mcp-ticketer 0.1.21__py3-none-any.whl → 0.1.22__py3-none-any.whl

mcp_ticketer/core/config.py

@@ -1,20 +1,22 @@
 """Centralized configuration management with caching and validation."""
 
-import os
 import json
 import logging
-from typing import Dict, Any, Optional, List, Union
-from pathlib import Path
+import os
+from enum import Enum
 from functools import lru_cache
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Union
+
 import yaml
-from pydantic import BaseModel, Field, validator, root_validator
-from enum import Enum
+from pydantic import BaseModel, Field, root_validator, validator
 
 logger = logging.getLogger(__name__)
 
 
 class AdapterType(str, Enum):
     """Supported adapter types."""
+
     GITHUB = "github"
     JIRA = "jira"
     LINEAR = "linear"
@@ -23,6 +25,7 @@ class AdapterType(str, Enum):
 
 class BaseAdapterConfig(BaseModel):
     """Base configuration for all adapters."""
+
     type: AdapterType
     name: Optional[str] = None
     enabled: bool = True
@@ -33,99 +36,104 @@ class BaseAdapterConfig(BaseModel):
 
 class GitHubConfig(BaseAdapterConfig):
     """GitHub adapter configuration."""
+
     type: AdapterType = AdapterType.GITHUB
-    token: Optional[str] = Field(None, env='GITHUB_TOKEN')
-    owner: Optional[str] = Field(None, env='GITHUB_OWNER')
-    repo: Optional[str] = Field(None, env='GITHUB_REPO')
+    token: Optional[str] = Field(None, env="GITHUB_TOKEN")
+    owner: Optional[str] = Field(None, env="GITHUB_OWNER")
+    repo: Optional[str] = Field(None, env="GITHUB_REPO")
     api_url: str = "https://api.github.com"
     use_projects_v2: bool = False
     custom_priority_scheme: Optional[Dict[str, List[str]]] = None
 
-    @validator('token', pre=True, always=True)
+    @validator("token", pre=True, always=True)
     def validate_token(cls, v):
         if not v:
-            v = os.getenv('GITHUB_TOKEN')
+            v = os.getenv("GITHUB_TOKEN")
         if not v:
-            raise ValueError('GitHub token is required')
+            raise ValueError("GitHub token is required")
         return v
 
-    @validator('owner', pre=True, always=True)
+    @validator("owner", pre=True, always=True)
     def validate_owner(cls, v):
         if not v:
-            v = os.getenv('GITHUB_OWNER')
+            v = os.getenv("GITHUB_OWNER")
         if not v:
-            raise ValueError('GitHub owner is required')
+            raise ValueError("GitHub owner is required")
         return v
 
-    @validator('repo', pre=True, always=True)
+    @validator("repo", pre=True, always=True)
     def validate_repo(cls, v):
         if not v:
-            v = os.getenv('GITHUB_REPO')
+            v = os.getenv("GITHUB_REPO")
         if not v:
-            raise ValueError('GitHub repo is required')
+            raise ValueError("GitHub repo is required")
         return v
 
 
 class JiraConfig(BaseAdapterConfig):
     """JIRA adapter configuration."""
+
     type: AdapterType = AdapterType.JIRA
-    server: Optional[str] = Field(None, env='JIRA_SERVER')
-    email: Optional[str] = Field(None, env='JIRA_EMAIL')
-    api_token: Optional[str] = Field(None, env='JIRA_API_TOKEN')
-    project_key: Optional[str] = Field(None, env='JIRA_PROJECT_KEY')
+    server: Optional[str] = Field(None, env="JIRA_SERVER")
+    email: Optional[str] = Field(None, env="JIRA_EMAIL")
+    api_token: Optional[str] = Field(None, env="JIRA_API_TOKEN")
+    project_key: Optional[str] = Field(None, env="JIRA_PROJECT_KEY")
     cloud: bool = True
     verify_ssl: bool = True
 
-    @validator('server', pre=True, always=True)
+    @validator("server", pre=True, always=True)
     def validate_server(cls, v):
         if not v:
-            v = os.getenv('JIRA_SERVER')
+            v = os.getenv("JIRA_SERVER")
         if not v:
-            raise ValueError('JIRA server URL is required')
-        return v.rstrip('/')
+            raise ValueError("JIRA server URL is required")
+        return v.rstrip("/")
 
-    @validator('email', pre=True, always=True)
+    @validator("email", pre=True, always=True)
     def validate_email(cls, v):
         if not v:
-            v = os.getenv('JIRA_EMAIL')
+            v = os.getenv("JIRA_EMAIL")
         if not v:
-            raise ValueError('JIRA email is required')
+            raise ValueError("JIRA email is required")
         return v
 
-    @validator('api_token', pre=True, always=True)
+    @validator("api_token", pre=True, always=True)
     def validate_api_token(cls, v):
         if not v:
-            v = os.getenv('JIRA_API_TOKEN')
+            v = os.getenv("JIRA_API_TOKEN")
         if not v:
-            raise ValueError('JIRA API token is required')
+            raise ValueError("JIRA API token is required")
         return v
 
 
 class LinearConfig(BaseAdapterConfig):
     """Linear adapter configuration."""
+
     type: AdapterType = AdapterType.LINEAR
-    api_key: Optional[str] = Field(None, env='LINEAR_API_KEY')
+    api_key: Optional[str] = Field(None, env="LINEAR_API_KEY")
     workspace: Optional[str] = None
     team_key: str
     api_url: str = "https://api.linear.app/graphql"
 
-    @validator('api_key', pre=True, always=True)
+    @validator("api_key", pre=True, always=True)
     def validate_api_key(cls, v):
         if not v:
-            v = os.getenv('LINEAR_API_KEY')
+            v = os.getenv("LINEAR_API_KEY")
         if not v:
-            raise ValueError('Linear API key is required')
+            raise ValueError("Linear API key is required")
         return v
 
 
 class AITrackdownConfig(BaseAdapterConfig):
     """AITrackdown adapter configuration."""
+
     type: AdapterType = AdapterType.AITRACKDOWN
     # AITrackdown uses local storage, minimal config needed
 
 
 class QueueConfig(BaseModel):
     """Queue configuration."""
+
     provider: str = "sqlite"
     connection_string: Optional[str] = None
     batch_size: int = 10
@@ -136,6 +144,7 @@ class QueueConfig(BaseModel):
 
 class LoggingConfig(BaseModel):
     """Logging configuration."""
+
     level: str = "INFO"
     format: str = "%(asctime)s - %(name)s - %(levelname)s - %(message)s"
     file: Optional[str] = None
@@ -145,25 +154,30 @@ class LoggingConfig(BaseModel):
 
 class AppConfig(BaseModel):
     """Main application configuration."""
-    adapters: Dict[str, Union[GitHubConfig, JiraConfig, LinearConfig, AITrackdownConfig]] = {}
+
+    adapters: Dict[
+        str, Union[GitHubConfig, JiraConfig, LinearConfig, AITrackdownConfig]
+    ] = {}
     queue: QueueConfig = QueueConfig()
     logging: LoggingConfig = LoggingConfig()
     cache_ttl: int = 300  # Cache TTL in seconds
     default_adapter: Optional[str] = None
 
-    @root_validator
+    @root_validator(skip_on_failure=True)
     def validate_adapters(cls, values):
         """Validate adapter configurations."""
-        adapters = values.get('adapters', {})
+        adapters = values.get("adapters", {})
 
         if not adapters:
             logger.warning("No adapters configured")
             return values
 
         # Validate default adapter
-        default_adapter = values.get('default_adapter')
+        default_adapter = values.get("default_adapter")
         if default_adapter and default_adapter not in adapters:
-            raise ValueError(f"Default adapter '{default_adapter}' not found in adapters")
+            raise ValueError(
+                f"Default adapter '{default_adapter}' not found in adapters"
+            )
 
         return values
 
@@ -173,17 +187,19 @@ class AppConfig(BaseModel):
 
     def get_enabled_adapters(self) -> Dict[str, BaseAdapterConfig]:
         """Get all enabled adapters."""
-        return {name: config for name, config in self.adapters.items() if config.enabled}
+        return {
+            name: config for name, config in self.adapters.items() if config.enabled
+        }
 
 
 class ConfigurationManager:
     """Centralized configuration management with caching and validation."""
 
-    _instance: Optional['ConfigurationManager'] = None
+    _instance: Optional["ConfigurationManager"] = None
     _config: Optional[AppConfig] = None
     _config_file_paths: List[Path] = []
 
-    def __new__(cls) -> 'ConfigurationManager':
+    def __new__(cls) -> "ConfigurationManager":
         """Singleton pattern for global config access."""
         if cls._instance is None:
             cls._instance = super().__new__(cls)
@@ -191,26 +207,48 @@ class ConfigurationManager:
 
     def __init__(self):
         """Initialize configuration manager."""
-        if not hasattr(self, '_initialized'):
+        if not hasattr(self, "_initialized"):
             self._initialized = True
             self._config_cache: Dict[str, Any] = {}
             self._find_config_files()
 
     def _find_config_files(self) -> None:
-        """Find configuration files in standard locations."""
+        """Find configuration files in project-local directory ONLY.
+
+        SECURITY: This method ONLY searches in the current project directory
+        to prevent configuration leakage across projects. It will NEVER read
+        from user home directory or system-wide locations.
+        """
+        # ONLY search in current project directory, never external locations
         possible_paths = [
-            Path.cwd() / "mcp-ticketer.yaml",
-            Path.cwd() / "mcp-ticketer.yml",
-            Path.cwd() / "config.yaml",
-            Path.cwd() / "config.yml",
-            Path.home() / ".mcp-ticketer.yaml",
-            Path.home() / ".mcp-ticketer.yml",
-            Path("/etc/mcp-ticketer/config.yaml"),
-            Path("/etc/mcp-ticketer/config.yml"),
+            Path.cwd() / ".mcp-ticketer" / "config.json",  # Primary JSON config
+            Path.cwd() / "mcp-ticketer.yaml",  # Alternative YAML
+            Path.cwd() / "mcp-ticketer.yml",  # Alternative YML
+            Path.cwd() / "config.yaml",  # Generic YAML
+            Path.cwd() / "config.yml",  # Generic YML
         ]
 
-        self._config_file_paths = [path for path in possible_paths if path.exists()]
-        logger.debug(f"Found config files: {self._config_file_paths}")
+        # Validate all paths are within project (security check)
+        validated_paths = []
+        for path in possible_paths:
+            if path.exists():
+                try:
+                    if path.resolve().is_relative_to(Path.cwd().resolve()):
+                        validated_paths.append(path)
+                    else:
+                        logger.warning(
+                            f"Security: Ignoring config file outside project: {path}"
+                        )
+                except (ValueError, RuntimeError):
+                    # is_relative_to may raise ValueError in some cases
+                    # Skip this file if we can't validate it
+                    logger.warning(f"Could not validate config file path: {path}")
+
+        self._config_file_paths = validated_paths
+        if self._config_file_paths:
+            logger.debug(f"Found project-local config files: {self._config_file_paths}")
+        else:
+            logger.debug("No project-local config files found, will use defaults")
 
     @lru_cache(maxsize=1)
     def load_config(self, config_file: Optional[Union[str, Path]] = None) -> AppConfig:
@@ -221,6 +259,7 @@ class ConfigurationManager:
 
         Returns:
             Validated application configuration
+
         """
         if self._config is not None and config_file is None:
             return self._config
@@ -253,7 +292,9 @@ class ConfigurationManager:
                 elif adapter_type == "aitrackdown":
                     parsed_adapters[name] = AITrackdownConfig(**adapter_config)
                 else:
-                    logger.warning(f"Unknown adapter type: {adapter_type} for adapter: {name}")
+                    logger.warning(
+                        f"Unknown adapter type: {adapter_type} for adapter: {name}"
+                    )
 
             config_data["adapters"] = parsed_adapters
 
@@ -264,10 +305,10 @@ class ConfigurationManager:
     def _load_config_file(self, config_path: Path) -> Dict[str, Any]:
         """Load configuration from YAML or JSON file."""
         try:
-            with open(config_path, 'r', encoding='utf-8') as file:
-                if config_path.suffix.lower() in ['.yaml', '.yml']:
+            with open(config_path, encoding="utf-8") as file:
+                if config_path.suffix.lower() in [".yaml", ".yml"]:
                     return yaml.safe_load(file) or {}
-                elif config_path.suffix.lower() == '.json':
+                elif config_path.suffix.lower() == ".json":
                     return json.load(file)
                 else:
                     # Try YAML first, then JSON
@@ -306,7 +347,9 @@ class ConfigurationManager:
         config = self.get_config()
         return config.logging
 
-    def reload_config(self, config_file: Optional[Union[str, Path]] = None) -> AppConfig:
+    def reload_config(
+        self, config_file: Optional[Union[str, Path]] = None
+    ) -> AppConfig:
         """Reload configuration from file."""
         # Clear cache
         self.load_config.cache_clear()
@@ -327,7 +370,7 @@ class ConfigurationManager:
 
         # Parse nested keys like "queue.batch_size"
         config = self.get_config()
-        parts = key.split('.')
+        parts = key.split(".")
         value = config.dict()
 
         for part in parts:
@@ -348,13 +391,13 @@ class ConfigurationManager:
                     "token": "${GITHUB_TOKEN}",
                     "owner": "your-org",
                     "repo": "your-repo",
-                    "enabled": True
+                    "enabled": True,
                 },
                 "linear-dev": {
                     "type": "linear",
                     "api_key": "${LINEAR_API_KEY}",
                     "team_key": "DEV",
-                    "enabled": True
+                    "enabled": True,
                 },
                 "jira-support": {
                     "type": "jira",
@@ -362,23 +405,16 @@ class ConfigurationManager:
                     "email": "${JIRA_EMAIL}",
                     "api_token": "${JIRA_API_TOKEN}",
                     "project_key": "SUPPORT",
-                    "enabled": False
-                }
-            },
-            "queue": {
-                "provider": "sqlite",
-                "batch_size": 10,
-                "max_concurrent": 5
-            },
-            "logging": {
-                "level": "INFO",
-                "file": "mcp-ticketer.log"
+                    "enabled": False,
+                },
             },
-            "default_adapter": "github-main"
+            "queue": {"provider": "sqlite", "batch_size": 10, "max_concurrent": 5},
+            "logging": {"level": "INFO", "file": "mcp-ticketer.log"},
+            "default_adapter": "github-main",
         }
 
         output_path = Path(output_path)
-        with open(output_path, 'w', encoding='utf-8') as file:
+        with open(output_path, "w", encoding="utf-8") as file:
             yaml.dump(sample_config, file, default_flow_style=False, indent=2)
 
         logger.info(f"Sample configuration created at: {output_path}")
@@ -400,4 +436,4 @@ def get_adapter_config(adapter_name: str) -> Optional[BaseAdapterConfig]:
 
 def reload_config(config_file: Optional[Union[str, Path]] = None) -> AppConfig:
     """Reload the global configuration."""
-    return config_manager.reload_config(config_file)
+    return config_manager.reload_config(config_file)

mcp_ticketer/core/env_discovery.py

@@ -8,14 +8,14 @@ environment files, including:
 - Security validation
 """
 
-import os
 import logging
-from pathlib import Path
-from typing import Dict, Any, Optional, List, Tuple
 from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
 from dotenv import dotenv_values
 
-from .project_config import AdapterType, AdapterConfig
+from .project_config import AdapterType
 
 logger = logging.getLogger(__name__)
 
@@ -130,9 +130,7 @@ class DiscoveryResult:
 
         # Sort by: complete configs first, then by confidence
         sorted_adapters = sorted(
-            self.adapters,
-            key=lambda a: (a.is_complete(), a.confidence),
-            reverse=True
+            self.adapters, key=lambda a: (a.is_complete(), a.confidence), reverse=True
         )
         return sorted_adapters[0]
 
@@ -160,6 +158,7 @@ class EnvDiscovery:
 
         Args:
             project_path: Path to project root (defaults to cwd)
+
         """
         self.project_path = project_path or Path.cwd()
 
@@ -168,6 +167,7 @@ class EnvDiscovery:
 
         Returns:
             DiscoveryResult with found adapters and warnings
+
         """
         result = DiscoveryResult()
 
@@ -179,19 +179,27 @@ class EnvDiscovery:
             return result
 
         # Detect adapters
-        linear_adapter = self._detect_linear(env_vars, result.env_files_found[0] if result.env_files_found else ".env")
+        linear_adapter = self._detect_linear(
+            env_vars, result.env_files_found[0] if result.env_files_found else ".env"
+        )
         if linear_adapter:
             result.adapters.append(linear_adapter)
 
-        github_adapter = self._detect_github(env_vars, result.env_files_found[0] if result.env_files_found else ".env")
+        github_adapter = self._detect_github(
+            env_vars, result.env_files_found[0] if result.env_files_found else ".env"
+        )
         if github_adapter:
             result.adapters.append(github_adapter)
 
-        jira_adapter = self._detect_jira(env_vars, result.env_files_found[0] if result.env_files_found else ".env")
+        jira_adapter = self._detect_jira(
+            env_vars, result.env_files_found[0] if result.env_files_found else ".env"
+        )
         if jira_adapter:
             result.adapters.append(jira_adapter)
 
-        aitrackdown_adapter = self._detect_aitrackdown(env_vars, result.env_files_found[0] if result.env_files_found else ".env")
+        aitrackdown_adapter = self._detect_aitrackdown(
+            env_vars, result.env_files_found[0] if result.env_files_found else ".env"
+        )
         if aitrackdown_adapter:
             result.adapters.append(aitrackdown_adapter)
 
@@ -209,6 +217,7 @@ class EnvDiscovery:
 
         Returns:
             Merged dictionary of environment variables
+
         """
         merged_env: Dict[str, str] = {}
 
@@ -229,7 +238,9 @@ class EnvDiscovery:
 
         return merged_env
 
-    def _find_key_value(self, env_vars: Dict[str, str], patterns: List[str]) -> Optional[str]:
+    def _find_key_value(
+        self, env_vars: Dict[str, str], patterns: List[str]
+    ) -> Optional[str]:
         """Find first matching key value from patterns.
 
         Args:
@@ -238,13 +249,16 @@ class EnvDiscovery:
 
         Returns:
             Value if found, None otherwise
+
         """
         for pattern in patterns:
             if pattern in env_vars and env_vars[pattern]:
                 return env_vars[pattern]
         return None
 
-    def _detect_linear(self, env_vars: Dict[str, str], found_in: str) -> Optional[DiscoveredAdapter]:
+    def _detect_linear(
+        self, env_vars: Dict[str, str], found_in: str
+    ) -> Optional[DiscoveredAdapter]:
         """Detect Linear adapter configuration.
 
         Args:
@@ -253,6 +267,7 @@ class EnvDiscovery:
 
         Returns:
             DiscoveredAdapter if Linear config detected, None otherwise
+
         """
         api_key = self._find_key_value(env_vars, LINEAR_KEY_PATTERNS)
 
@@ -289,7 +304,9 @@ class EnvDiscovery:
             found_in=found_in,
         )
 
-    def _detect_github(self, env_vars: Dict[str, str], found_in: str) -> Optional[DiscoveredAdapter]:
+    def _detect_github(
+        self, env_vars: Dict[str, str], found_in: str
+    ) -> Optional[DiscoveredAdapter]:
         """Detect GitHub adapter configuration.
 
         Args:
@@ -298,6 +315,7 @@ class EnvDiscovery:
 
         Returns:
             DiscoveredAdapter if GitHub config detected, None otherwise
+
         """
         token = self._find_key_value(env_vars, GITHUB_TOKEN_PATTERNS)
 
@@ -345,7 +363,9 @@ class EnvDiscovery:
             found_in=found_in,
         )
 
-    def _detect_jira(self, env_vars: Dict[str, str], found_in: str) -> Optional[DiscoveredAdapter]:
+    def _detect_jira(
+        self, env_vars: Dict[str, str], found_in: str
+    ) -> Optional[DiscoveredAdapter]:
         """Detect JIRA adapter configuration.
 
         Args:
@@ -354,6 +374,7 @@ class EnvDiscovery:
 
         Returns:
             DiscoveredAdapter if JIRA config detected, None otherwise
+
         """
         api_token = self._find_key_value(env_vars, JIRA_TOKEN_PATTERNS)
 
@@ -398,7 +419,9 @@ class EnvDiscovery:
             found_in=found_in,
         )
 
-    def _detect_aitrackdown(self, env_vars: Dict[str, str], found_in: str) -> Optional[DiscoveredAdapter]:
+    def _detect_aitrackdown(
+        self, env_vars: Dict[str, str], found_in: str
+    ) -> Optional[DiscoveredAdapter]:
         """Detect AITrackdown adapter configuration.
 
         Args:
@@ -407,6 +430,7 @@ class EnvDiscovery:
 
         Returns:
             DiscoveredAdapter if AITrackdown config detected, None otherwise
+
         """
         base_path = self._find_key_value(env_vars, AITRACKDOWN_PATH_PATTERNS)
 
@@ -440,6 +464,7 @@ class EnvDiscovery:
 
         Returns:
             List of security warnings
+
         """
         warnings: List[str] = []
 
@@ -460,7 +485,7 @@ class EnvDiscovery:
         # Check if .gitignore exists and has .env patterns
         if gitignore_path.exists():
             try:
-                with open(gitignore_path, 'r') as f:
+                with open(gitignore_path) as f:
                     gitignore_content = f.read()
                     if ".env" not in gitignore_content:
                         warnings.append(
@@ -479,6 +504,7 @@ class EnvDiscovery:
 
         Returns:
             True if file is tracked in git, False otherwise
+
         """
         import subprocess
 
@@ -506,6 +532,7 @@ class EnvDiscovery:
 
         Returns:
             List of validation warnings
+
         """
         warnings: List[str] = []
 
@@ -522,12 +549,16 @@ class EnvDiscovery:
 
             # Validate token prefix
             if token and not token.startswith(("ghp_", "gho_", "ghu_", "ghs_", "ghr_")):
-                warnings.append("⚠️  GitHub token doesn't match expected format (should start with ghp_, gho_, etc.)")
+                warnings.append(
+                    "⚠️  GitHub token doesn't match expected format (should start with ghp_, gho_, etc.)"
+                )
 
         elif adapter.adapter_type == AdapterType.JIRA.value:
             server = adapter.config.get("server", "")
             if server and not server.startswith(("http://", "https://")):
-                warnings.append("⚠️  JIRA server URL should start with http:// or https://")
+                warnings.append(
+                    "⚠️  JIRA server URL should start with http:// or https://"
+                )
 
             email = adapter.config.get("email", "")
             if email and "@" not in email:
@@ -550,6 +581,7 @@ def discover_config(project_path: Optional[Path] = None) -> DiscoveryResult:
 
     Returns:
         DiscoveryResult with found adapters and warnings
+
     """
     discovery = EnvDiscovery(project_path)
     return discovery.discover()