mcp-proxy-adapter 4.1.0__py3-none-any.whl → 6.0.0__py3-none-any.whl

mcp_proxy_adapter/api/middleware/transport_middleware.py

@@ -0,0 +1,122 @@
+"""
+Transport Middleware Module
+
+This module provides middleware for transport validation in the MCP Proxy Adapter.
+"""
+
+from typing import Callable
+from fastapi import Request, Response
+from fastapi.responses import JSONResponse
+from starlette.middleware.base import BaseHTTPMiddleware
+
+from mcp_proxy_adapter.core.transport_manager import transport_manager
+from mcp_proxy_adapter.core.logging import logger
+
+
+class TransportMiddleware(BaseHTTPMiddleware):
+    """Middleware for transport validation."""
+    
+    def __init__(self, app, transport_manager_instance=None):
+        """
+        Initialize transport middleware.
+        
+        Args:
+            app: FastAPI application
+            transport_manager_instance: Transport manager instance (optional)
+        """
+        super().__init__(app)
+        self.transport_manager = transport_manager_instance or transport_manager
+    
+    async def dispatch(self, request: Request, call_next: Callable) -> Response:
+        """
+        Process request through transport middleware.
+        
+        Args:
+            request: Incoming request
+            call_next: Next middleware/endpoint
+            
+        Returns:
+            Response from next middleware/endpoint or error response
+        """
+        # Determine transport type from request
+        transport_type = self._get_request_transport_type(request)
+        
+        # Check if request matches configured transport
+        if not self._is_transport_allowed(transport_type):
+            configured_type = self.transport_manager.get_transport_type()
+            configured_type_str = configured_type.value if configured_type else "not configured"
+            logger.warning(f"Transport not allowed: {transport_type} for {request.url}")
+            return JSONResponse(
+                status_code=403,
+                content={
+                    "error": "Transport not allowed",
+                    "message": f"Transport '{transport_type}' is not allowed. Configured transport: {configured_type_str}",
+                    "configured_transport": configured_type_str,
+                    "request_url": str(request.url)
+                }
+            )
+        
+        # Add transport info to request state
+        request.state.transport_type = transport_type
+        request.state.transport_allowed = True
+        
+        response = await call_next(request)
+        return response
+    
+    def _get_request_transport_type(self, request: Request) -> str:
+        """
+        Determine transport type from request.
+        
+        Args:
+            request: Incoming request
+            
+        Returns:
+            Transport type string
+        """
+        if request.url.scheme == "https":
+            # Check for client certificate for MTLS
+            if self._has_client_certificate(request):
+                return "mtls"
+            return "https"
+        return "http"
+    
+    def _has_client_certificate(self, request: Request) -> bool:
+        """
+        Check if request has client certificate.
+        
+        Args:
+            request: Incoming request
+            
+        Returns:
+            True if client certificate is present, False otherwise
+        """
+        # Check for client certificate in request headers or SSL context
+        # This is a simplified check - in production, you might need more sophisticated detection
+        client_cert_header = request.headers.get("ssl-client-cert")
+        if client_cert_header:
+            return True
+        
+        # Check if request has SSL client certificate context
+        if hasattr(request, "client") and request.client:
+            # In a real implementation, you would check the SSL context
+            # For now, we'll assume HTTPS with client cert is MTLS
+            return self.transport_manager.is_mtls()
+        
+        return False
+    
+    def _is_transport_allowed(self, transport_type: str) -> bool:
+        """
+        Check if transport type is allowed.
+        
+        Args:
+            transport_type: Transport type to check
+            
+        Returns:
+            True if transport is allowed, False otherwise
+        """
+        configured_type = self.transport_manager.get_transport_type()
+        if not configured_type:
+            logger.error("Transport not configured")
+            return False
+        
+        return transport_type == configured_type.value 

mcp_proxy_adapter/commands/__init__.py

@@ -6,9 +6,12 @@ from mcp_proxy_adapter.commands.base import Command
 from mcp_proxy_adapter.commands.command_registry import registry, CommandRegistry
 from mcp_proxy_adapter.commands.dependency_container import container, DependencyContainer
 from mcp_proxy_adapter.commands.result import CommandResult, SuccessResult, ErrorResult
-
-# Automatically discover and register commands
-registry.discover_commands()
+from mcp_proxy_adapter.commands.auth_validation_command import AuthValidationCommand
+from mcp_proxy_adapter.commands.ssl_setup_command import SSLSetupCommand
+from mcp_proxy_adapter.commands.certificate_management_command import CertificateManagementCommand
+from mcp_proxy_adapter.commands.key_management_command import KeyManagementCommand
+from mcp_proxy_adapter.commands.cert_monitor_command import CertMonitorCommand
+from mcp_proxy_adapter.commands.transport_management_command import TransportManagementCommand
 
 __all__ = [
     "Command",
@@ -18,5 +21,11 @@ __all__ = [
     "registry",
     "CommandRegistry",
     "container",
-    "DependencyContainer"
+    "DependencyContainer",
+    "AuthValidationCommand",
+    "SSLSetupCommand",
+    "CertificateManagementCommand",
+    "KeyManagementCommand",
+    "CertMonitorCommand",
+    "TransportManagementCommand"
 ]

mcp_proxy_adapter/commands/auth_validation_command.py

@@ -0,0 +1,408 @@
+"""
+Authentication Validation Commands
+
+This module provides commands for validating different types of authentication:
+- Universal authentication validation
+- Certificate validation
+- Token validation
+- mTLS validation
+- SSL validation
+
+Author: MCP Proxy Adapter Team
+Version: 1.0.0
+"""
+
+import logging
+from typing import Dict, List, Any, Optional, Union
+
+from ..commands.base import Command
+from ..commands.result import SuccessResult, ErrorResult
+from ..core.auth_validator import AuthValidator, AuthValidationResult
+
+
+class AuthValidationCommand(Command):
+    """
+    Authentication validation commands.
+    
+    Provides commands for validating different types of authentication
+    using the universal AuthValidator.
+    """
+    
+    def __init__(self):
+        """Initialize authentication validation command."""
+        super().__init__()
+        self.validator = AuthValidator()
+        self.logger = logging.getLogger(__name__)
+    
+    async def auth_validate(self, auth_data: Dict[str, Any]) -> Union[SuccessResult, ErrorResult]:
+        """
+        Universal authentication validation.
+        
+        Validates authentication data based on the provided type.
+        Supports certificate, token, mTLS, and SSL validation.
+        
+        Args:
+            auth_data: Authentication data dictionary containing:
+                - auth_type: Type of authentication (auto/certificate/token/mtls/ssl)
+                - cert_path: Path to certificate file (for certificate/mtls/ssl)
+                - cert_type: Type of certificate (server/client/ca)
+                - token: Token string (for token validation)
+                - token_type: Type of token (jwt/api)
+                - client_cert: Path to client certificate (for mTLS)
+                - ca_cert: Path to CA certificate (for mTLS)
+                - server_cert: Path to server certificate (for SSL)
+        
+        Returns:
+            CommandResult with validation status and extracted roles
+        """
+        try:
+            auth_type = auth_data.get("auth_type", "auto")
+            
+            # Perform validation
+            result = self.validator.validate_auth(auth_data, auth_type)
+            
+            if result.is_valid:
+                return SuccessResult(
+                    data={
+                        "valid": True,
+                        "roles": result.roles,
+                        "auth_type": auth_type
+                    }
+                )
+            else:
+                error_data = result.to_json_rpc_error()
+                return ErrorResult(
+                    message=error_data["message"],
+                    code=error_data["code"]
+                )
+                
+        except Exception as e:
+            self.logger.error(f"Authentication validation error: {e}")
+            return ErrorResult(
+                message=f"Internal authentication validation error: {str(e)}",
+                code=-32603
+            )
+    
+    async def auth_validate_cert(self, cert_path: str, cert_type: str = "server") -> Union[SuccessResult, ErrorResult]:
+        """
+        Validate certificate.
+        
+        Validates a certificate file and extracts roles if present.
+        
+        Args:
+            cert_path: Path to certificate file
+            cert_type: Type of certificate (server/client/ca)
+        
+        Returns:
+            CommandResult with certificate validation status and roles
+        """
+        try:
+            # Perform certificate validation
+            result = self.validator.validate_certificate(cert_path, cert_type)
+            
+            if result.is_valid:
+                return SuccessResult(
+                    data={
+                        "valid": True,
+                        "cert_path": cert_path,
+                        "cert_type": cert_type,
+                        "roles": result.roles
+                    }
+                )
+            else:
+                error_data = result.to_json_rpc_error()
+                return ErrorResult(
+                    message=error_data["message"],
+                    code=error_data["code"]
+                )
+                
+        except Exception as e:
+            self.logger.error(f"Certificate validation error: {e}")
+            return ErrorResult(
+                message=f"Internal certificate validation error: {str(e)}",
+                code=-32603
+            )
+    
+    async def auth_validate_token(self, token: str, token_type: str = "jwt") -> Union[SuccessResult, ErrorResult]:
+        """
+        Validate token.
+        
+        Validates a token and extracts roles if present.
+        
+        Args:
+            token: Token string to validate
+            token_type: Type of token (jwt/api)
+        
+        Returns:
+            CommandResult with token validation status and roles
+        """
+        try:
+            # Perform token validation
+            result = self.validator.validate_token(token, token_type)
+            
+            if result.is_valid:
+                return SuccessResult(
+                    data={
+                        "valid": True,
+                        "token_type": token_type,
+                        "roles": result.roles
+                    }
+                )
+            else:
+                error_data = result.to_json_rpc_error()
+                return ErrorResult(
+                    message=error_data["message"],
+                    code=error_data["code"]
+                )
+                
+        except Exception as e:
+            self.logger.error(f"Token validation error: {e}")
+            return ErrorResult(
+                message=f"Internal token validation error: {str(e)}",
+                code=-32603
+            )
+    
+    async def auth_validate_mtls(self, client_cert: str, ca_cert: str) -> Union[SuccessResult, ErrorResult]:
+        """
+        Validate mTLS connection.
+        
+        Validates client certificate against CA certificate and extracts roles.
+        
+        Args:
+            client_cert: Path to client certificate
+            ca_cert: Path to CA certificate
+        
+        Returns:
+            CommandResult with mTLS validation status and roles
+        """
+        try:
+            # Perform mTLS validation
+            result = self.validator.validate_mtls(client_cert, ca_cert)
+            
+            if result.is_valid:
+                return SuccessResult(
+                    data={
+                        "valid": True,
+                        "client_cert": client_cert,
+                        "ca_cert": ca_cert,
+                        "roles": result.roles
+                    }
+                )
+            else:
+                error_data = result.to_json_rpc_error()
+                return ErrorResult(
+                    message=error_data["message"],
+                    code=error_data["code"]
+                )
+                
+        except Exception as e:
+            self.logger.error(f"mTLS validation error: {e}")
+            return ErrorResult(
+                message=f"Internal mTLS validation error: {str(e)}",
+                code=-32603
+            )
+    
+    async def auth_validate_ssl(self, server_cert: str) -> Union[SuccessResult, ErrorResult]:
+        """
+        Validate SSL connection.
+        
+        Validates server certificate and extracts roles if present.
+        
+        Args:
+            server_cert: Path to server certificate
+        
+        Returns:
+            CommandResult with SSL validation status and roles
+        """
+        try:
+            # Perform SSL validation
+            result = self.validator.validate_ssl(server_cert)
+            
+            if result.is_valid:
+                return SuccessResult(
+                    data={
+                        "valid": True,
+                        "server_cert": server_cert,
+                        "roles": result.roles
+                    }
+                )
+            else:
+                error_data = result.to_json_rpc_error()
+                return ErrorResult(
+                    message=error_data["message"],
+                    code=error_data["code"]
+                )
+                
+        except Exception as e:
+            self.logger.error(f"SSL validation error: {e}")
+            return ErrorResult(
+                message=f"Internal SSL validation error: {str(e)}",
+                code=-32603
+            )
+    
+    async def execute(self, **kwargs) -> Union[SuccessResult, ErrorResult]:
+        """
+        Execute authentication validation command.
+        
+        This is a placeholder method to satisfy the abstract base class.
+        Individual validation methods should be called directly.
+        
+        Args:
+            **kwargs: Command parameters
+            
+        Returns:
+            Command result
+        """
+        return ErrorResult(
+            message="Method not found. Use specific validation methods instead.",
+            code=-32601
+        )
+    
+    @classmethod
+    def get_schema(cls) -> Dict[str, Any]:
+        """
+        Get command schema for documentation.
+        
+        Returns:
+            Dictionary containing command schema
+        """
+        return {
+            "auth_validate": {
+                "description": "Universal authentication validation",
+                "parameters": {
+                    "auth_data": {
+                        "type": "object",
+                        "description": "Authentication data dictionary",
+                        "properties": {
+                            "auth_type": {
+                                "type": "string",
+                                "enum": ["auto", "certificate", "token", "mtls", "ssl"],
+                                "description": "Type of authentication to validate"
+                            },
+                            "cert_path": {
+                                "type": "string",
+                                "description": "Path to certificate file"
+                            },
+                            "cert_type": {
+                                "type": "string",
+                                "enum": ["server", "client", "ca"],
+                                "description": "Type of certificate"
+                            },
+                            "token": {
+                                "type": "string",
+                                "description": "Token string to validate"
+                            },
+                            "token_type": {
+                                "type": "string",
+                                "enum": ["jwt", "api"],
+                                "description": "Type of token"
+                            },
+                            "client_cert": {
+                                "type": "string",
+                                "description": "Path to client certificate (for mTLS)"
+                            },
+                            "ca_cert": {
+                                "type": "string",
+                                "description": "Path to CA certificate (for mTLS)"
+                            },
+                            "server_cert": {
+                                "type": "string",
+                                "description": "Path to server certificate (for SSL)"
+                            }
+                        }
+                    }
+                },
+                "returns": {
+                    "type": "object",
+                    "properties": {
+                        "valid": {"type": "boolean"},
+                        "roles": {"type": "array", "items": {"type": "string"}},
+                        "auth_type": {"type": "string"}
+                    }
+                }
+            },
+            "auth_validate_cert": {
+                "description": "Validate certificate",
+                "parameters": {
+                    "cert_path": {
+                        "type": "string",
+                        "description": "Path to certificate file"
+                    },
+                    "cert_type": {
+                        "type": "string",
+                        "enum": ["server", "client", "ca"],
+                        "description": "Type of certificate"
+                    }
+                },
+                "returns": {
+                    "type": "object",
+                    "properties": {
+                        "valid": {"type": "boolean"},
+                        "cert_path": {"type": "string"},
+                        "cert_type": {"type": "string"},
+                        "roles": {"type": "array", "items": {"type": "string"}}
+                    }
+                }
+            },
+            "auth_validate_token": {
+                "description": "Validate token",
+                "parameters": {
+                    "token": {
+                        "type": "string",
+                        "description": "Token string to validate"
+                    },
+                    "token_type": {
+                        "type": "string",
+                        "enum": ["jwt", "api"],
+                        "description": "Type of token"
+                    }
+                },
+                "returns": {
+                    "type": "object",
+                    "properties": {
+                        "valid": {"type": "boolean"},
+                        "token_type": {"type": "string"},
+                        "roles": {"type": "array", "items": {"type": "string"}}
+                    }
+                }
+            },
+            "auth_validate_mtls": {
+                "description": "Validate mTLS connection",
+                "parameters": {
+                    "client_cert": {
+                        "type": "string",
+                        "description": "Path to client certificate"
+                    },
+                    "ca_cert": {
+                        "type": "string",
+                        "description": "Path to CA certificate"
+                    }
+                },
+                "returns": {
+                    "type": "object",
+                    "properties": {
+                        "valid": {"type": "boolean"},
+                        "client_cert": {"type": "string"},
+                        "ca_cert": {"type": "string"},
+                        "roles": {"type": "array", "items": {"type": "string"}}
+                    }
+                }
+            },
+            "auth_validate_ssl": {
+                "description": "Validate SSL connection",
+                "parameters": {
+                    "server_cert": {
+                        "type": "string",
+                        "description": "Path to server certificate"
+                    }
+                },
+                "returns": {
+                    "type": "object",
+                    "properties": {
+                        "valid": {"type": "boolean"},
+                        "server_cert": {"type": "string"},
+                        "roles": {"type": "array", "items": {"type": "string"}}
+                    }
+                }
+            }
+        }