mcp-proxy-adapter-dev 8.11.16__py3-none-any.whl

mcp_proxy_adapter/api/core/app_factory.py

@@ -0,0 +1,215 @@
+"""
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+
+Application factory for MCP Proxy Adapter API.
+"""
+
+from typing import Any, Dict, Optional
+
+from fastapi import FastAPI
+
+from mcp_proxy_adapter.commands.help_command import set_app_metadata
+from mcp_proxy_adapter.core.logging import get_global_logger
+from mcp_proxy_adapter.custom_openapi import custom_openapi_with_fallback
+
+from .app_factory_config import debug_config_info, resolve_current_config
+from .app_factory_routes import setup_routes
+from .app_factory_validators import validate_configuration
+from .lifespan_manager import LifespanManager
+
+
+class AppFactory:
+    """Factory for creating FastAPI applications."""
+
+    def __init__(self) -> None:
+        """Initialize app factory."""
+        self.logger = get_global_logger()
+        self.lifespan_manager = LifespanManager()
+        self._config_path: Optional[str] = None
+
+    def create_app(
+        self,
+        title: Optional[str] = None,
+        description: Optional[str] = None,
+        version: Optional[str] = None,
+        app_config: Optional[Dict[str, Any]] = None,
+        config_path: Optional[str] = None,
+    ) -> FastAPI:
+        """Create and configure FastAPI application."""
+        self._config_path = config_path
+        if config_path:
+            # The file given at start stays the default source of `reload`
+            # for the whole server lifetime.
+            from mcp_proxy_adapter.config import get_config
+
+            get_config().set_start_config_path(config_path)
+        current_config = resolve_current_config(app_config)
+        debug_config_info(app_config, self.logger)
+
+        # ONE enforcement call: validate_configuration builds a SimpleConfigModel
+        # from current_config and runs SimpleConfigValidator, rejecting any
+        # invalid configuration (bug e86b4fb5's fix removed the second,
+        # independently-implemented validate_certificates() call that used to
+        # duplicate this exact work under a misleading name - see
+        # pipeline/checks/check_config_validation_wired.py).
+        validate_configuration(current_config, self.logger, self._config_path)
+
+        title = title or "MCP Proxy Adapter"
+        description = description or "JSON-RPC API for interacting with MCP Proxy"
+        version = version or "1.0.0"
+
+        self.logger.info(
+            "🔍 AppFactory: Creating lifespan with current_config keys: %s",
+            list(current_config.keys()) if hasattr(current_config, "keys") else "None",
+        )
+        lifespan = self.lifespan_manager.create_lifespan(config_path, current_config)
+        self.logger.info(
+            "🔍 AppFactory: lifespan created, callable=%s", callable(lifespan)
+        )
+
+        app = FastAPI(
+            title=title,
+            description=description,
+            version=version,
+            lifespan=lifespan,
+        )
+        # The listener is started after this factory returns. Keep the
+        # validated source configuration on this app so ServerEngineFactory
+        # can apply its TLS settings even when a consumer supplies only
+        # host/port/log_level to engine.run_server().
+        app.state.mcp_proxy_adapter_config = current_config
+        app.state.mcp_proxy_adapter_config_path = config_path
+        self.logger.info("🔍 AppFactory: FastAPI app created")
+
+        # Register built-in commands automatically
+        # Pass current_config to enable automatic queue commands registration
+        #
+        # Import deferred to point of use (surfaced while fixing bug
+        # 7f7ce943): this module is reachable from
+        # `commands/builtin_commands.py` itself via
+        # `health_command.py -> core/proxy_registration.py ->
+        # api/core/registration_manager -> api/core/__init__.py ->
+        # this module`. A module-level import here used to work only by
+        # ACCIDENT OF IMPORT ORDER - as long as something else (previously,
+        # `mcp_proxy_adapter/__init__.py`'s own eager `create_app` import)
+        # fully warmed `api.core`/this module BEFORE anything imported
+        # `commands.builtin_commands` directly, the cycle never manifested.
+        # Once that accidental warm-up was removed (deferred, for the same
+        # bug), any direct import of `commands.builtin_commands` (e.g.
+        # `pipeline/checks/check_info_command.py`) hit this module while
+        # `commands.builtin_commands` was still mid-init, and
+        # `register_builtin_commands` did not exist on it yet -
+        # `ImportError: cannot import name 'register_builtin_commands' from
+        # partially initialized module ... (most likely due to a circular
+        # import)`. Importing here instead means this module finishes
+        # loading regardless of which side of the cycle is entered first.
+        from mcp_proxy_adapter.commands.builtin_commands import (
+            register_builtin_commands,
+        )
+
+        register_builtin_commands(config_data=current_config)
+        self.logger.info("✅ Built-in commands registered")
+
+        # Store app metadata for help command
+        set_app_metadata(title, description, version)
+        self.logger.info(f"✅ App metadata stored: {title} v{version}")
+
+        setup_routes(app)
+        app.openapi = lambda: custom_openapi_with_fallback(app)  # type: ignore[method-assign]  # monkeypatch
+
+        # Add security middleware when EITHER the canonical auth.use_token or
+        # the legacy security.enabled flag requests authentication, so /ws and
+        # other public paths are enforced (enables repro of WebSocket 403
+        # under mTLS). Defect 2e24933f-a130-47d7-95b2-370b69c89b8f: every
+        # shipped config declares credentials under "auth" (the schema
+        # SimpleConfigModel declares, AuthValidator validates, and both
+        # packaged config generators emit) rather than the legacy "security"
+        # section, so gating registration on security.enabled alone left
+        # those configs' credentials completely unenforced. auth takes
+        # precedence when both sections are present; a config with neither
+        # flag set registers no middleware and stays open (three shipped
+        # modes legitimately run without credentials).
+        auth_cfg = current_config.get("auth", {}) or {}
+        security_cfg = current_config.get("security", {}) or {}
+        if auth_cfg.get("use_token", False) or security_cfg.get("enabled", False):
+            from mcp_proxy_adapter.api.middleware.unified_security import (
+                UnifiedSecurityMiddleware,
+            )
+
+            app.add_middleware(UnifiedSecurityMiddleware, config=current_config)
+            self.logger.info(
+                "Unified security middleware added (auth.use_token=%s, "
+                "security.enabled=%s)",
+                auth_cfg.get("use_token", False),
+                security_cfg.get("enabled", False),
+            )
+
+        # Request logging middleware: UNCONDITIONAL (bug 73b03995 / deb24fa7
+        # logging half). Access logging is observability, not a security
+        # feature, so it needs no config flag. Added AFTER the security
+        # middleware above so it ends up OUTERMOST (Starlette's
+        # add_middleware() makes the LAST-added middleware the outermost
+        # one - see mcp_proxy_adapter/api/middleware/request_logging.py's
+        # docstring), wrapping the security middleware so its one access-log
+        # line per request also covers a 401/403 security rejection.
+        from mcp_proxy_adapter.api.middleware.request_logging import (
+            RequestLoggingMiddleware,
+        )
+
+        app.add_middleware(RequestLoggingMiddleware)
+        self.logger.info("Request logging middleware added (unconditional)")
+
+        # CORS middleware: UNCONDITIONAL, like request logging above (bug
+        # 4d3d801c). Before this fix, CORSMiddleware was wired only in the
+        # OTHER app-creation path - core/app_factory/app_creator.py, reached
+        # only by examples/basic_framework/main.py and examples/test_config.py
+        # - while THIS factory (AppFactory.create_app, the one
+        # examples/full_application/main.py and the pipeline's server
+        # actually use) never added it at all, so a browser-based caller got
+        # no CORS headers on any request, preflight included.
+        #
+        # No "cors" config surface existed anywhere in this project (no
+        # dataclass field on SimpleConfigModel, no key any generator emits)
+        # before this fix, so an optional "cors" section is read the same
+        # way "auth"/"security" are read above - a raw dict lookup on
+        # current_config, never routed through SimpleConfigModel - and
+        # unknown/absent keys fall back to a CONSERVATIVE documented
+        # default: reflect the requesting origin (allow_origins=["*"]) but
+        # WITHOUT credentials, and restrict methods to what this JSON-RPC/
+        # command API actually exposes (GET for /health and docs, POST for
+        # /api/jsonrpc and /api/async, OPTIONS for the preflight itself).
+        # This is spec-legal and safe: a wildcard origin combined with
+        # allow_credentials=False never leaks cookies/auth headers
+        # cross-origin (unlike app_creator.py's allow_origins=["*"] +
+        # allow_credentials=True combination, which relies on Starlette
+        # reflecting the concrete origin instead of literal "*" to stay
+        # spec-legal and is intentionally NOT replicated here). Added LAST
+        # so it is the OUTERMOST middleware (see the comment on
+        # RequestLoggingMiddleware above for why last-added = outermost in
+        # Starlette): CORS headers must be present even on a 401/403/5xx
+        # response, or a browser-based caller sees an opaque network error
+        # instead of the real status.
+        cors_cfg = current_config.get("cors", {}) or {}
+        from fastapi.middleware.cors import CORSMiddleware
+
+        cors_allow_origins = cors_cfg.get("allow_origins", ["*"])
+        cors_allow_credentials = cors_cfg.get("allow_credentials", False)
+        cors_allow_methods = cors_cfg.get("allow_methods", ["GET", "POST", "OPTIONS"])
+        cors_allow_headers = cors_cfg.get("allow_headers", ["*"])
+        app.add_middleware(
+            CORSMiddleware,
+            allow_origins=cors_allow_origins,
+            allow_credentials=cors_allow_credentials,
+            allow_methods=cors_allow_methods,
+            allow_headers=cors_allow_headers,
+        )
+        self.logger.info(
+            "CORS middleware added (allow_origins=%s, allow_credentials=%s, "
+            "allow_methods=%s)",
+            cors_allow_origins,
+            cors_allow_credentials,
+            cors_allow_methods,
+        )
+
+        return app

mcp_proxy_adapter/api/core/app_factory_certificates.py

@@ -0,0 +1,159 @@
+"""
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+
+Certificate validation helpers for API AppFactory.
+"""
+
+from dataclasses import fields
+from typing import Any, Dict, Optional, Tuple, Type
+
+RegistrationConfigData = Dict[str, Any]
+
+
+def build_simple_config_model(current_config: Dict[str, Any]) -> Any:
+    """
+    Build a SimpleConfigModel from a raw configuration dict.
+
+    This is the single shared implementation for reconstructing a
+    ``SimpleConfigModel`` out of an in-memory config dict (as opposed to
+    ``SimpleConfig.load()``, which reconstructs one from a config file path).
+    Both certificate validation and startup configuration validation use
+    this helper so there is exactly one place that knows how to map a raw
+    dict onto the dataclass model.
+
+    Args:
+        current_config: Configuration dictionary.
+
+    Returns:
+        A populated SimpleConfigModel instance.
+    """
+    from mcp_proxy_adapter.core.config.simple_config import (
+        AuthConfig,
+        ClientConfig,
+        HeartbeatConfig,
+        QueueManagerConfig,
+        RegistrationConfig,
+        ServerConfig,
+        ServerValidationConfig,
+        SimpleConfigModel,
+        SSLConfig,
+    )
+
+    server_data = _filter_dataclass_fields(
+        ServerConfig, current_config.get("server", {})
+    )
+    if "servername" not in server_data:
+        server_data["servername"] = server_data.get("host", "localhost")
+    server_data = _coerce_ssl_config(server_data, SSLConfig)
+    server = ServerConfig(**server_data)
+    client_data = _filter_dataclass_fields(
+        ClientConfig, current_config.get("client", {})
+    )
+    client_data = _coerce_ssl_config(client_data, SSLConfig)
+    client = ClientConfig(**client_data)
+    registration, heartbeat_override = _build_registration_config(current_config)
+    registration = _filter_dataclass_fields(RegistrationConfig, registration)
+    registration = _coerce_ssl_config(registration, SSLConfig)
+    auth = AuthConfig(**current_config.get("auth", {}))
+    server_validation_data = _filter_dataclass_fields(
+        ServerValidationConfig,
+        current_config.get("server_validation", {}),
+    )
+    server_validation_data = _coerce_ssl_config(server_validation_data, SSLConfig)
+    server_validation = ServerValidationConfig(**server_validation_data)
+    queue_manager_data = _filter_dataclass_fields(
+        QueueManagerConfig,
+        current_config.get("queue_manager", {}),
+    )
+    queue_manager = QueueManagerConfig(**queue_manager_data)
+    registration_model = RegistrationConfig(**registration)
+    if heartbeat_override is not None:
+        registration_model.heartbeat = HeartbeatConfig(**heartbeat_override)
+    return SimpleConfigModel(
+        server=server,
+        client=client,
+        registration=registration_model,
+        server_validation=server_validation,
+        auth=auth,
+        queue_manager=queue_manager,
+    )
+
+
+def _filter_dataclass_fields(cls: Type[Any], data: Any) -> Dict[str, Any]:
+    """Return only keys accepted by a dataclass constructor."""
+    if not isinstance(data, dict):
+        return {}
+    allowed = {field.name for field in fields(cls)}
+    return {key: value for key, value in data.items() if key in allowed}
+
+
+def _coerce_ssl_config(data: Dict[str, Any], ssl_cls: Type[Any]) -> Dict[str, Any]:
+    """Convert nested ssl dict to SSLConfig while preserving existing objects."""
+    ssl_value = data.get("ssl")
+    if not isinstance(ssl_value, dict):
+        return data
+
+    ssl_data = ssl_value.copy()
+    if "check_hostname" in ssl_data:
+        ssl_data["dnscheck"] = ssl_data["check_hostname"]
+    elif "dnscheck" in ssl_data and "check_hostname" not in ssl_data:
+        ssl_data["check_hostname"] = ssl_data["dnscheck"]
+    data = data.copy()
+    # Unknown/retired keys (e.g. server.ssl.verify_client) must not crash the
+    # strict dataclass; SimpleConfigValidator reports them from the raw dict.
+    known = {f.name for f in fields(ssl_cls)}
+    data["ssl"] = ssl_cls(**{k: v for k, v in ssl_data.items() if k in known})
+    return data
+
+
+def _build_registration_config(
+    current_config: Dict[str, Any],
+) -> Tuple[RegistrationConfigData, Optional[Dict[str, Any]]]:
+    """Build registration configuration and heartbeat overrides."""
+    registration_config = current_config.get("registration", {}) or {}
+    if not registration_config and current_config.get("proxy_client"):
+        pc = current_config["proxy_client"]
+        registration_config = {
+            "enabled": pc.get("enabled", False),
+            "host": pc.get("host", "localhost"),
+            "port": pc.get("port", 3005),
+            "protocol": pc.get("protocol", "http"),
+            "server_id": pc.get("server_id"),
+            "server_name": pc.get("server_name"),
+            "cert_file": pc.get("cert_file"),
+            "key_file": pc.get("key_file"),
+            "ca_cert_file": pc.get("ca_cert_file"),
+            "crl_file": pc.get("crl_file"),
+            "use_system_ca": pc.get("use_system_ca", False),
+            "register_endpoint": (
+                pc.get("registration", {}).get("register_endpoint", "/register")
+                if isinstance(pc.get("registration"), dict)
+                else "/register"
+            ),
+            "unregister_endpoint": (
+                pc.get("registration", {}).get("unregister_endpoint", "/unregister")
+                if isinstance(pc.get("registration"), dict)
+                else "/unregister"
+            ),
+            "auto_on_startup": (
+                pc.get("registration", {}).get("auto_on_startup", True)
+                if isinstance(pc.get("registration"), dict)
+                else True
+            ),
+            "auto_on_shutdown": (
+                pc.get("registration", {}).get("auto_on_shutdown", True)
+                if isinstance(pc.get("registration"), dict)
+                else True
+            ),
+            "heartbeat": pc.get("heartbeat", {}),
+        }
+
+    heartbeat_override = None
+    heartbeat = registration_config.get("heartbeat")
+    if isinstance(heartbeat, dict):
+        heartbeat_override = heartbeat.copy()
+        if "endpoint" in heartbeat_override and "url" not in heartbeat_override:
+            heartbeat_override.pop("endpoint")
+
+    return registration_config, heartbeat_override

mcp_proxy_adapter/api/core/app_factory_config.py

@@ -0,0 +1,75 @@
+"""
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+
+Configuration helpers for API AppFactory.
+"""
+
+import logging
+from typing import Any, Dict, Optional, cast
+
+from mcp_proxy_adapter.core.logging import get_global_logger
+
+
+def resolve_current_config(app_config: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+    """
+    Resolve application configuration from provided source or global config.
+
+    Args:
+        app_config: Configuration dict or config object.
+
+    Returns:
+        Dictionary with resolved configuration.
+    """
+    if app_config is not None:
+        if hasattr(app_config, "get_all"):
+            return cast(Dict[str, Any], app_config.get_all())
+        if hasattr(app_config, "keys"):
+            return app_config
+        return app_config
+
+    try:
+        from mcp_proxy_adapter.config import get_config
+
+        return get_config().get_all()
+    except Exception:
+        return {}
+
+
+def debug_config_info(
+    app_config: Optional[Dict[str, Any]],
+    logger: Optional[logging.Logger] = None,
+) -> None:
+    """
+    Log diagnostic information about the configuration create_app() received.
+
+    Silent by default (bug 20231492): this used to be five bare print()
+    calls, which made every create_app() invocation write to stdout
+    regardless of caller intent. Reporting now goes through logger.debug(),
+    which is silent unless the caller has explicitly enabled DEBUG-level
+    console logging (see core.logging.setup_logging) - the pure scaffolding
+    branches (no app_config supplied; app_config of an unexpected type) that
+    carried no diagnostic value beyond restating the obvious were dropped
+    instead of being demoted.
+
+    Args:
+        app_config: Configuration dict or config object.
+        logger: Logger to report through. Defaults to the package's global
+            logger (mcp_proxy_adapter.core.logging.get_global_logger()).
+    """
+    if not app_config or not hasattr(app_config, "keys"):
+        return
+
+    log = logger or get_global_logger()
+    keys = list(app_config.keys())
+    protocol = app_config.get("server", {}).get("protocol", "http")
+    # verify_client is protocol-derived only (todo 9425f2d0 target B,
+    # BREAKING) - the former transport.verify_client debug read is dropped,
+    # it was print-only scaffolding.
+    ssl_enabled = protocol in ["https", "mtls"]
+    log.debug(
+        "create_app received app_config keys=%s protocol=%s ssl_enabled=%s",
+        keys,
+        protocol,
+        ssl_enabled,
+    )