mcp-proxy-adapter 6.3.4__py3-none-any.whl → 6.3.6__py3-none-any.whl

mcp_proxy_adapter/core/unified_config_adapter.py

@@ -18,8 +18,12 @@ from dataclasses import dataclass
 try:
     from mcp_security_framework import SecurityConfig
     from mcp_security_framework.schemas.config import (
-        AuthConfig, SSLConfig, PermissionConfig, RateLimitConfig
+        AuthConfig,
+        SSLConfig,
+        PermissionConfig,
+        RateLimitConfig,
     )
+
     SECURITY_FRAMEWORK_AVAILABLE = True
 except ImportError:
     SECURITY_FRAMEWORK_AVAILABLE = False
@@ -35,12 +39,12 @@ from mcp_proxy_adapter.core.logging import logger
 @dataclass
 class ValidationResult:
     """Result of configuration validation."""
-    
+
     is_valid: bool
     errors: List[str]
     warnings: List[str]
     details: Dict[str, Any]
-    
+
     def __post_init__(self):
         """Initialize with empty lists if None."""
         if self.errors is None:
@@ -54,162 +58,189 @@ class ValidationResult:
 class UnifiedConfigAdapter:
     """
     Unified adapter for converting mcp_proxy_adapter configuration to SecurityConfig.
-    
+
     This adapter handles:
     - Legacy configuration format compatibility
     - Configuration validation
     - Conversion to mcp_security_framework format
     - Default value management
     """
-    
+
     def __init__(self):
         """Initialize the unified configuration adapter."""
         self.validation_errors = []
         self.validation_warnings = []
-    
-    def convert_to_security_config(self, config: Dict[str, Any]) -> Optional[SecurityConfig]:
+
+    def convert_to_security_config(
+        self, config: Dict[str, Any]
+    ) -> Optional[SecurityConfig]:
         """
         Convert mcp_proxy_adapter configuration to SecurityConfig.
-        
+
         Args:
             config: mcp_proxy_adapter configuration dictionary
-            
+
         Returns:
             SecurityConfig instance or None if conversion failed
         """
         if not SECURITY_FRAMEWORK_AVAILABLE:
-            logger.error("mcp_security_framework not available, cannot convert configuration")
+            logger.error(
+                "mcp_security_framework not available, cannot convert configuration"
+            )
             return None
-        
+
         try:
             # Validate configuration first
             validation_result = self.validate_configuration(config)
             if not validation_result.is_valid:
-                logger.error(f"Configuration validation failed: {validation_result.errors}")
+                logger.error(
+                    f"Configuration validation failed: {validation_result.errors}"
+                )
                 return None
-            
+
             # Convert configuration sections
             auth_config = self._convert_auth_config(config)
             ssl_config = self._convert_ssl_config(config)
             permission_config = self._convert_permission_config(config)
             rate_limit_config = self._convert_rate_limit_config(config)
-            
+
             # Create SecurityConfig
             security_config = SecurityConfig(
                 auth=auth_config,
                 ssl=ssl_config,
                 permissions=permission_config,
-                rate_limit=rate_limit_config
+                rate_limit=rate_limit_config,
             )
-            
+
             logger.info("Configuration successfully converted to SecurityConfig")
             return security_config
-            
+
         except Exception as e:
             logger.error(f"Failed to convert configuration: {e}")
             return None
-    
+
     def validate_configuration(self, config: Dict[str, Any]) -> ValidationResult:
         """
         Validate configuration before conversion.
-        
+
         Args:
             config: Configuration dictionary to validate
-            
+
         Returns:
             ValidationResult with validation details
         """
         self.validation_errors = []
         self.validation_warnings = []
-        
+
         # Debug: Check SSL config at start of validation
         if "security" in config:
             ssl_config = config["security"].get("ssl", {})
-            print(f"🔍 Debug: SSL config at start of validation: enabled={ssl_config.get('enabled', False)}")
-        
+            print(
+                f"🔍 Debug: SSL config at start of validation: enabled={ssl_config.get('enabled', False)}"
+            )
+
         # Debug: Check if root ssl section exists
         if "ssl" in config:
-            print(f"🔍 Debug: Root SSL section found: enabled={config['ssl'].get('enabled', False)}")
-        
+            print(
+                f"🔍 Debug: Root SSL section found: enabled={config['ssl'].get('enabled', False)}"
+            )
+
         # Check if config is a dictionary
         if not isinstance(config, dict):
             return ValidationResult(
                 is_valid=False,
                 errors=["Configuration must be a dictionary"],
                 warnings=[],
-                details={}
+                details={},
             )
-        
+
         # Validate security section
         self._validate_security_section(config)
-        
+
         # Validate legacy sections for compatibility
         self._validate_legacy_sections(config)
-        
+
         # Check for conflicts
         self._check_configuration_conflicts(config)
-        
+
         # Validate individual sections
         self._validate_auth_section(config)
         self._validate_ssl_section(config)
         self._validate_permissions_section(config)
         self._validate_rate_limit_section(config)
-        
+
         return ValidationResult(
             is_valid=len(self.validation_errors) == 0,
             errors=self.validation_errors.copy(),
             warnings=self.validation_warnings.copy(),
             details={
                 "has_security_section": "security" in config,
-                "has_legacy_sections": any(key in config for key in ["ssl", "roles", "auth_enabled"]),
+                "has_legacy_sections": any(
+                    key in config for key in ["ssl", "roles", "auth_enabled"]
+                ),
                 "total_errors": len(self.validation_errors),
-                "total_warnings": len(self.validation_warnings)
-            }
+                "total_warnings": len(self.validation_warnings),
+            },
         )
-    
+
     def _validate_security_section(self, config: Dict[str, Any]):
         """Validate security section."""
         security_config = config.get("security", {})
-        
+
         if not isinstance(security_config, dict):
             self.validation_errors.append("Security section must be a dictionary")
             return
-        
+
         # Check for unknown keys in security section
-        known_keys = {"enabled", "auth", "ssl", "permissions", "rate_limit", "public_paths"}
+        known_keys = {
+            "enabled",
+            "auth",
+            "ssl",
+            "permissions",
+            "rate_limit",
+            "public_paths",
+        }
         unknown_keys = set(security_config.keys()) - known_keys
-        
+
         if unknown_keys:
-            self.validation_warnings.append(f"Unknown keys in security section: {unknown_keys}")
-    
+            self.validation_warnings.append(
+                f"Unknown keys in security section: {unknown_keys}"
+            )
+
     def _validate_legacy_sections(self, config: Dict[str, Any]):
         """Validate legacy configuration sections."""
         legacy_sections = ["ssl", "roles", "auth_enabled", "rate_limit_enabled"]
-        
+
         for section in legacy_sections:
             if section in config:
-                self.validation_warnings.append(f"Legacy section '{section}' found, consider migrating to security section")
-    
+                self.validation_warnings.append(
+                    f"Legacy section '{section}' found, consider migrating to security section"
+                )
+
     def _check_configuration_conflicts(self, config: Dict[str, Any]):
         """Check for configuration conflicts."""
         security_config = config.get("security", {})
-        
+
         # Check for SSL configuration conflicts
         if "ssl" in config and "ssl" in security_config:
-            self.validation_warnings.append("SSL configuration found in both root and security sections")
-        
+            self.validation_warnings.append(
+                "SSL configuration found in both root and security sections"
+            )
+
         # Check for auth configuration conflicts
         if "auth_enabled" in config and "auth" in security_config:
-            self.validation_warnings.append("Auth configuration found in both root and security sections")
-    
+            self.validation_warnings.append(
+                "Auth configuration found in both root and security sections"
+            )
+
     def _validate_auth_section(self, config: Dict[str, Any]):
         """Validate authentication section."""
         auth_config = self._get_auth_config(config)
-        
+
         if not isinstance(auth_config, dict):
             self.validation_errors.append("Auth configuration must be a dictionary")
             return
-        
+
         # Validate auth methods
         methods = auth_config.get("methods", [])
         if not isinstance(methods, list):
@@ -218,98 +249,115 @@ class UnifiedConfigAdapter:
             valid_methods = {"api_key", "jwt", "certificate"}
             invalid_methods = set(methods) - valid_methods
             if invalid_methods:
-                self.validation_errors.append(f"Invalid auth methods: {invalid_methods}")
-        
+                self.validation_errors.append(
+                    f"Invalid auth methods: {invalid_methods}"
+                )
+
         # Validate API keys
         api_keys = auth_config.get("api_keys", {})
         if not isinstance(api_keys, dict):
             self.validation_errors.append("API keys must be a dictionary")
-        
+
         # Validate JWT configuration
         if "jwt" in methods:
             jwt_secret = auth_config.get("jwt_secret", "")
             if not jwt_secret:
                 self.validation_warnings.append("JWT secret is empty or not set")
-    
+
     def _validate_ssl_section(self, config: Dict[str, Any]):
         """Validate SSL section."""
         ssl_config = self._get_ssl_config(config)
-        
+
         if not isinstance(ssl_config, dict):
             self.validation_errors.append("SSL configuration must be a dictionary")
             return
-        
+
         # Validate certificate files
         if ssl_config.get("enabled", False):
             cert_file = ssl_config.get("cert_file")
             key_file = ssl_config.get("key_file")
-            
+
             print(f"🔍 Debug: _validate_ssl_section: cert_file={cert_file}")
             print(f"🔍 Debug: _validate_ssl_section: key_file={key_file}")
-            print(f"🔍 Debug: _validate_ssl_section: cert_file exists={Path(cert_file).exists() if cert_file else 'None'}")
-            print(f"🔍 Debug: _validate_ssl_section: key_file exists={Path(key_file).exists() if key_file else 'None'}")
-            
+            print(
+                f"🔍 Debug: _validate_ssl_section: cert_file exists={Path(cert_file).exists() if cert_file else 'None'}"
+            )
+            print(
+                f"🔍 Debug: _validate_ssl_section: key_file exists={Path(key_file).exists() if key_file else 'None'}"
+            )
+
             if cert_file and not Path(cert_file).exists():
-                self.validation_warnings.append(f"SSL certificate file not found: {cert_file}")
-            
+                self.validation_warnings.append(
+                    f"SSL certificate file not found: {cert_file}"
+                )
+
             if key_file and not Path(key_file).exists():
                 self.validation_warnings.append(f"SSL key file not found: {key_file}")
-    
+
     def _validate_permissions_section(self, config: Dict[str, Any]):
         """Validate permissions section."""
         permissions_config = self._get_permissions_config(config)
-        
+
         if not isinstance(permissions_config, dict):
-            self.validation_errors.append("Permissions configuration must be a dictionary")
+            self.validation_errors.append(
+                "Permissions configuration must be a dictionary"
+            )
             return
-        
+
         # Validate roles file
         if permissions_config.get("enabled", False):
             roles_file = permissions_config.get("roles_file")
             if roles_file and not Path(roles_file).exists():
                 self.validation_warnings.append(f"Roles file not found: {roles_file}")
-    
+
     def _validate_rate_limit_section(self, config: Dict[str, Any]):
         """Validate rate limit section."""
         rate_limit_config = self._get_rate_limit_config(config)
-        
+
         if not isinstance(rate_limit_config, dict):
-            self.validation_errors.append("Rate limit configuration must be a dictionary")
+            self.validation_errors.append(
+                "Rate limit configuration must be a dictionary"
+            )
             return
-        
+
         # Validate rate limit values only if enabled
         if rate_limit_config.get("enabled", False):
-            requests_per_minute = rate_limit_config.get("requests_per_minute", rate_limit_config.get("default_requests_per_minute", 0))
+            requests_per_minute = rate_limit_config.get(
+                "requests_per_minute",
+                rate_limit_config.get("default_requests_per_minute", 0),
+            )
             if requests_per_minute <= 0:
-                self.validation_errors.append("requests_per_minute must be greater than 0 when rate limiting is enabled")
-    
+                self.validation_errors.append(
+                    "requests_per_minute must be greater than 0 when rate limiting is enabled"
+                )
+
     def _convert_auth_config(self, config: Dict[str, Any]) -> AuthConfig:
         """Convert authentication configuration."""
         auth_config = self._get_auth_config(config)
-        
+
         # Get authentication methods
         methods = auth_config.get("methods", ["api_key"])
-        
+
         # Get API keys from multiple sources
         api_keys = auth_config.get("api_keys", {})
         if not api_keys:
             # Try legacy SSL config
             legacy_ssl = config.get("ssl", {})
             api_keys = legacy_ssl.get("api_keys", {})
-        
+
         return AuthConfig(
             enabled=auth_config.get("enabled", True),
             methods=methods,
             api_keys=api_keys,
             jwt_secret=auth_config.get("jwt_secret", ""),
             jwt_algorithm=auth_config.get("jwt_algorithm", "HS256"),
-            jwt_expiration=auth_config.get("jwt_expiration", 3600)
+            jwt_expiration=auth_config.get("jwt_expiration", 3600),
         )
-    
+
     def _convert_ssl_config(self, config: Dict[str, Any]) -> SSLConfig:
         """Convert SSL configuration."""
         ssl_config = self._get_ssl_config(config)
-        
+
         return SSLConfig(
             enabled=ssl_config.get("enabled", False),
             cert_file=ssl_config.get("cert_file"),
@@ -318,25 +366,25 @@ class UnifiedConfigAdapter:
             min_tls_version=ssl_config.get("min_tls_version", "TLSv1.2"),
             verify_client=ssl_config.get("verify_client", False),
             client_cert_required=ssl_config.get("client_cert_required", False),
-            cipher_suites=ssl_config.get("cipher_suites", [])
+            cipher_suites=ssl_config.get("cipher_suites", []),
         )
-    
+
     def _convert_permission_config(self, config: Dict[str, Any]) -> PermissionConfig:
         """Convert permissions configuration."""
         permissions_config = self._get_permissions_config(config)
-        
+
         return PermissionConfig(
             enabled=permissions_config.get("enabled", True),
             roles_file=permissions_config.get("roles_file", "roles.json"),
             default_role=permissions_config.get("default_role", "user"),
             deny_by_default=permissions_config.get("deny_by_default", True),
-            role_mappings=permissions_config.get("role_mappings", {})
+            role_mappings=permissions_config.get("role_mappings", {}),
         )
-    
+
     def _convert_rate_limit_config(self, config: Dict[str, Any]) -> RateLimitConfig:
         """Convert rate limit configuration."""
         rate_limit_config = self._get_rate_limit_config(config)
-        
+
         return RateLimitConfig(
             enabled=rate_limit_config.get("enabled", False),
             requests_per_minute=rate_limit_config.get("requests_per_minute", 60),
@@ -347,42 +395,46 @@ class UnifiedConfigAdapter:
             by_user=rate_limit_config.get("by_user", True),
             by_endpoint=rate_limit_config.get("by_endpoint", False),
             exempt_roles=rate_limit_config.get("exempt_roles", []),
-            exempt_endpoints=rate_limit_config.get("exempt_endpoints", [])
+            exempt_endpoints=rate_limit_config.get("exempt_endpoints", []),
         )
-    
+
     def _get_auth_config(self, config: Dict[str, Any]) -> Dict[str, Any]:
         """Get authentication configuration from config."""
         security_config = config.get("security", {})
-        
+
         # Ensure security_config is a dictionary
         if not isinstance(security_config, dict):
             return {}
-        
+
         auth_config = security_config.get("auth", {})
-        
+
         # Handle legacy auth_enabled flag
         if config.get("auth_enabled") is not None:
             auth_config["enabled"] = config["auth_enabled"]
-        
+
         return auth_config
-    
+
     def _get_ssl_config(self, config: Dict[str, Any]) -> Dict[str, Any]:
         """Get SSL configuration from config."""
         security_config = config.get("security", {})
-        
+
         # Ensure security_config is a dictionary
         if not isinstance(security_config, dict):
             return {}
-        
+
         ssl_config = security_config.get("ssl", {})
-        
+
         # Debug: Check SSL config before merging
-        print(f"🔍 Debug: _get_ssl_config: security.ssl key_file={ssl_config.get('key_file')}")
-        
+        print(
+            f"🔍 Debug: _get_ssl_config: security.ssl key_file={ssl_config.get('key_file')}"
+        )
+
         # Merge with legacy SSL config, but prioritize security.ssl over legacy ssl
         legacy_ssl = config.get("ssl", {})
         if legacy_ssl:
-            print(f"🔍 Debug: _get_ssl_config: legacy ssl key_file={legacy_ssl.get('key_file')}")
+            print(
+                f"🔍 Debug: _get_ssl_config: legacy ssl key_file={legacy_ssl.get('key_file')}"
+            )
             # Only merge legacy config if security.ssl is not enabled or missing
             if not ssl_config.get("enabled", False):
                 ssl_config.update(legacy_ssl)
@@ -391,67 +443,61 @@ class UnifiedConfigAdapter:
                 for key, value in legacy_ssl.items():
                     if key not in ssl_config or ssl_config[key] is None:
                         ssl_config[key] = value
-        
+
         print(f"🔍 Debug: _get_ssl_config: final key_file={ssl_config.get('key_file')}")
         return ssl_config
-    
+
     def _get_permissions_config(self, config: Dict[str, Any]) -> Dict[str, Any]:
         """Get permissions configuration from config."""
         security_config = config.get("security", {})
-        
+
         # Ensure security_config is a dictionary
         if not isinstance(security_config, dict):
             return {}
-        
+
         permissions_config = security_config.get("permissions", {})
-        
+
         # Merge with legacy roles config
         legacy_roles = config.get("roles", {})
         if legacy_roles:
             permissions_config.update(legacy_roles)
-        
+
         return permissions_config
-    
+
     def _get_rate_limit_config(self, config: Dict[str, Any]) -> Dict[str, Any]:
         """Get rate limit configuration from config."""
         security_config = config.get("security", {})
-        
+
         # Ensure security_config is a dictionary
         if not isinstance(security_config, dict):
             return {}
-        
+
         rate_limit_config = security_config.get("rate_limit", {})
-        
+
         # Handle legacy rate_limit_enabled flag
         if config.get("rate_limit_enabled") is not None:
             rate_limit_config["enabled"] = config["rate_limit_enabled"]
-        
+
         return rate_limit_config
-    
+
     def get_public_paths(self, config: Dict[str, Any]) -> List[str]:
         """
         Get public paths from configuration.
-        
+
         Args:
             config: Configuration dictionary
-            
+
         Returns:
             List of public paths
         """
         security_config = config.get("security", {})
-        
+
         # Ensure security_config is a dictionary
         if not isinstance(security_config, dict):
-            return [
-                "/health",
-                "/docs",
-                "/redoc",
-                "/openapi.json",
-                "/favicon.ico"
-            ]
-        
+            return ["/health", "/docs", "/redoc", "/openapi.json", "/favicon.ico"]
+
         public_paths = security_config.get("public_paths", [])
-        
+
         # Add default public paths if none specified
         if not public_paths:
             public_paths = [
@@ -459,72 +505,77 @@ class UnifiedConfigAdapter:
                 "/docs",
                 "/redoc",
                 "/openapi.json",
-                "/favicon.ico"
+                "/favicon.ico",
             ]
-        
+
         return public_paths
-    
+
     def get_security_enabled(self, config: Dict[str, Any]) -> bool:
         """
         Check if security is enabled in configuration.
-        
+
         Args:
             config: Configuration dictionary
-            
+
         Returns:
             True if security is enabled
         """
         security_config = config.get("security", {})
-        
+
         # Ensure security_config is a dictionary
         if not isinstance(security_config, dict):
             return True  # Default to enabled for safety
-        
+
         return security_config.get("enabled", True)
-    
+
     def migrate_legacy_config(self, config: Dict[str, Any]) -> Dict[str, Any]:
         """
         Migrate legacy configuration to new format.
-        
+
         Args:
             config: Legacy configuration dictionary
-            
+
         Returns:
             Migrated configuration dictionary
         """
         migrated_config = config.copy()
-        
+
         # Create security section if it doesn't exist
         if "security" not in migrated_config:
             migrated_config["security"] = {}
-        
+
         security_config = migrated_config["security"]
-        
+
         # Migrate SSL configuration
         if "ssl" in migrated_config and "ssl" not in security_config:
             security_config["ssl"] = migrated_config["ssl"]
             # Don't remove legacy SSL yet for backward compatibility
-        
+
         # Migrate roles configuration
         if "roles" in migrated_config and "permissions" not in security_config:
             security_config["permissions"] = migrated_config["roles"]
             # Don't remove legacy roles yet for backward compatibility
-        
+
         # Migrate auth_enabled flag
         if "auth_enabled" in migrated_config and "auth" not in security_config:
             security_config["auth"] = {"enabled": migrated_config["auth_enabled"]}
-        
+
         # Migrate rate_limit_enabled flag
-        if "rate_limit_enabled" in migrated_config and "rate_limit" not in security_config:
-            security_config["rate_limit"] = {"enabled": migrated_config["rate_limit_enabled"]}
-        
+        if (
+            "rate_limit_enabled" in migrated_config
+            and "rate_limit" not in security_config
+        ):
+            security_config["rate_limit"] = {
+                "enabled": migrated_config["rate_limit_enabled"]
+            }
+
         logger.info("Legacy configuration migrated to new format")
         return migrated_config
-    
+
     def get_default_config(self) -> Dict[str, Any]:
         """
         Get default configuration.
-        
+
         Returns:
             Default configuration dictionary
         """
@@ -537,7 +588,7 @@ class UnifiedConfigAdapter:
                     "api_keys": {},
                     "jwt_secret": "",
                     "jwt_algorithm": "HS256",
-                    "jwt_expiration": 3600
+                    "jwt_expiration": 3600,
                 },
                 "ssl": {
                     "enabled": False,
@@ -547,14 +598,14 @@ class UnifiedConfigAdapter:
                     "min_tls_version": "TLSv1.2",
                     "verify_client": False,
                     "client_cert_required": False,
-                    "cipher_suites": []
+                    "cipher_suites": [],
                 },
                 "permissions": {
                     "enabled": True,
                     "roles_file": "roles.json",
                     "default_role": "user",
                     "deny_by_default": True,
-                    "role_mappings": {}
+                    "role_mappings": {},
                 },
                 "rate_limit": {
                     "enabled": True,
@@ -566,14 +617,14 @@ class UnifiedConfigAdapter:
                     "by_user": True,
                     "by_endpoint": False,
                     "exempt_roles": [],
-                    "exempt_endpoints": []
+                    "exempt_endpoints": [],
                 },
                 "public_paths": [
                     "/health",
                     "/docs",
                     "/redoc",
                     "/openapi.json",
-                    "/favicon.ico"
-                ]
+                    "/favicon.ico",
+                ],
             }
         }