nextcloud-agent 2.4.0__tar.gz → 2.4.2__tar.gz

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nextcloud-agent
-Version: 2.4.0
+Version: 2.4.2
 Summary: Nextcloud MCP Server for Agentic AI!
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/nextcloud_agent/__init__.py

@@ -1,11 +1,11 @@
 from scion_sdk.connector import Connector
 
 from nextcloud_agent.api_client import NextcloudAPI
-from nextcloud_agent.auth import get_client
+from nextcloud_agent.auth import make_client
 
 connector = Connector(
     api=NextcloudAPI,
-    get_client=get_client,
+    get_client=make_client,
     tools="nextcloud_agent.mcp_server",
     instructions="nextcloud-agent MCP Server — Condensed Action-Routed Tools.",
 )

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/nextcloud_agent/api/api_client_base.py

@@ -33,6 +33,12 @@ class _StreamedResponse(Protocol):
     def close(self) -> Any: ...
 
 
+def _allowed_private_hosts() -> set[str]:
+    """Hosts the operator admits for private addresses and plain http (R002)."""
+    raw = setting("NEXTCLOUD_ALLOWED_PRIVATE_HOSTS", "")
+    return {host.lower().rstrip(".") for host in csv_values(raw)}
+
+
 def _origin(url: str, *, require_clean_base: bool = False) -> tuple[str, str, int]:
     try:
         parsed = urlsplit(url)
@@ -57,8 +63,11 @@ def _origin(url: str, *, require_clean_base: bool = False) -> tuple[str, str, in
             loopback = ipaddress.ip_address(host).is_loopback
         except ValueError:
             loopback = host == "localhost"
-        if not loopback:
-            raise ValueError("unencrypted service URL is restricted to loopback")
+        if not loopback and host not in _allowed_private_hosts():
+            raise ValueError(
+                "unencrypted service URL is restricted to loopback and "
+                "NEXTCLOUD_ALLOWED_PRIVATE_HOSTS"
+            )
     return scheme, host, port
 
 
@@ -169,7 +178,7 @@ class BaseApiClient:
     def files_dav(self) -> WebDavBackend:
         """The SDK WebDAV backend on the files root (CONN-NEXTCLOUD-AGENT-R002)."""
         if self._files_dav is None:
-            hosts = tuple(csv_values(setting("NEXTCLOUD_ALLOWED_PRIVATE_HOSTS", "")))
+            hosts = tuple(sorted(_allowed_private_hosts()))
             self._files_dav = WebDavBackend(
                 self.webdav_base,
                 username=self.username,

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/nextcloud_agent/auth.py

@@ -8,19 +8,16 @@ from nextcloud_agent.api_client import NextcloudAPI
 logger = logging.getLogger(__name__)
 
 
-def get_client(
+def make_client(
     base_url: str | None = None,
     username: str | None = None,
     password: str | None = None,
-):
-    """
-    Yield a NextcloudAPI client and close it afterwards.
+) -> NextcloudAPI:
+    """Build one NextcloudAPI client from arguments or the connector settings.
 
-    A plain generator, because FastMCP's ``Depends`` drives generator
-    dependencies itself; wrapping it in ``contextlib.contextmanager`` handed
-    every tool the context-manager object instead of the client.
-
-    CONCEPT:AU-OS.config.secrets-authentication
+    The SDK per-operation tools call this factory once per call
+    (CONN-NEXTCLOUD-AGENT-R002); ``get_client`` wraps it as a FastMCP
+    generator dependency that also closes the client.
     """
     if not base_url:
         base_url = setting("NEXTCLOUD_URL", None)
@@ -32,15 +29,31 @@ def get_client(
         raise ValueError(
             "Nextcloud URL, username, and password must be provided via arguments or environment variables."
         )
-
     try:
-        client = NextcloudAPI(base_url=base_url, username=username, password=password)
+        return NextcloudAPI(base_url=base_url, username=username, password=password)
     except (AuthError, UnauthorizedError) as e:
         raise RuntimeError(
             "AUTHENTICATION ERROR: The configured credentials were rejected. "
             f"Please check your NEXTCLOUD_USERNAME and NEXTCLOUD_PASSWORD environment variables. "
             f"Error details: {type(e).__name__}"
         ) from e
+
+
+def get_client(
+    base_url: str | None = None,
+    username: str | None = None,
+    password: str | None = None,
+):
+    """
+    Yield a NextcloudAPI client and close it afterwards.
+
+    A plain generator, because FastMCP's ``Depends`` drives generator
+    dependencies itself; wrapping it in ``contextlib.contextmanager`` handed
+    every tool the context-manager object instead of the client.
+
+    CONCEPT:AU-OS.config.secrets-authentication
+    """
+    client = make_client(base_url=base_url, username=username, password=password)
     try:
         yield client
     finally:

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/nextcloud_agent/ontology/certification.json

@@ -29,5 +29,5 @@
   "signer": "UNSIGNED-PREVIEW",
   "signing_public_key": "",
   "status": "source-validated",
-  "validated_at": "2026-11-05T11:12:30Z"
+  "validated_at": "2026-11-05T12:20:44Z"
 }

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/nextcloud_agent.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nextcloud-agent
-Version: 2.4.0
+Version: 2.4.2
 Summary: Nextcloud MCP Server for Agentic AI!
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "nextcloud-agent"
-version = "2.4.0"
+version = "2.4.2"
 description = "Nextcloud MCP Server for Agentic AI!"
 readme = "README.md"
 classifiers = [ "Development Status :: 3 - Alpha", "License :: OSI Approved :: MIT License", "Environment :: Console", "Operating System :: POSIX :: Linux", "Programming Language :: Python :: 3",]

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/tests/test_auth.py

@@ -75,3 +75,20 @@ def test_get_client_is_a_generator_dependency_that_yields_the_client():
     assert client.base_url == "https://x.test"
     assert not hasattr(client, "__enter__") or hasattr(client, "get_user_info")
     gen.close()
+
+
+@pytest.mark.spec("CONN-NEXTCLOUD-AGENT-R002")
+async def test_per_operation_tools_resolve_a_client_not_a_generator(monkeypatch):
+    """The SDK per-operation tools call ``connector.get_client()`` directly."""
+    from scion_sdk.mcp._method_invoke import _resolve_client
+
+    from nextcloud_agent import connector
+
+    monkeypatch.setenv("NEXTCLOUD_URL", "https://cloud.example")
+    monkeypatch.setenv("NEXTCLOUD_USERNAME", "svc")
+    monkeypatch.setenv("NEXTCLOUD_PASSWORD", "pw")
+    client = await _resolve_client(connector.get_client)
+    try:
+        assert callable(client.list_files)
+    finally:
+        client.close()

{nextcloud_agent-2.4.0 → nextcloud_agent-2.4.2}/tests/test_files_webdav.py

@@ -143,3 +143,13 @@ def test_sdk_pin_carries_storage_backend():
     from scion_sdk.storage import WebDavBackend as Backend
 
     assert Backend.backend_type == "webdav"
+
+
+@pytest.mark.spec("CONN-NEXTCLOUD-AGENT-R002")
+def test_plain_http_is_admitted_only_for_listed_hosts(monkeypatch):
+    monkeypatch.delenv("NEXTCLOUD_ALLOWED_PRIVATE_HOSTS", raising=False)
+    with pytest.raises(ValueError, match="restricted to loopback"):
+        NextcloudAPI(base_url="http://files.example", username="svc", password="pw")
+    monkeypatch.setenv("NEXTCLOUD_ALLOWED_PRIVATE_HOSTS", "files.example")
+    client = NextcloudAPI(base_url="http://files.example", username="svc", password="pw")
+    assert client.files_dav.backend_type == "webdav"