
+
+async def get_apollo_client() -> ApolloClientProtocol:
+    """获取 Apollo 客户端（基于 Portal OpenAPI）。
+
+    Apollo OpenAPI 接口稳定为 v1，无需按版本适配，
+    因此工厂当前统一返回 OpenAPI 客户端，并保留工厂层以便未来扩展
+    （如新增只读的 Config Service 客户端）。
+    """
+    global _cached_client
+    if _cached_client:
+        return _cached_client
+
+    _cached_client = ApolloOpenApiClient()
+    return _cached_client