mcp-ticketer 0.1.20__py3-none-any.whl → 0.1.22__py3-none-any.whl

mcp_ticketer/cli/utils.py

@@ -2,71 +2,97 @@
 
 import asyncio
 import json
+import logging
 import os
-from typing import Optional, Dict, Any, Callable, TypeVar, List
-from pathlib import Path
 from functools import wraps
+from pathlib import Path
+from typing import Any, Callable, Dict, List, Optional, TypeVar
 
 import typer
 from rich.console import Console
-from rich.table import Table
-from rich.panel import Panel
 from rich.progress import Progress, SpinnerColumn, TextColumn
+from rich.table import Table
 
-from ..core import Task, TicketState, Priority, AdapterRegistry
-from ..core.config import get_config, get_adapter_config
-from ..queue import Queue, WorkerManager, QueueStatus
+from ..core import AdapterRegistry, Priority, Task, TicketState
+from ..queue import Queue, QueueStatus, WorkerManager
 
 # Type variable for async functions
-T = TypeVar('T')
+T = TypeVar("T")
 
 console = Console()
+logger = logging.getLogger(__name__)
 
 
 class CommonPatterns:
     """Common CLI patterns and utilities."""
 
-    # Configuration file management
-    CONFIG_FILE = Path.home() / ".mcp-ticketer" / "config.json"
+    # Configuration file management - PROJECT-LOCAL ONLY
+    CONFIG_FILE = Path.cwd() / ".mcp-ticketer" / "config.json"
 
     @staticmethod
     def load_config() -> dict:
-        """Load configuration from file.
+        """Load configuration from project-local config file ONLY.
+
+        SECURITY: This method ONLY reads from the current project directory
+        to prevent configuration leakage across projects. It will NEVER read
+        from user home directory or system-wide locations.
 
         Resolution order:
         1. Project-specific config (.mcp-ticketer/config.json in cwd)
-        2. Global config (~/.mcp-ticketer/config.json)
+        2. Default to aitrackdown adapter
 
         Returns:
-            Configuration dictionary
+            Configuration dictionary with adapter and config keys.
+            Defaults to aitrackdown if no local config exists.
+
         """
-        # Check project-specific config first
+        # ONLY check project-specific config in current working directory
         project_config = Path.cwd() / ".mcp-ticketer" / "config.json"
         if project_config.exists():
+            # Validate that config file is actually in project directory
             try:
-                with open(project_config, "r") as f:
-                    return json.load(f)
-            except (json.JSONDecodeError, IOError) as e:
-                console.print(f"[yellow]Warning: Could not load project config: {e}[/yellow]")
-                # Fall through to global config
-
-        # Fall back to global config
-        if CommonPatterns.CONFIG_FILE.exists():
-            try:
-                with open(CommonPatterns.CONFIG_FILE, "r") as f:
-                    return json.load(f)
-            except (json.JSONDecodeError, IOError) as e:
-                console.print(f"[yellow]Warning: Could not load global config: {e}[/yellow]")
+                if not project_config.resolve().is_relative_to(Path.cwd().resolve()):
+                    logger.error(
+                        f"Security violation: Config file {project_config} "
+                        "is not within project directory"
+                    )
+                    raise ValueError(
+                        f"Security violation: Config file {project_config} "
+                        "is not within project directory"
+                    )
+            except (ValueError, RuntimeError):
+                # is_relative_to may raise ValueError in some cases
+                pass
 
-        # Default fallback
+            try:
+                with open(project_config) as f:
+                    config = json.load(f)
+                    logger.info(
+                        f"Loaded configuration from project-local: {project_config}"
+                    )
+                    return config
+            except (OSError, json.JSONDecodeError) as e:
+                logger.warning(f"Could not load project config: {e}, using defaults")
+                console.print(
+                    f"[yellow]Warning: Could not load project config: {e}[/yellow]"
+                )
+
+        # Default to aitrackdown with local base path
+        logger.info("No project-local config found, defaulting to aitrackdown adapter")
         return {"adapter": "aitrackdown", "config": {"base_path": ".aitrackdown"}}
 
     @staticmethod
     def save_config(config: dict) -> None:
-        """Save configuration to file."""
-        CommonPatterns.CONFIG_FILE.parent.mkdir(parents=True, exist_ok=True)
-        with open(CommonPatterns.CONFIG_FILE, "w") as f:
+        """Save configuration to project-local config file ONLY.
+
+        SECURITY: This method ONLY saves to the current project directory
+        to prevent configuration leakage across projects.
+        """
+        project_config = Path.cwd() / ".mcp-ticketer" / "config.json"
+        project_config.parent.mkdir(parents=True, exist_ok=True)
+        with open(project_config, "w") as f:
             json.dump(config, f, indent=2)
+        logger.info(f"Saved configuration to project-local: {project_config}")
 
     @staticmethod
     def merge_config(updates: dict) -> dict:
@@ -89,7 +115,9 @@ class CommonPatterns:
         return config
 
     @staticmethod
-    def get_adapter(override_adapter: Optional[str] = None, override_config: Optional[dict] = None):
+    def get_adapter(
+        override_adapter: Optional[str] = None, override_config: Optional[dict] = None
+    ):
         """Get configured adapter instance with environment variable support."""
         config = CommonPatterns.load_config()
 
@@ -141,7 +169,7 @@ class CommonPatterns:
         ticket_data: Dict[str, Any],
         operation: str,
         adapter_name: Optional[str] = None,
-        show_progress: bool = True
+        show_progress: bool = True,
     ) -> str:
         """Queue an operation and optionally start the worker."""
         if not adapter_name:
@@ -151,14 +179,14 @@ class CommonPatterns:
         # Add to queue
         queue = Queue()
         queue_id = queue.add(
-            ticket_data=ticket_data,
-            adapter=adapter_name,
-            operation=operation
+            ticket_data=ticket_data, adapter=adapter_name, operation=operation
         )
 
         if show_progress:
             console.print(f"[green]✓[/green] Queued {operation}: {queue_id}")
-            console.print("[dim]Use 'mcp-ticketer check {queue_id}' to check progress[/dim]")
+            console.print(
+                "[dim]Use 'mcp-ticketer check {queue_id}' to check progress[/dim]"
+            )
 
         # Start worker if needed
         manager = WorkerManager()
@@ -202,7 +230,7 @@ class CommonPatterns:
         console.print(f"Priority: [yellow]{ticket.priority}[/yellow]")
 
         if ticket.description:
-            console.print(f"\n[dim]Description:[/dim]")
+            console.print("\n[dim]Description:[/dim]")
             console.print(ticket.description)
 
         if ticket.tags:
@@ -238,32 +266,41 @@ class CommonPatterns:
         # Show worker status
         worker_status = manager.get_status()
         if worker_status["running"]:
-            console.print(f"\n[green]● Worker is running[/green] (PID: {worker_status.get('pid')})")
+            console.print(
+                f"\n[green]● Worker is running[/green] (PID: {worker_status.get('pid')})"
+            )
         else:
             console.print("\n[red]○ Worker is not running[/red]")
             if pending > 0:
-                console.print("[yellow]Note: There are pending items. Start worker with 'mcp-ticketer queue start'[/yellow]")
+                console.print(
+                    "[yellow]Note: There are pending items. Start worker with 'mcp-ticketer queue start'[/yellow]"
+                )
 
 
 def async_command(f: Callable[..., T]) -> Callable[..., T]:
     """Decorator to handle async CLI commands."""
+
     @wraps(f)
     def wrapper(*args, **kwargs):
         return asyncio.run(f(*args, **kwargs))
+
     return wrapper
 
 
 def with_adapter(f: Callable) -> Callable:
     """Decorator to inject adapter instance into CLI commands."""
+
     @wraps(f)
     def wrapper(adapter: Optional[str] = None, *args, **kwargs):
         adapter_instance = CommonPatterns.get_adapter(override_adapter=adapter)
         return f(adapter_instance, *args, **kwargs)
+
     return wrapper
 
 
 def with_progress(message: str = "Processing..."):
     """Decorator to show progress spinner for long-running operations."""
+
     def decorator(f: Callable) -> Callable:
         @wraps(f)
         def wrapper(*args, **kwargs):
@@ -274,12 +311,15 @@ def with_progress(message: str = "Processing..."):
             ) as progress:
                 progress.add_task(description=message, total=None)
                 return f(*args, **kwargs)
+
         return wrapper
+
     return decorator
 
 
 def validate_required_fields(**field_map):
     """Decorator to validate required fields are provided."""
+
     def decorator(f: Callable) -> Callable:
         @wraps(f)
         def wrapper(*args, **kwargs):
@@ -289,16 +329,21 @@ def validate_required_fields(**field_map):
                     missing_fields.append(display_name)
 
             if missing_fields:
-                console.print(f"[red]Error:[/red] Missing required fields: {', '.join(missing_fields)}")
+                console.print(
+                    f"[red]Error:[/red] Missing required fields: {', '.join(missing_fields)}"
+                )
                 raise typer.Exit(1)
 
             return f(*args, **kwargs)
+
         return wrapper
+
     return decorator
 
 
 def handle_adapter_errors(f: Callable) -> Callable:
     """Decorator to handle common adapter errors gracefully."""
+
     @wraps(f)
     def wrapper(*args, **kwargs):
         try:
@@ -314,6 +359,7 @@ def handle_adapter_errors(f: Callable) -> Callable:
         except Exception as e:
             console.print(f"[red]Unexpected Error:[/red] {e}")
             raise typer.Exit(1)
+
     return wrapper
 
 
@@ -350,7 +396,9 @@ class ConfigValidator:
                 if not config.get(field):
                     env_var = ConfigValidator._get_env_var(adapter_type, field)
                     if env_var and not os.getenv(env_var):
-                        issues.append(f"Missing {display_name} (config.{field} or {env_var})")
+                        issues.append(
+                            f"Missing {display_name} (config.{field} or {env_var})"
+                        )
 
         return issues
 
@@ -358,8 +406,16 @@ class ConfigValidator:
     def _get_env_var(adapter_type: str, field: str) -> Optional[str]:
         """Get corresponding environment variable name for a config field."""
         env_mapping = {
-            "github": {"token": "GITHUB_TOKEN", "owner": "GITHUB_OWNER", "repo": "GITHUB_REPO"},
-            "jira": {"api_token": "JIRA_API_TOKEN", "email": "JIRA_EMAIL", "server": "JIRA_SERVER"},
+            "github": {
+                "token": "GITHUB_TOKEN",
+                "owner": "GITHUB_OWNER",
+                "repo": "GITHUB_REPO",
+            },
+            "jira": {
+                "api_token": "JIRA_API_TOKEN",
+                "email": "JIRA_EMAIL",
+                "server": "JIRA_SERVER",
+            },
             "linear": {"api_key": "LINEAR_API_KEY"},
         }
         return env_mapping.get(adapter_type, {}).get(field)
@@ -406,7 +462,9 @@ class CommandBuilder:
         default_adapter = config.get("default_adapter", "aitrackdown")
         adapter_config = config.get("adapters", {}).get(default_adapter, {})
 
-        issues = ConfigValidator.validate_adapter_config(default_adapter, adapter_config)
+        issues = ConfigValidator.validate_adapter_config(
+            default_adapter, adapter_config
+        )
         if issues:
             console.print("[red]Configuration Issues:[/red]")
             for issue in issues:
@@ -417,6 +475,7 @@ class CommandBuilder:
 
 def create_standard_ticket_command(operation: str):
     """Create a standard ticket operation command."""
+
     def command_template(
         ticket_id: Optional[str] = None,
         title: Optional[str] = None,
@@ -437,9 +496,11 @@ def create_standard_ticket_command(operation: str):
         if description:
             ticket_data["description"] = description
         if priority:
-            ticket_data["priority"] = priority.value if hasattr(priority, 'value') else priority
+            ticket_data["priority"] = (
+                priority.value if hasattr(priority, "value") else priority
+            )
         if state:
-            ticket_data["state"] = state.value if hasattr(state, 'value') else state
+            ticket_data["state"] = state.value if hasattr(state, "value") else state
         if assignee:
             ticket_data["assignee"] = assignee
         if tags:
@@ -466,7 +527,7 @@ class TicketCommands:
         adapter_instance,
         state: Optional[TicketState] = None,
         priority: Optional[Priority] = None,
-        limit: int = 10
+        limit: int = 10,
     ):
         """List tickets with filters."""
         filters = {}
@@ -482,9 +543,7 @@ class TicketCommands:
     @async_command
     @handle_adapter_errors
     async def show_ticket(
-        adapter_instance,
-        ticket_id: str,
-        show_comments: bool = False
+        adapter_instance, ticket_id: str, show_comments: bool = False
     ):
         """Show ticket details."""
         ticket = await adapter_instance.read(ticket_id)
@@ -505,7 +564,7 @@ class TicketCommands:
         priority: Priority = Priority.MEDIUM,
         tags: Optional[List[str]] = None,
         assignee: Optional[str] = None,
-        adapter: Optional[str] = None
+        adapter: Optional[str] = None,
     ) -> str:
         """Create a new ticket."""
         ticket_data = {
@@ -520,9 +579,7 @@ class TicketCommands:
 
     @staticmethod
     def update_ticket(
-        ticket_id: str,
-        updates: Dict[str, Any],
-        adapter: Optional[str] = None
+        ticket_id: str, updates: Dict[str, Any], adapter: Optional[str] = None
     ) -> str:
         """Update a ticket."""
         if not updates:
@@ -534,14 +591,12 @@ class TicketCommands:
 
     @staticmethod
     def transition_ticket(
-        ticket_id: str,
-        state: TicketState,
-        adapter: Optional[str] = None
+        ticket_id: str, state: TicketState, adapter: Optional[str] = None
     ) -> str:
         """Transition ticket state."""
         ticket_data = {
             "ticket_id": ticket_id,
-            "state": state.value if hasattr(state, 'value') else state
+            "state": state.value if hasattr(state, "value") else state,
         }
 
-        return CommonPatterns.queue_operation(ticket_data, "transition", adapter)
+        return CommonPatterns.queue_operation(ticket_data, "transition", adapter)

mcp_ticketer/core/__init__.py

@@ -1,7 +1,7 @@
 """Core models and abstractions for MCP Ticketer."""
 
-from .models import Epic, Task, Comment, TicketState, Priority, TicketType
 from .adapter import BaseAdapter
+from .models import Comment, Epic, Priority, Task, TicketState, TicketType
 from .registry import AdapterRegistry
 
 __all__ = [
@@ -13,4 +13,4 @@ __all__ = [
     "TicketType",
     "BaseAdapter",
     "AdapterRegistry",
-]
+]

mcp_ticketer/core/adapter.py

@@ -1,8 +1,9 @@
 """Base adapter abstract class for ticket systems."""
 
 from abc import ABC, abstractmethod
-from typing import List, Optional, Dict, Any, TypeVar, Generic, Union
-from .models import Epic, Task, Comment, SearchQuery, TicketState, TicketType
+from typing import Any, Dict, Generic, List, Optional, TypeVar
+
+from .models import Comment, Epic, SearchQuery, Task, TicketState, TicketType
 
 # Generic type for tickets
 T = TypeVar("T", Epic, Task)
@@ -16,6 +17,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Args:
             config: Adapter-specific configuration dictionary
+
         """
         self.config = config
         self._state_mapping = self._get_state_mapping()
@@ -26,6 +28,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Dictionary mapping TicketState to system-specific state strings
+
         """
         pass
 
@@ -35,6 +38,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             (is_valid, error_message) - Tuple of validation result and error message
+
         """
         pass
 
@@ -47,6 +51,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Created ticket with ID populated
+
         """
         pass
 
@@ -59,6 +64,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Ticket if found, None otherwise
+
         """
         pass
 
@@ -72,6 +78,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Updated ticket if successful, None otherwise
+
         """
         pass
 
@@ -84,15 +91,13 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             True if deleted, False otherwise
+
         """
         pass
 
     @abstractmethod
     async def list(
-        self,
-        limit: int = 10,
-        offset: int = 0,
-        filters: Optional[Dict[str, Any]] = None
+        self, limit: int = 10, offset: int = 0, filters: Optional[Dict[str, Any]] = None
     ) -> List[T]:
         """List tickets with pagination and filters.
 
@@ -103,6 +108,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             List of tickets matching criteria
+
         """
         pass
 
@@ -115,14 +121,13 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             List of tickets matching search criteria
+
         """
         pass
 
     @abstractmethod
     async def transition_state(
-        self,
-        ticket_id: str,
-        target_state: TicketState
+        self, ticket_id: str, target_state: TicketState
     ) -> Optional[T]:
         """Transition ticket to a new state.
 
@@ -132,6 +137,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Updated ticket if transition successful, None otherwise
+
         """
         pass
 
@@ -144,15 +150,13 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Created comment with ID populated
+
         """
         pass
 
     @abstractmethod
     async def get_comments(
-        self,
-        ticket_id: str,
-        limit: int = 10,
-        offset: int = 0
+        self, ticket_id: str, limit: int = 10, offset: int = 0
     ) -> List[Comment]:
         """Get comments for a ticket.
 
@@ -163,6 +167,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             List of comments for the ticket
+
         """
         pass
 
@@ -174,6 +179,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             System-specific state string
+
         """
         return self._state_mapping.get(state, state.value)
 
@@ -185,14 +191,13 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Universal ticket state
+
         """
         reverse_mapping = {v: k for k, v in self._state_mapping.items()}
         return reverse_mapping.get(system_state, TicketState.OPEN)
 
     async def validate_transition(
-        self,
-        ticket_id: str,
-        target_state: TicketState
+        self, ticket_id: str, target_state: TicketState
     ) -> bool:
         """Validate if state transition is allowed.
 
@@ -202,6 +207,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             True if transition is valid
+
         """
         ticket = await self.read(ticket_id)
         if not ticket:
@@ -218,10 +224,7 @@ class BaseAdapter(ABC, Generic[T]):
     # Epic/Issue/Task Hierarchy Methods
 
     async def create_epic(
-        self,
-        title: str,
-        description: Optional[str] = None,
-        **kwargs
+        self, title: str, description: Optional[str] = None, **kwargs
     ) -> Optional[Epic]:
         """Create epic (top-level grouping).
 
@@ -232,12 +235,13 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Created epic or None if failed
+
         """
         epic = Epic(
             title=title,
             description=description,
             ticket_type=TicketType.EPIC,
-            **{k: v for k, v in kwargs.items() if k in Epic.__fields__}
+            **{k: v for k, v in kwargs.items() if k in Epic.__fields__},
         )
         result = await self.create(epic)
         if isinstance(result, Epic):
@@ -252,6 +256,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Epic if found, None otherwise
+
         """
         # Default implementation - subclasses should override for platform-specific logic
         result = await self.read(epic_id)
@@ -267,6 +272,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             List of epics
+
         """
         # Default implementation - subclasses should override
         filters = kwargs.copy()
@@ -279,7 +285,7 @@ class BaseAdapter(ABC, Generic[T]):
         title: str,
         description: Optional[str] = None,
         epic_id: Optional[str] = None,
-        **kwargs
+        **kwargs,
     ) -> Optional[Task]:
         """Create issue, optionally linked to epic.
 
@@ -291,13 +297,14 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             Created issue or None if failed
+
         """
         task = Task(
             title=title,
             description=description,
             ticket_type=TicketType.ISSUE,
             parent_epic=epic_id,
-            **{k: v for k, v in kwargs.items() if k in Task.__fields__}
+            **{k: v for k, v in kwargs.items() if k in Task.__fields__},
         )
         return await self.create(task)
 
@@ -309,6 +316,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             List of issues belonging to epic
+
         """
         # Default implementation - subclasses should override for efficiency
         filters = {"parent_epic": epic_id, "ticket_type": TicketType.ISSUE}
@@ -316,11 +324,7 @@ class BaseAdapter(ABC, Generic[T]):
         return [r for r in results if isinstance(r, Task) and r.is_issue()]
 
     async def create_task(
-        self,
-        title: str,
-        parent_id: str,
-        description: Optional[str] = None,
-        **kwargs
+        self, title: str, parent_id: str, description: Optional[str] = None, **kwargs
     ) -> Optional[Task]:
         """Create task as sub-ticket of parent issue.
 
@@ -335,6 +339,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Raises:
             ValueError: If parent_id is not provided
+
         """
         if not parent_id:
             raise ValueError("Tasks must have a parent_id (issue)")
@@ -344,7 +349,7 @@ class BaseAdapter(ABC, Generic[T]):
             description=description,
             ticket_type=TicketType.TASK,
             parent_issue=parent_id,
-            **{k: v for k, v in kwargs.items() if k in Task.__fields__}
+            **{k: v for k, v in kwargs.items() if k in Task.__fields__},
         )
 
         # Validate hierarchy before creating
@@ -362,6 +367,7 @@ class BaseAdapter(ABC, Generic[T]):
 
         Returns:
             List of tasks belonging to issue
+
         """
         # Default implementation - subclasses should override for efficiency
         filters = {"parent_issue": issue_id, "ticket_type": TicketType.TASK}
@@ -370,4 +376,4 @@ class BaseAdapter(ABC, Generic[T]):
 
     async def close(self) -> None:
         """Close adapter and cleanup resources."""
-        pass
+        pass