mirror of
https://github.com/Sea-Haven-Industries/sh-mcp.git
synced 2026-10-05 11:52:02 +00:00
Some checks are pending
deploy / deploy (push) Waiting to run
* Add shared transport: dispatch, MCP + OpenAPI adapters, local auth
Add the single authoritative tool-execution path (executeTool) plus the two
universal interfaces over it (design.md §2.5, §7.3):
- dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance
egress redaction (redactDeep), and structured audit emission on one path.
- audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions.
- mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and
tools/call routed through executeTool.
- http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz.
- openapi.ts: buildOpenApiDocument wraps the existing path generator into a full
OpenAPI 3.1 document.
- local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct
outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6).
* Add in-memory dev clients; make package tool exports lazy
Add an in-memory Client implementation per integration package (seeded fake
data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/
tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking
fields so the redaction egress path has real targets to mask.
Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools)
so importing a package barrel no longer constructs an AWS client at module load
(build-plan §7 'no I/O at import time') — the previous eager construction broke
server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations
resolve under dist/index.d.ts like the other 8 packages.
* Add runnable sh-mcp-ops and sh-mcp-finance servers
Two thin composition-root servers over the shared transport (design.md §3):
- ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks,
reminders. finance: qbo, payments (audited + redacted on egress).
- config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects
LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs
(aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5).
- index.ts is the only place .listen() is called; a Lambda handler placeholder
is exported but not depended on.
- synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app
(build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector.
* Add security-weighted test suite + coverage gate; wire tooling
Add tests for the highest-risk surface (build-plan §5, design.md §7.3):
tool-hiding, server-side scope enforcement (incl. forced hidden calls),
audience binding, input-schema validation, finance redaction on egress, audit
emission with hashed args, prompt-injection regression (tool output is data),
rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1
validity, and local-auth safety. Add HTTP integration tests (supertest) for both
servers and per-package dev-client tests. 405 tests pass.
Wire the coverage gate into vitest.config.ts: 80% overall, with per-file
thresholds on the auth + dispatch crown jewels; exclude deferred real client
stubs, entrypoints, cdk apps, and aws-only config from the gate (documented).
Extend eslint flat config + add .prettierignore to cover servers/. Commit the
updated package-lock.json.
* Suppress pre-existing dev-tooling + out-of-scope scanner findings
Add written-justification suppressions for the 4 confirmed crit/high pre-push
scanner findings, none of which are in this PR's Phase 1 production code:
- npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never
run in the deployed server/Lambda runtime (pins carried from Phase 0b;
Dependabot will bump).
- gitleaks docs/agentforce-plan.md secret: that file is not on this branch and
not in this changeset; flagged for the maintainer to scrub on its own branch.
The deep agentic /sh-security-review (required for this auth/authz-touching PR)
was NOT run by the agent and is flagged outstanding in the PR body.
* Address CodeQL findings: bound ajv error work + edge rate limiting
GHAS code-scanning alerts on this PR:
- dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on
untrusted input, letting a crafted payload force unbounded error
enumeration. Switch to allErrors:false (default) so validation
short-circuits on the first failure; the 400 still names that path.
- http.ts (js/missing-rate-limiting): the authenticated routes (/mcp,
/tools/:name) had no edge throttle — auth/JWT verification ran on every
request before the per-sub dispatch limiter could apply. Add an IP-keyed
express-rate-limit in front of authenticate (120/60s default, configurable),
returning the standard 429 shape. Defense-in-depth over the per-sub +
per-tool limiter in executeTool; API GW/WAF remains the production edge.
Tests: +2 cases proving the edge limiter throttles before auth (429, not
401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean.
* Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos)
extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space,
so the two quantifiers overlap and a crafted header can drive polynomial
backtracking. Require the capture to start with a non-whitespace char
(/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is
unchanged for real tokens; +2 regression tests.
* Harden auth + finance redaction (sh-security-review confirmed mediums)
Two confirmed medium findings from the agentic security review:
- Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset,
so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider
and accept static dev bearer tokens (dev-finance-admin -> finance:admin).
Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the
server refuses to start. Plus an independent guard in LocalAuthProvider
that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME /
AWS_EXECUTION_ENV present), regardless of the env flag.
- Finance egress redaction gap: redactDeep only wholesale-masked a sensitive
key when its value was a scalar; an object/array under a sensitive key was
recursed into, letting a bare nested value (e.g. {account:{number:...}})
escape the keyword-gated pattern matcher. Now the entire subtree under a
sensitive key is masked. No current finance tool emitted such shapes (all
flat strings), so this closes a latent hole in the universal safety net.
+4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green.
Review also produced lows (memo free-text digits, unsalted argsHash,
unauth /openapi.json by-design, session-cap no-reset by-design) tracked
separately; 0 confirmed critical/high — review verdict PASS.
164 lines
5.1 KiB
TypeScript
164 lines
5.1 KiB
TypeScript
/**
|
|
* InMemoryCalendarClient — deterministic in-memory CalendarClient for local dev.
|
|
*
|
|
* Implements the same CalendarClient interface as GoogleCalendarClient but holds
|
|
* a small set of FAKE seed events in memory, partitioned by userSub so a user
|
|
* only ever sees their own calendar. No network, no AWS, no token provider.
|
|
*
|
|
* This is for build-plan §4 "in-memory dev clients (tools return real data
|
|
* locally)" — wire it into a dev server instead of GoogleCalendarClient.
|
|
*/
|
|
|
|
import type {
|
|
AvailabilityResult,
|
|
CalendarClient,
|
|
CalendarEvent,
|
|
CheckAvailabilityOptions,
|
|
CreateEventOptions,
|
|
GetEventsOptions,
|
|
} from './client.js';
|
|
|
|
/** Seed events keyed by userSub. Each user sees only their own list. */
|
|
function seedEvents(): Map<string, CalendarEvent[]> {
|
|
const map = new Map<string, CalendarEvent[]>();
|
|
|
|
map.set('lauren@seahavenind.com', [
|
|
{
|
|
id: 'evt-lauren-001',
|
|
summary: 'Vendor onboarding sync',
|
|
description: 'Walk through the new vendor intake checklist.',
|
|
start: '2026-06-25T15:00:00Z',
|
|
end: '2026-06-25T15:30:00Z',
|
|
attendees: [
|
|
{
|
|
email: 'lauren@seahavenind.com',
|
|
responseStatus: 'accepted',
|
|
self: true,
|
|
organizer: true,
|
|
},
|
|
{ email: 'adam@seahavenind.com', responseStatus: 'accepted' },
|
|
],
|
|
hasExternalAttendees: false,
|
|
status: 'confirmed',
|
|
htmlLink: 'https://calendar.google.com/event?eid=evt-lauren-001',
|
|
},
|
|
{
|
|
id: 'evt-lauren-002',
|
|
summary: 'Site walkthrough — Marina pier',
|
|
start: '2026-06-26T13:00:00Z',
|
|
end: '2026-06-26T14:00:00Z',
|
|
attendees: [
|
|
{
|
|
email: 'lauren@seahavenind.com',
|
|
responseStatus: 'accepted',
|
|
self: true,
|
|
organizer: true,
|
|
},
|
|
{ email: 'contractor@example.com', responseStatus: 'needsAction' },
|
|
],
|
|
hasExternalAttendees: true,
|
|
status: 'confirmed',
|
|
},
|
|
]);
|
|
|
|
map.set('adam@seahavenind.com', [
|
|
{
|
|
id: 'evt-adam-001',
|
|
summary: 'Quarterly finance review',
|
|
description: 'Review payment dashboard and QBO vendor balances.',
|
|
start: '2026-06-24T17:00:00Z',
|
|
end: '2026-06-24T18:00:00Z',
|
|
attendees: [
|
|
{ email: 'adam@seahavenind.com', responseStatus: 'accepted', self: true, organizer: true },
|
|
{ email: 'lauren@seahavenind.com', responseStatus: 'tentative' },
|
|
],
|
|
hasExternalAttendees: false,
|
|
status: 'confirmed',
|
|
},
|
|
]);
|
|
|
|
return map;
|
|
}
|
|
|
|
/**
|
|
* In-memory CalendarClient. Events are partitioned by userSub; createEvent
|
|
* appends to the caller's own list and returns the created event.
|
|
*/
|
|
export class InMemoryCalendarClient implements CalendarClient {
|
|
private readonly eventsBySub: Map<string, CalendarEvent[]>;
|
|
private counter = 1000;
|
|
|
|
constructor() {
|
|
this.eventsBySub = seedEvents();
|
|
}
|
|
|
|
async getEvents(userSub: string, opts: GetEventsOptions): Promise<CalendarEvent[]> {
|
|
const all = this.eventsBySub.get(userSub) ?? [];
|
|
const min = Date.parse(opts.timeMin);
|
|
const max = Date.parse(opts.timeMax);
|
|
const inWindow = all.filter((e) => {
|
|
const start = Date.parse(e.start);
|
|
return start >= min && start <= max;
|
|
});
|
|
const limit = opts.maxResults ?? 50;
|
|
return inWindow.slice(0, limit);
|
|
}
|
|
|
|
async checkAvailability(
|
|
userSub: string,
|
|
opts: CheckAvailabilityOptions,
|
|
): Promise<AvailabilityResult> {
|
|
const min = Date.parse(opts.timeMin);
|
|
const max = Date.parse(opts.timeMax);
|
|
const all = this.eventsBySub.get(userSub) ?? [];
|
|
|
|
const busy = all
|
|
.filter((e) => Date.parse(e.start) < max && Date.parse(e.end) > min)
|
|
.map((e) => ({ start: e.start, end: e.end }))
|
|
.sort((a, b) => Date.parse(a.start) - Date.parse(b.start));
|
|
|
|
const free: Array<{ start: string; end: string }> = [];
|
|
let cursor = min;
|
|
for (const slot of busy) {
|
|
const slotStart = Date.parse(slot.start);
|
|
if (slotStart > cursor) {
|
|
free.push({
|
|
start: new Date(cursor).toISOString(),
|
|
end: new Date(slotStart).toISOString(),
|
|
});
|
|
}
|
|
cursor = Math.max(cursor, Date.parse(slot.end));
|
|
}
|
|
if (cursor < max) {
|
|
free.push({ start: new Date(cursor).toISOString(), end: new Date(max).toISOString() });
|
|
}
|
|
|
|
return { busy, free };
|
|
}
|
|
|
|
async createEvent(userSub: string, opts: CreateEventOptions): Promise<CalendarEvent> {
|
|
const event: CalendarEvent = {
|
|
id: `evt-dev-${this.counter++}`,
|
|
summary: opts.summary,
|
|
start: opts.start,
|
|
end: opts.end,
|
|
status: 'confirmed',
|
|
htmlLink: `https://calendar.google.com/event?eid=evt-dev-${this.counter}`,
|
|
};
|
|
if (opts.description !== undefined) {
|
|
event.description = opts.description;
|
|
}
|
|
if (opts.attendees !== undefined) {
|
|
event.attendees = opts.attendees.map((a) =>
|
|
a.displayName !== undefined
|
|
? { email: a.email, displayName: a.displayName, responseStatus: 'needsAction' }
|
|
: { email: a.email, responseStatus: 'needsAction' },
|
|
);
|
|
}
|
|
|
|
const list = this.eventsBySub.get(userSub) ?? [];
|
|
list.push(event);
|
|
this.eventsBySub.set(userSub, list);
|
|
return event;
|
|
}
|
|
}
|