solidworks-mcp-python 1.5.0__py3-none-any.whl

solidworks_mcp/exceptions.py

@@ -0,0 +1,37 @@
+"""Custom exceptions for SolidWorks MCP Server."""
+
+
+class SolidWorksMCPError(Exception):
+    """Base exception for SolidWorks MCP Server errors."""
+
+    pass
+
+
+class SolidWorksConnectionError(SolidWorksMCPError):
+    """Exception raised when SolidWorks connection fails."""
+
+    pass
+
+
+class SolidWorksOperationError(SolidWorksMCPError):
+    """Exception raised when SolidWorks operation fails."""
+
+    pass
+
+
+class ConfigurationError(SolidWorksMCPError):
+    """Exception raised for configuration issues."""
+
+    pass
+
+
+class AuthenticationError(SolidWorksMCPError):
+    """Exception raised for authentication failures."""
+
+    pass
+
+
+class RateLimitError(SolidWorksMCPError):
+    """Exception raised when rate limit is exceeded."""
+
+    pass

solidworks_mcp/security/__init__.py

@@ -0,0 +1,68 @@
+"""Security module for SolidWorks MCP Server.
+
+Provides authentication, authorization, and security features based on the configured
+security level.
+"""
+
+from typing import Any
+
+from ..config import SolidWorksMCPConfig
+from .auth import setup_authentication, validate_api_key
+from .cors import setup_cors
+from .rate_limiting import setup_rate_limiting
+from .runtime import SecurityEnforcer
+
+_security_enforcer: SecurityEnforcer | None = None
+
+
+def get_security_enforcer() -> SecurityEnforcer | None:
+    """Return the active runtime security enforcer, if configured.
+
+    Returns:
+        SecurityEnforcer | None: The result produced by the operation.
+    """
+    return _security_enforcer
+
+
+async def setup_security(mcp: Any, config: SolidWorksMCPConfig) -> None:
+    """Configure security middleware based on selected security level.
+
+    Args:
+        mcp (Any): The mcp value.
+        config (SolidWorksMCPConfig): Configuration values for the operation.
+
+    Returns:
+        None: None.
+    """
+    from ..config import SecurityLevel
+
+    if config.security_level == SecurityLevel.MINIMAL:
+        # Local only, minimal security
+        global _security_enforcer
+        _security_enforcer = SecurityEnforcer(config)
+        return
+
+    if config.security_level in [SecurityLevel.STANDARD, SecurityLevel.STRICT]:
+        # Setup API key authentication
+        if config.api_key:
+            setup_authentication(mcp, config)
+
+        # Setup CORS
+        if config.enable_cors:
+            setup_cors(mcp, config)
+
+        # Setup rate limiting
+        if config.enable_rate_limiting:
+            setup_rate_limiting(mcp, config)
+
+    _security_enforcer = SecurityEnforcer(config)
+
+
+__all__ = [
+    "setup_security",
+    "setup_authentication",
+    "validate_api_key",
+    "setup_cors",
+    "setup_rate_limiting",
+    "get_security_enforcer",
+]

solidworks_mcp/security/auth.py

@@ -0,0 +1,128 @@
+"""Authentication and authorization for SolidWorks MCP Server."""
+
+import secrets
+from collections.abc import Awaitable, Callable
+from functools import wraps
+from typing import Any, TypeVar, cast
+
+from ..config import SolidWorksMCPConfig
+
+F = TypeVar("F", bound=Callable[..., Awaitable[Any]])
+
+
+def setup_authentication(mcp: Any, config: SolidWorksMCPConfig) -> None:
+    """Configure authentication middleware hooks.
+
+    Args:
+        mcp (Any): The mcp value.
+        config (SolidWorksMCPConfig): Configuration values for the operation.
+
+    Returns:
+        None: None.
+    """
+    api_key = getattr(config, "api_key", None)
+    api_keys = getattr(config, "api_keys", [])
+    api_key_required = bool(getattr(config, "api_key_required", False))
+    auth_mode = "api_key" if (api_key or api_keys or api_key_required) else "none"
+    try:
+        mcp._security_auth_enabled = True
+        mcp._security_auth_mode = auth_mode
+    except (AttributeError, TypeError):
+        # Some tests intentionally pass plain object() instances without __dict__.
+        return
+
+
+def validate_api_key(provided_key: str, expected_key: str) -> bool:
+    """Validate API key using constant-time comparison.
+
+    Args:
+        provided_key (str): The provided key value.
+        expected_key (str): The expected key value.
+
+    Returns:
+        bool: True if validate api key, otherwise False.
+    """
+    if not provided_key or not expected_key:
+        return False
+
+    return secrets.compare_digest(provided_key, expected_key)
+
+
+def require_auth(config: SolidWorksMCPConfig) -> Callable[[F], F]:
+    """Decorate a coroutine with authentication checks.
+
+    Args:
+        config (SolidWorksMCPConfig): Configuration values for the operation.
+
+    Returns:
+        Callable[[F], F]: The result produced by the operation.
+    """
+
+    def decorator(func: F) -> F:
+        """Wrap a coroutine with request-level authentication checks.
+
+        Args:
+            func (F): The func value.
+
+        Returns:
+            F: The result produced by the operation.
+
+        Raises:
+            RuntimeError: Authentication failed: invalid api_key.
+        """
+
+        @wraps(func)
+        async def wrapper(*args: Any, **kwargs: Any) -> Any:
+            """Run the wrapped coroutine after API key validation.
+
+            Args:
+                *args (Any): Additional positional arguments forwarded to the call.
+                **kwargs (Any): Additional keyword arguments forwarded to the call.
+
+            Returns:
+                Any: The result produced by the operation.
+
+            Raises:
+                RuntimeError: Authentication failed: invalid api_key.
+            """
+            security_level = str(getattr(config, "security_level", "minimal"))
+            if security_level == "minimal":
+                return await func(*args, **kwargs)
+
+            api_key_required = bool(getattr(config, "api_key_required", False))
+            api_key = getattr(config, "api_key", None)
+            api_keys = getattr(config, "api_keys", [])
+            if not (api_key_required or api_key or api_keys):
+                return await func(*args, **kwargs)
+
+            payload = kwargs.get("input_data")
+            if payload is None and args:
+                payload = args[0]
+
+            payload_dict: dict[str, Any] = {}
+            if payload is not None and hasattr(payload, "model_dump"):
+                payload_dict = cast(dict[str, Any], payload.model_dump())
+            elif isinstance(payload, dict):
+                payload_dict = payload
+
+            provided_key_value = payload_dict.get("api_key")
+            provided_key = str(provided_key_value) if provided_key_value else ""
+
+            expected_key = ""
+            if api_key is not None and hasattr(api_key, "get_secret_value"):
+                expected_key = api_key.get_secret_value()
+            elif isinstance(api_key, str):
+                expected_key = api_key
+            elif api_keys:
+                expected_key = api_keys[0]
+
+            if not validate_api_key(
+                provided_key=provided_key, expected_key=expected_key
+            ):
+                raise RuntimeError("authentication failed: invalid api_key")
+
+            return await func(*args, **kwargs)
+
+        return wrapper  # type: ignore[return-value]
+
+    return decorator

solidworks_mcp/security/cors.py

@@ -0,0 +1,27 @@
+"""CORS (Cross-Origin Resource Sharing) configuration for remote deployments."""
+
+from typing import Any
+
+from ..config import SolidWorksMCPConfig
+
+
+def setup_cors(mcp: Any, config: SolidWorksMCPConfig) -> None:
+    """Configure CORS middleware for remote deployments.
+
+    Args:
+        mcp (Any): The mcp value.
+        config (SolidWorksMCPConfig): Configuration values for the operation.
+
+    Returns:
+        None: None.
+    """
+    cors_origins = getattr(config, "cors_origins", [])
+    allowed_origins = getattr(config, "allowed_origins", [])
+    enable_cors = bool(getattr(config, "enable_cors", False))
+    origins = cors_origins or allowed_origins
+    try:
+        mcp._security_cors_enabled = enable_cors
+        mcp._security_cors_origins = list(origins)
+    except (AttributeError, TypeError):
+        # Some tests intentionally pass plain object() instances without __dict__.
+        return

solidworks_mcp/security/rate_limiting.py

@@ -0,0 +1,90 @@
+"""Rate limiting for API endpoints."""
+
+import time
+from collections import defaultdict
+from typing import Any
+
+from ..config import SolidWorksMCPConfig
+
+
+class RateLimiter:
+    """Simple in-memory rate limiter.
+
+    Args:
+        max_requests (int): The max requests value.
+        time_window (int): The time window value. Defaults to 60.
+
+    Attributes:
+        max_requests (Any): The max requests value.
+        time_window (Any): The time window value.
+    """
+
+    def __init__(self, max_requests: int, time_window: int = 60):
+        """Initialize the rate limiter.
+
+        Args:
+            max_requests (int): The max requests value.
+            time_window (int): The time window value. Defaults to 60.
+        """
+        self.max_requests = max_requests
+        self.time_window = time_window
+        self.requests: dict[str, list[float]] = defaultdict(list)
+
+    def is_allowed(self, client_id: str) -> bool:
+        """Check if client is within rate limits.
+
+        Args:
+            client_id (str): The client id value.
+
+        Returns:
+            bool: True if allowed, otherwise False.
+        """
+        now = time.time()
+        window_start = now - self.time_window
+
+        # Remove old requests
+        self.requests[client_id] = [
+            req_time for req_time in self.requests[client_id] if req_time > window_start
+        ]
+
+        # Check if under limit
+        if len(self.requests[client_id]) < self.max_requests:
+            self.requests[client_id].append(now)
+            return True
+
+        return False
+
+
+# Global rate limiter instance
+_rate_limiter: RateLimiter | None = None
+
+
+def setup_rate_limiting(mcp: Any, config: SolidWorksMCPConfig) -> None:
+    """Initialize in-memory rate limiting.
+
+    Args:
+        mcp (Any): The mcp value.
+        config (SolidWorksMCPConfig): Configuration values for the operation.
+
+    Returns:
+        None: None.
+    """
+    global _rate_limiter
+    _rate_limiter = RateLimiter(
+        max_requests=config.rate_limit_per_minute,
+        time_window=60,  # 1 minute
+    )
+
+
+def check_rate_limit(client_id: str) -> bool:
+    """Check if client is within rate limits.
+
+    Args:
+        client_id (str): The client id value.
+
+    Returns:
+        bool: True if check rate limit, otherwise False.
+    """
+    if _rate_limiter is None:
+        return True
+    return _rate_limiter.is_allowed(client_id)

solidworks_mcp/security/runtime.py

@@ -0,0 +1,155 @@
+"""Runtime security enforcement helpers for tool invocations."""
+
+from __future__ import annotations
+
+import secrets
+from dataclasses import dataclass
+from typing import cast
+
+from ..config import SecurityLevel, SolidWorksMCPConfig
+from .auth import validate_api_key
+from .rate_limiting import check_rate_limit
+
+
+class SecurityError(RuntimeError):
+    """Raised when a request violates configured security policies."""
+
+
+@dataclass(frozen=True)
+class SecurityContext:
+    """Extracted invocation security context.
+
+    Attributes:
+        api_key (str | None): The api key value.
+        client_id (str): The client id value.
+    """
+
+    client_id: str
+    api_key: str | None
+
+
+class SecurityEnforcer:
+    """Enforce authentication and rate-limit policies at runtime.
+
+    Args:
+        config (SolidWorksMCPConfig): Configuration values for the operation.
+
+    Attributes:
+        _config (Any): The config value.
+    """
+
+    def __init__(self, config: SolidWorksMCPConfig) -> None:
+        """Initialize the security enforcer.
+
+        Args:
+            config (SolidWorksMCPConfig): Configuration values for the operation.
+
+        Returns:
+            None: None.
+        """
+        self._config = config
+
+    def enforce(self, tool_name: str, payload: object) -> None:
+        """Validate invocation against runtime security policy.
+
+        Args:
+            tool_name (str): The tool name value.
+            payload (object): The payload value.
+
+        Returns:
+            None: None.
+
+        Raises:
+            SecurityError: Authentication failed: invalid api_key.
+        """
+        context = self._extract_context(payload)
+
+        if self._config.enable_rate_limiting and not check_rate_limit(
+            context.client_id
+        ):
+            raise SecurityError(
+                f"rate limit exceeded for client '{context.client_id}' while calling '{tool_name}'"
+            )
+
+        if not self._is_auth_required():
+            return
+
+        expected_key = self._expected_api_key()
+        if not expected_key:
+            raise SecurityError("authentication required but no API key configured")
+
+        provided_key = context.api_key
+        if provided_key is None:
+            raise SecurityError("authentication required but api_key was not provided")
+
+        if not validate_api_key(provided_key=provided_key, expected_key=expected_key):
+            raise SecurityError("authentication failed: invalid api_key")
+
+    def _extract_context(self, payload: object) -> SecurityContext:
+        """Extract client and auth information from payload object.
+
+        Args:
+            payload (object): The payload value.
+
+        Returns:
+            SecurityContext: The result produced by the operation.
+        """
+        if hasattr(payload, "model_dump"):
+            payload_dict = payload.model_dump()
+        elif isinstance(payload, dict):
+            payload_dict = payload
+        else:
+            payload_dict = {}
+
+        client_id_raw = payload_dict.get("client_id", "anonymous")
+        client_id = str(client_id_raw).strip() if client_id_raw else "anonymous"
+
+        api_key_raw = payload_dict.get("api_key")
+        api_key = str(api_key_raw) if api_key_raw is not None else None
+
+        return SecurityContext(client_id=client_id, api_key=api_key)
+
+    def _is_auth_required(self) -> bool:
+        """Return whether API key validation should be enforced.
+
+        Returns:
+            bool: True if auth required, otherwise False.
+        """
+        if bool(getattr(self._config, "api_key_required", False)):
+            return True
+        if getattr(self._config, "security_level", None) == SecurityLevel.STRICT:
+            return True
+        return getattr(self._config, "api_key", None) is not None or bool(
+            getattr(self._config, "api_keys", [])
+        )
+
+    def _expected_api_key(self) -> str | None:
+        """Return configured expected API key for validation.
+
+        Returns:
+            str | None: The result produced by the operation.
+        """
+        api_key = getattr(self._config, "api_key", None)
+        if api_key is not None:
+            get_secret_value = getattr(api_key, "get_secret_value", None)
+            if callable(get_secret_value):
+                return cast("str | None", get_secret_value())
+            return cast(str, api_key)
+
+        api_keys = getattr(self._config, "api_keys", [])
+        if api_keys:
+            return cast("str | None", api_keys[0])
+        return None
+
+
+def constant_time_equals(left: str, right: str) -> bool:
+    """Compare two strings in constant time.
+
+    Args:
+        left (str): The left value.
+        right (str): The right value.
+
+    Returns:
+        bool: True if constant time equals, otherwise False.
+    """
+    return secrets.compare_digest(left, right)