Phase 1 — Secure Foundation

A. Project bootstrap ──┬──▶ C. Secrets loader ──┬──▶ D. API key auth ──┬──▶ G. MCP server + stubs
                       │                        │                      │
                       └──▶ B. Database & schema ─▶ F. Audit log ──────┤
                                                  │                    │
                                                  └─▶ E. Rate limiting ┤
                                                                       │
                                                  H. OAuth scaffolding ┤
                                                                       │
                                              I. CI & dep hygiene ─────┘ (runs alongside everything)

# Runtime
npm install \
  fastify@^5.0.0 \
  @fastify/helmet@^13.0.0 \
  @fastify/rate-limit@^10.0.0 \
  rate-limiter-flexible@^7.0.0 \
  drizzle-orm@^0.36.0 \
  pg@^8.13.0 \
  zod@^3.23.0 \
  @modelcontextprotocol/sdk@^1.0.0
  # ^^^ Phase 1 was authored against SDK 1.x. The McpServer / StreamableHTTPServerTransport
  # API shape in §G1 may differ on newer minor versions — adapt the registry, keep the contract.
 
# Dev / build / test
npm install --save-dev \
  typescript@^5.6.0 \
  tsx@^4.19.0 \
  @types/node@^22.0.0 \
  @types/pg@^8.11.0 \
  drizzle-kit@^0.28.0 \
  vitest@^2.1.0 \
  eslint@^9.0.0 \
  typescript-eslint@^8.0.0

{
  "name": "deneva-mcp",
  "private": true,
  "type": "module",
  "engines": { "node": ">=22.0.0 <23" },
  "scripts": {
    "dev":       "tsx watch src/index.ts",
    "build":     "tsc --project tsconfig.json",
    "start":     "node dist/index.js",
    "typecheck": "tsc --noEmit",
    "lint":      "eslint . --max-warnings=0",
    "test":      "vitest run",
    "test:watch":"vitest",
    "audit":     "npm audit --audit-level=high",
    "db:migrate":"drizzle-kit migrate",
    "db:studio": "drizzle-kit studio"
  }
}

{
  "compilerOptions": {
    "target": "ES2023",
    "module": "ESNext",
    "moduleResolution": "Bundler",
    "strict": true,
    "noUncheckedIndexedAccess": true,
    "exactOptionalPropertyTypes": true,
    "noImplicitOverride": true,
    "isolatedModules": true,
    "resolveJsonModule": true,
    "outDir": "dist",
    "rootDir": "src"
  },
  "include": ["src/**/*"]
}

node_modules
dist
.env
.env.*
secrets/
coverage

// eslint.config.js
import tseslint from 'typescript-eslint';
 
export default tseslint.config(
  ...tseslint.configs.recommendedTypeChecked,
  {
    languageOptions: { parserOptions: { project: './tsconfig.json' } },
    rules: {
      'no-restricted-syntax': [
        'error',
        {
          // db.execute(sql`...${var}...`) where the sql tag is given a raw template literal
          selector:
            "CallExpression[callee.property.name='execute'] > TaggedTemplateExpression[tag.name='sql'][quasi.expressions.length>0]",
          message:
            'Raw template interpolation in db.execute(sql`...`) is forbidden. Use parameterized helpers (eq, and, sql.placeholder) instead.',
        },
      ],
    },
  },
);

services:
  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: deneva_mcp
      POSTGRES_USER: mcp_admin
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-dev_only_password}
    ports:
      - "127.0.0.1:5432:5432"   # bound to localhost only
    volumes:
      - mcp_pg_data:/var/lib/postgresql/data
volumes:
  mcp_pg_data:

import { pgTable, uuid, text, timestamp, jsonb, integer } from 'drizzle-orm/pg-core';

// drizzle.config.ts
import { defineConfig } from 'drizzle-kit';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';
 
const password = readFileSync(
  process.env.NODE_ENV === 'production'
    ? join('/run/credentials', process.env.SYSTEMD_UNIT ?? 'deneva-mcp.service', 'DB_ADMIN_PASSWORD')
    : join(process.cwd(), 'secrets', 'DB_ADMIN_PASSWORD'),
  'utf8',
).trim();
 
export default defineConfig({
  schema:  './src/db/schema.ts',
  out:     './src/db/migrations',
  dialect: 'postgresql',
  dbCredentials: {
    host:     process.env.DB_HOST ?? '127.0.0.1',
    port:     5432,
    user:     'mcp_admin',
    password,
    database: 'deneva_mcp',
    ssl:      false, // dev; prod uses CA-signed cert (Phase 5)
  },
  strict: true,
});

import { drizzle } from 'drizzle-orm/node-postgres';
import { Pool } from 'pg';
import * as schema from './schema.js';
import { loadSecret } from '../security/secrets.loader.js';
 
const pool = new Pool({
  host:     process.env.DB_HOST ?? '127.0.0.1',
  port:     5432,
  user:     'mcp_app',
  password: (await loadSecret('DB_PASSWORD')).toString('utf8'),
  database: 'deneva_mcp',
  ssl:      { rejectUnauthorized: false }, // dev; production uses CA-signed cert
  max:      20,                            // see §B6; sized for Phase 4 sync fan-out
});
 
export const db = drizzle(pool, { schema });

ALTER TABLE metric_cache          ENABLE ROW LEVEL SECURITY;
ALTER TABLE platform_credentials  ENABLE ROW LEVEL SECURITY;
ALTER TABLE sync_log              ENABLE ROW LEVEL SECURITY;
ALTER TABLE api_keys              ENABLE ROW LEVEL SECURITY;
 
-- Tenant isolation: every tenant-scoped query must SET app.current_tenant_id first.
CREATE POLICY tenant_isolation_metric_cache ON metric_cache
  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
CREATE POLICY tenant_isolation_creds ON platform_credentials
  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
CREATE POLICY tenant_isolation_sync_log ON sync_log
  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
CREATE POLICY tenant_isolation_api_keys ON api_keys
  USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
 
-- audit_log is intentionally NOT RLS-isolated: cross-tenant security review needs full visibility.
-- Access control on audit_log is via role grants in roles.sql.

// inside tenant.middleware.ts, after tenantId is resolved:
await db.execute(sql`SELECT set_config('app.current_tenant_id', ${tenantId}, true)`);

psql "postgresql://mcp_admin:$ADMIN_PW@127.0.0.1:5432/deneva_mcp" \
  -v app_password="$APP_PW" -f src/db/roles.sql

CREATE ROLE mcp_app LOGIN PASSWORD :'app_password' NOINHERIT;
 
GRANT CONNECT ON DATABASE deneva_mcp TO mcp_app;
GRANT USAGE   ON SCHEMA public          TO mcp_app;
GRANT SELECT, INSERT, UPDATE, DELETE
      ON ALL TABLES IN SCHEMA public    TO mcp_app;
GRANT USAGE
      ON ALL SEQUENCES IN SCHEMA public TO mcp_app;
 
-- audit_log is INSERT-only for the application
REVOKE UPDATE, DELETE ON audit_log FROM mcp_app;
 
-- mcp_app must NOT bypass RLS
ALTER ROLE mcp_app NOBYPASSRLS;
 
-- mcp_admin already has full privileges (created by Postgres at boot).
-- Re-asserting NOBYPASSRLS for mcp_app is the only contract we enforce here.

import { describe, it, expect } from 'vitest';
import { db } from '../../src/db/index.js';
import { metricCache, tenants } from '../../src/db/schema.js';
import { sql } from 'drizzle-orm';
 
describe('row-level security', () => {
  it('blocks tenant A from reading tenant B rows', async () => {
    const [a] = await db.insert(tenants).values({ name: 'A' }).returning();
    const [b] = await db.insert(tenants).values({ name: 'B' }).returning();
 
    // Insert a row owned by tenant B, with B's context set.
    await db.execute(sql`SELECT set_config('app.current_tenant_id', ${b.id}, false)`);
    await db.insert(metricCache).values({
      tenantId: b.id, platform: 'google', reportType: 'health',
      dateRangeKey: 'last_7', data: {}, expiresAt: new Date(Date.now() + 60_000),
    });
 
    // Switch to tenant A's context.
    await db.execute(sql`SELECT set_config('app.current_tenant_id', ${a.id}, false)`);
    const visible = await db.select().from(metricCache);
 
    expect(visible).toHaveLength(0); // RLS hides B's row from A
  });
});

# Take a snapshot dump immediately before applying migrations.
TS=$(date -u +%Y%m%dT%H%M%SZ)
pg_dump --format=custom --no-owner --no-privileges deneva_mcp \
  > /var/backups/deneva-mcp/pre-migrate-${TS}.dump
 
# Apply migrations.
npm run db:migrate || {
  echo "Migration failed; restore with:"
  echo "  dropdb deneva_mcp && createdb deneva_mcp"
  echo "  pg_restore --dbname=deneva_mcp /var/backups/deneva-mcp/pre-migrate-${TS}.dump"
  exit 1
}

import { readFile } from 'node:fs/promises';
import { join } from 'node:path';
 
const REQUIRED_SECRETS = [
  'CREDENTIAL_KEK',
  'API_KEY_HMAC_SECRET',
  'DB_PASSWORD',
  'INNGEST_SIGNING_KEY',
] as const;
type SecretName = (typeof REQUIRED_SECRETS)[number];
 
const cache = new Map<SecretName, Buffer>();
 
export async function loadSecret(name: SecretName): Promise<Buffer> {
  const hit = cache.get(name);
  if (hit) return hit;
 
  const path = process.env.NODE_ENV === 'production'
    ? join('/run/credentials', process.env.SYSTEMD_UNIT ?? 'deneva-mcp.service', name)
    : join(process.cwd(), 'secrets', name);
 
  const value = await readFile(path);
  cache.set(name, value);
  return value;
}
 
export async function verifyAllSecretsLoadable(): Promise<void> {
  // Fail fast at startup — better than discovering a missing secret at first request.
  for (const name of REQUIRED_SECRETS) await loadSecret(name);
}

import { verifyAllSecretsLoadable } from './security/secrets.loader.js';
 
await verifyAllSecretsLoadable(); // throws if any required secret is missing
// ... continue Fastify bootstrap

#!/usr/bin/env bash
set -euo pipefail
mkdir -p secrets
chmod 700 secrets
gen() { head -c 32 /dev/urandom | base64 > "secrets/$1" && chmod 600 "secrets/$1"; }
[[ -f secrets/CREDENTIAL_KEK       ]] || gen CREDENTIAL_KEK
[[ -f secrets/API_KEY_HMAC_SECRET  ]] || gen API_KEY_HMAC_SECRET
[[ -f secrets/DB_PASSWORD          ]] || echo -n 'dev_only_password' > secrets/DB_PASSWORD
[[ -f secrets/DB_ADMIN_PASSWORD    ]] || echo -n 'dev_only_password' > secrets/DB_ADMIN_PASSWORD
[[ -f secrets/INNGEST_SIGNING_KEY  ]] || gen INNGEST_SIGNING_KEY
chmod 600 secrets/DB_PASSWORD secrets/DB_ADMIN_PASSWORD
echo "Dev secrets in ./secrets/ (gitignored)."

# /etc/systemd/system/deneva-mcp.service
[Service]
Type=simple
User=deneva-mcp
WorkingDirectory=/opt/deneva-mcp
ExecStart=/usr/bin/node dist/index.js
Environment=NODE_ENV=production
Environment=SYSTEMD_UNIT=deneva-mcp.service
 
LoadCredentialEncrypted=CREDENTIAL_KEK:/etc/deneva-mcp/creds/CREDENTIAL_KEK.cred
LoadCredentialEncrypted=API_KEY_HMAC_SECRET:/etc/deneva-mcp/creds/API_KEY_HMAC_SECRET.cred
LoadCredentialEncrypted=DB_PASSWORD:/etc/deneva-mcp/creds/DB_PASSWORD.cred
LoadCredentialEncrypted=INNGEST_SIGNING_KEY:/etc/deneva-mcp/creds/INNGEST_SIGNING_KEY.cred
 
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true

import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
import { loadSecret } from './secrets.loader.js';
 
const HMAC_SECRET = await loadSecret('API_KEY_HMAC_SECRET');
 
export function generateApiKey(): string {
  // 32 bytes = 256 bits, base64url-encoded; shown to user once, never stored
  return randomBytes(32).toString('base64url');
}
 
export function hashApiKey(rawKey: string): string {
  return createHmac('sha256', HMAC_SECRET).update(rawKey).digest('hex');
}
 
export function verifyApiKey(rawKey: string, storedHash: string): boolean {
  const candidate = Buffer.from(hashApiKey(rawKey));
  const stored    = Buffer.from(storedHash);
  if (candidate.length !== stored.length) return false;
  return timingSafeEqual(candidate, stored);
}

import type { FastifyPluginAsync } from 'fastify';
import { and, eq, gt, isNull } from 'drizzle-orm';
import { db } from '../db/index.js';
import { apiKeys } from '../db/schema.js';
import { hashApiKey } from './api-key.service.js';
import { writeAuditEvent } from './audit-log.service.js';
 
declare module 'fastify' {
  interface FastifyRequest { tenantId?: string; apiKeyId?: string }
}
 
export const tenantAuthPlugin: FastifyPluginAsync = async (fastify) => {
  fastify.addHook('preHandler', async (req, reply) => {
    if (!req.url.startsWith('/mcp')) return;            // auth only on /mcp routes
    const raw = req.headers['x-api-key'];
    if (typeof raw !== 'string' || raw.length === 0) {
      await writeAuditEvent('api_key.auth_failure', 'failure', { ip: req.ip, reason: 'missing' });
      return reply.code(401).send({ error: 'unauthorized' });
    }
    const hash = hashApiKey(raw);
    const now  = new Date();
    const [row] = await db.select().from(apiKeys).where(
      and(
        eq(apiKeys.keyHash, hash),
        isNull(apiKeys.revokedAt),
        gt(apiKeys.expiresAt, now),
      ),
    );
    if (!row) {
      await writeAuditEvent('api_key.auth_failure', 'failure', { ip: req.ip, reason: 'invalid' });
      return reply.code(401).send({ error: 'unauthorized' });
    }
    req.tenantId  = row.tenantId;
    req.apiKeyId  = row.id;
    // Async fire-and-forget: lastUsedAt update should not block the request.
    void db.update(apiKeys).set({ lastUsedAt: now }).where(eq(apiKeys.id, row.id));
    await writeAuditEvent('api_key.auth_success', 'success', { tenantId: row.tenantId });
  });
};

import type { FastifyPluginAsync } from 'fastify';
import { eq } from 'drizzle-orm';
import { z } from 'zod';
import { timingSafeEqual } from 'node:crypto';
import { db } from '../db/index.js';
import { apiKeys } from '../db/schema.js';
import { generateApiKey, hashApiKey } from '../security/api-key.service.js';
import { writeAuditEvent } from '../security/audit-log.service.js';
import { loadSecret } from '../security/secrets.loader.js';
 
const ADMIN_HEADER_NAME = 'x-admin-token';
const adminToken = Buffer.from((await loadSecret('API_KEY_HMAC_SECRET')).toString('hex')); // Phase 1 placeholder; Phase 5 introduces a separate ADMIN_TOKEN secret
 
function adminTokenMatches(presented: unknown): boolean {
  if (typeof presented !== 'string') return false;
  const cand = Buffer.from(presented);
  if (cand.length !== adminToken.length) return false;
  return timingSafeEqual(cand, adminToken);
}
 
const RotateBody = z.object({ tenantId: z.string().uuid(), description: z.string().min(1).max(120) });
 
export const adminRoutes: FastifyPluginAsync = async (fastify) => {
  fastify.post('/admin/api-keys/rotate', async (req, reply) => {
    if (!adminTokenMatches(req.headers[ADMIN_HEADER_NAME])) return reply.code(401).send();
    const body = RotateBody.parse(req.body);
 
    const newKey = generateApiKey();
    const newHash = hashApiKey(newKey);
    const graceUntil = new Date(Date.now() + 24 * 60 * 60 * 1000);
 
    await db.transaction(async (tx) => {
      // Mark previous active keys for this tenant with a 24h grace expiry — do NOT revoke immediately.
      await tx.update(apiKeys)
        .set({ expiresAt: graceUntil })
        .where(eq(apiKeys.tenantId, body.tenantId));
      await tx.insert(apiKeys).values({
        tenantId: body.tenantId,
        keyHash: newHash,
        description: body.description,
        expiresAt: new Date(Date.now() + 365 * 24 * 60 * 60 * 1000),
      });
    });
    await writeAuditEvent('api_key.rotated', 'success', { tenantId: body.tenantId });
 
    return { apiKey: newKey, graceUntil }; // shown once, never retrievable again
  });
};

import type { FastifyPluginAsync } from 'fastify';
import rateLimit from '@fastify/rate-limit';
 
export const rateLimiterPlugin: FastifyPluginAsync = async (fastify) => {
  await fastify.register(rateLimit, {
    global: true,
    max: 100,
    timeWindow: 60_000,
    keyGenerator: (req) => req.ip,
    errorResponseBuilder: (req, _ctx) => {
      // The plugin invokes this on every blocked request — do the audit write here.
      // Lazy import keeps audit-log.service out of the plugin's import cycle.
      void import('./audit-log.service.js').then(({ writeAuditEvent }) =>
        writeAuditEvent('rate_limit.exceeded', 'failure', { ip: req.ip, scope: 'global' }),
      );
      return { error: 'rate_limit_exceeded' };
    },
  });
};

// inside the same plugin file
import { RateLimiterMemory } from 'rate-limiter-flexible';
 
const tenantLimiter = new RateLimiterMemory({ points: 300, duration: 60 });
 
fastify.addHook('preHandler', async (req, reply) => {
  if (!req.tenantId) return;
  try { await tenantLimiter.consume(req.tenantId, 1); }
  catch {
    const { writeAuditEvent } = await import('./audit-log.service.js');
    await writeAuditEvent('rate_limit.exceeded', 'failure', { tenantId: req.tenantId, scope: 'tenant' });
    return reply.code(429).send({ error: 'rate_limit_exceeded' });
  }
});

fastify.register(async (inst) => {
  await inst.register(rateLimit, { max: 5, timeWindow: 15 * 60_000, keyGenerator: (req) => req.ip });
  inst.get('/auth/_phase1_placeholder', async () => ({ ok: true }));
}, { prefix: '/' });

// security/ip-block.service.ts — sketch
const blocks = new Map<string, number>();
export function isBlocked(ip: string): boolean {
  const exp = blocks.get(ip);
  if (!exp) return false;
  if (exp < Date.now()) { blocks.delete(ip); return false; }
  return true;
}
export function recordFailure(ip: string): boolean { /* sliding-window count; returns true when threshold tripped */ }

import { db } from '../db/index.js';
import { auditLog } from '../db/schema.js';
 
export type AuditEventType =
  | 'api_key.auth_success' | 'api_key.auth_failure'
  | 'api_key.created' | 'api_key.rotated' | 'api_key.revoked'
  | 'oauth.flow_started' | 'oauth.flow_completed' | 'oauth.flow_failed'
  | 'oauth.token_refreshed' | 'oauth.token_revoked'
  | 'mcp.tool_called' | 'mcp.tool_failed'
  | 'tenant.created' | 'tenant.deleted'
  | 'rate_limit.exceeded' | 'auth.blocked_ip' | 'sync.exhausted';
 
interface Ctx {
  tenantId?: string; ip?: string; requestId?: string;
  reason?: string; scope?: string; tool?: string;
  [k: string]: unknown;
}
 
const PII_KEYS = new Set(['email', 'name', 'firstName', 'lastName', 'phone', 'address']);
 
function stripPii(meta: Ctx): Ctx {
  const out: Ctx = {};
  for (const [k, v] of Object.entries(meta)) if (!PII_KEYS.has(k)) out[k] = v;
  return out;
}
 
export async function writeAuditEvent(
  eventType: AuditEventType,
  outcome: 'success' | 'failure',
  ctx: Ctx = {},
): Promise<void> {
  const { tenantId, ip, requestId, ...rest } = ctx;
  await db.insert(auditLog).values({
    tenantId: tenantId ?? null,
    eventType,
    actorIp:  ip ?? null,
    requestId: requestId ?? null,
    outcome,
    metadata: stripPii(rest as Ctx),
  });
}

import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
import type { FastifyInstance } from 'fastify';
import { pingTool } from './tools/ping.js';
import { accountHealthTool } from './tools/account-health.js';
import { writeAuditEvent } from '../security/audit-log.service.js';
 
export interface ToolDef<I, O> {
  name: string;
  description: string;
  inputSchema: import('zod').ZodType<I>;
  handler: (input: I, ctx: { tenantId: string; requestId: string }) => Promise<O>;
}
 
const TOOLS: ToolDef<unknown, unknown>[] = [pingTool, accountHealthTool];
 
export function buildMcpServer(): McpServer {
  const server = new McpServer({ name: 'deneva-mcp', version: '0.1.0' });
  for (const t of TOOLS) {
    server.tool(t.name, t.description, t.inputSchema, async (input, extra) => {
      // tenantId + requestId are propagated via the transport's request-context (set in mountMcp)
      const ctx = extra.context as { tenantId: string; requestId: string };
      try {
        return await t.handler(input as never, ctx as never);
      } catch (err) {
        // Single producer for mcp.tool_failed in Phase 1 — every later phase reuses this path.
        // Phase 2's typed-error path (AdapterError) flows through here too.
        await writeAuditEvent('mcp.tool_failed', 'failure', {
          tenantId:  ctx.tenantId,
          requestId: ctx.requestId,
          tool:      t.name,
          reason:    err instanceof Error ? err.message : 'unknown',
        });
        throw err; // let the MCP transport translate to a JSON-RPC error
      }
    });
  }
  return server;
}
 
export async function mountMcp(fastify: FastifyInstance): Promise<void> {
  fastify.post('/mcp', async (req, reply) => {
    const transport = new StreamableHTTPServerTransport({
      sessionIdGenerator: () => crypto.randomUUID(),
    });
    const server = buildMcpServer();
    await server.connect(transport);
    await transport.handleRequest(req.raw, reply.raw, { tenantId: req.tenantId!, requestId: req.id });
  });
}

import { z } from 'zod';
import type { ToolDef } from '../server.js';
import { writeAuditEvent } from '../../security/audit-log.service.js';
 
const Input = z.object({});
 
export const pingTool: ToolDef<z.infer<typeof Input>, { ok: true; tenantId: string; requestId: string }> = {
  name: 'ping',
  description: 'Health-check tool — verifies the entire middleware stack.',
  inputSchema: Input,
  async handler(_input, ctx) {
    await writeAuditEvent('mcp.tool_called', 'success', { tenantId: ctx.tenantId, requestId: ctx.requestId, tool: 'ping' });
    return { ok: true, tenantId: ctx.tenantId, requestId: ctx.requestId };
  },
};

import { z } from 'zod';
import type { ToolDef } from '../server.js';
import { writeAuditEvent } from '../../security/audit-log.service.js';
 
const Input = z.object({
  platform:  z.enum(['google', 'meta', 'tiktok']),
  dateRange: z.enum(['last_7_days', 'last_30_days', 'last_90_days']),
});
 
interface Output {
  platform: 'google' | 'meta' | 'tiktok';
  dateRange: string;
  metrics: { spend: number; roas: number; cpa: number; ctr: number };
  _stub: true; // removed in Phase 2 when real data lands
}
 
export const accountHealthTool: ToolDef<z.infer<typeof Input>, Output> = {
  name: 'get_account_health',
  description: 'Returns spend, ROAS, CPA, CTR for the given platform and date range.',
  inputSchema: Input,
  async handler(input, ctx) {
    await writeAuditEvent('mcp.tool_called', 'success', { tenantId: ctx.tenantId, requestId: ctx.requestId, tool: 'get_account_health' });
    return {
      platform: input.platform,
      dateRange: input.dateRange,
      metrics: { spend: 0, roas: 0, cpa: 0, ctr: 0 },
      _stub: true,
    };
  },
};

import Fastify from 'fastify';
import helmet from '@fastify/helmet';
import { verifyAllSecretsLoadable } from './security/secrets.loader.js';
import { rateLimiterPlugin } from './security/rate-limiter.plugin.js';
import { tenantAuthPlugin } from './security/tenant.middleware.js';
import { adminRoutes } from './auth/admin-routes.js';
import { mountMcp } from './mcp/server.js';
import { startOAuthStateCleanup } from './auth/oauth-state.service.js';
 
await verifyAllSecretsLoadable();
 
// Pino logs structured JSON to stdout. In production the systemd unit captures stdout into
// journald — no log-shipping infrastructure is wired in Phase 1. Retention (size + time)
// is configured in Phase 5 §L; for dev, `journalctl -u deneva-mcp -f` tails the live log.
//
// Redaction has two layers:
//   1. Pino's built-in `redact` strips known request-header paths (api-key, admin-token).
//   2. A custom `err` serializer scrubs token-shaped strings and token-named fields from
//      arbitrary log objects — adapter SDKs sometimes echo `access_token` into error
//      messages, and we don't want those in journald. Phase 5 §L2's grep evidence check
//      then becomes a regression-detector, not the primary defence.
const TOKEN_KEY_RE = /access_token|refresh_token|client_secret|authorization|api[_-]?key|x-admin-token/i;
function scrubTokens(value: unknown, depth = 0): unknown {
  if (depth > 6 || value == null) return value;
  if (typeof value === 'string') {
    return value
      .replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]')
      .replace(/ya29\.[A-Za-z0-9_-]+/g, '[REDACTED]')
      .replace(/EAA[A-Za-z0-9]+/g, '[REDACTED]');
  }
  if (Array.isArray(value)) return value.map((v) => scrubTokens(v, depth + 1));
  if (typeof value === 'object') {
    const out: Record<string, unknown> = {};
    for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
      out[k] = TOKEN_KEY_RE.test(k) ? '[REDACTED]' : scrubTokens(v, depth + 1);
    }
    return out;
  }
  return value;
}
const app = Fastify({
  logger: {
    redact: ['req.headers["x-api-key"]', 'req.headers["x-admin-token"]'],
    serializers: {
      err: (e: Error) => scrubTokens({ type: e.name, message: e.message, stack: e.stack }),
    },
  },
  genReqId: () => crypto.randomUUID(),
});
 
await app.register(helmet, { global: true });
await app.register(rateLimiterPlugin);
await app.register(tenantAuthPlugin);
await app.register(adminRoutes);
await mountMcp(app);
 
// Process-liveness probe for nginx / systemd / external uptime monitor.
// Unauthenticated by design — a 200 here means the Node process is alive and listening,
// not that downstream dependencies are healthy. Phase 4 §G3 owns the dependency-health
// endpoint (/admin/health/inngest); Phase 5 §G1 wires this to an external monitor.
const startedAt = Date.now();
app.get('/health', async () => ({
  ok:        true,
  version:   process.env.npm_package_version ?? '0.1.0',
  uptimeSec: Math.floor((Date.now() - startedAt) / 1000),
}));
 
startOAuthStateCleanup();
 
await app.listen({ host: '127.0.0.1', port: 3001 });

# ping
curl -X POST https://localhost/mcp \
  -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ping","arguments":{}}}'
 
# get_account_health
curl -X POST https://localhost/mcp \
  -H "X-Api-Key: $KEY" -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_account_health","arguments":{"platform":"google","dateRange":"last_7_days"}}}'

import { createHash, randomBytes } from 'node:crypto';
import { and, eq, gt, lt } from 'drizzle-orm';
import { db } from '../db/index.js';
import { oauthStates } from '../db/schema.js';
 
export async function createOAuthState(tenantId: string, platform: string) {
  const state         = randomBytes(32).toString('base64url');
  const codeVerifier  = randomBytes(32).toString('base64url');
  const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
 
  await db.insert(oauthStates).values({
    state, codeVerifier, tenantId, platform,
    expiresAt: new Date(Date.now() + 10 * 60 * 1000),
  });
  return { state, codeVerifier, codeChallenge };
}
 
export async function consumeOAuthState(state: string) {
  const [row] = await db.delete(oauthStates)
    .where(and(eq(oauthStates.state, state), gt(oauthStates.expiresAt, new Date())))
    .returning();
  if (!row) throw new Error('Invalid or expired OAuth state');
  return row; // single-use: deleted on read
}
 
export function startOAuthStateCleanup(): void {
  // Plain in-process timer is fine for Phase 1; replaced by Inngest cron in Phase 4.
  setInterval(() => {
    void db.delete(oauthStates).where(lt(oauthStates.expiresAt, new Date()));
  }, 5 * 60_000).unref();
}

// scripts/seed-tenant.mjs
//
// Usage:
//   node scripts/seed-tenant.mjs "Acme Corp"
//
// Reads DB_ADMIN_PASSWORD and API_KEY_HMAC_SECRET from ./secrets/.
// Prints "API key: <raw>" to stdout. The raw key is shown ONCE — store it now.
 
import { readFileSync } from 'node:fs';
import { createHmac, randomBytes } from 'node:crypto';
import pg from 'pg';
 
const tenantName = process.argv[2] ?? 'dev-tenant';
 
const adminPw  = readFileSync('secrets/DB_ADMIN_PASSWORD', 'utf8').trim();
const hmacKey  = readFileSync('secrets/API_KEY_HMAC_SECRET');
 
const client = new pg.Client({
  host: '127.0.0.1', port: 5432, user: 'mcp_admin',
  password: adminPw, database: 'deneva_mcp',
});
await client.connect();
 
const rawKey = randomBytes(32).toString('base64url');
const keyHash = createHmac('sha256', hmacKey).update(rawKey).digest('hex');
const expires = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000);
 
try {
  await client.query('BEGIN');
  const { rows: [tenant] } = await client.query(
    'INSERT INTO tenants (name) VALUES ($1) RETURNING id',
    [tenantName],
  );
  await client.query(
    `INSERT INTO api_keys (tenant_id, key_hash, description, expires_at)
     VALUES ($1, $2, $3, $4)`,
    [tenant.id, keyHash, 'seed-tenant.mjs', expires],
  );
  await client.query('COMMIT');
  console.log(`Tenant: ${tenant.id} (${tenantName})`);
  console.log(`API key: ${rawKey}`);
  console.log('Store this key now — it cannot be retrieved later.');
} catch (err) {
  await client.query('ROLLBACK');
  throw err;
} finally {
  await client.end();
}

name: CI
on:
  pull_request:
  push: { branches: [main] }
 
jobs:
  build:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        env: { POSTGRES_PASSWORD: ci, POSTGRES_DB: deneva_mcp }
        ports: ['5432:5432']
        options: >-
          --health-cmd "pg_isready -U postgres" --health-interval 5s
          --health-timeout 5s --health-retries 10
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '22', cache: 'npm' }
      - run: npm ci
      - run: bash scripts/dev-secrets.sh
      - run: npm run typecheck
      - run: npm run lint
      - run: npm run audit          # fails on high/critical advisories
      - run: npm run db:migrate
      - run: npm test

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule: { interval: "daily" }
    open-pull-requests-limit: 10
    groups:
      minor-and-patch:
        update-types: ["minor", "patch"]
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule: { interval: "weekly" }

# 1. Bring up Postgres
docker compose up -d postgres
 
# 2. Generate dev secrets
bash scripts/dev-secrets.sh
 
# 3. Run migrations
npm run db:migrate
 
# 4. Create the mcp_app role + apply RLS (must be done BEFORE the app connects).
#    mcp_admin lacks CREATEROLE, so roles.sql runs as the postgres superuser.
APP_PW="$(cat secrets/DB_PASSWORD)"
ADMIN_PW="$(cat secrets/DB_ADMIN_PASSWORD)"
sudo -u postgres psql -d deneva_mcp -v app_password="$APP_PW" -f src/db/roles.sql
psql "postgresql://mcp_admin:${ADMIN_PW}@127.0.0.1:5432/deneva_mcp" -f src/db/rls.sql
 
# 5. Seed a tenant + API key
node scripts/seed-tenant.mjs "dev-tenant"   # prints "API key: XYZ123..." ONCE — copy now
export KEY=XYZ123...
 
# 6. Start the server (now that mcp_app role exists)
npm run dev
 
# 7. initialize with valid key — expect 200 + audit row.
#    The Accept header is REQUIRED by Streamable HTTP; without it the SDK 406s.
#    `initialize` is the right smoke-test target because `tools/call` requires a
#    stateful session (initialize → notifications/initialized → tools/call) that
#    a real MCP client handles, but curl on its own does not.
curl -s -o /dev/null -w "%{http_code}\n" -X POST http://127.0.0.1:3001/mcp \
  -H "X-Api-Key: $KEY" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"1.0"}}}'
# → 200
 
# 8. /mcp without key — expect 401 + audit row
curl -s -o /dev/null -w "%{http_code}\n" -X POST http://127.0.0.1:3001/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"1.0"}}}'
# → 401
 
# 9. Hammer with 101 requests in a minute — expect at least one 429
for i in $(seq 1 101); do
  curl -s -o /dev/null -w "%{http_code} " -X POST http://127.0.0.1:3001/mcp \
    -H "X-Api-Key: $KEY" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke","version":"1.0"}}}'
done; echo
# → mostly 200, then 429s
 
# 10. Confirm mcp_app cannot tamper with audit_log
psql "postgresql://mcp_app@127.0.0.1:5432/deneva_mcp" -c "DELETE FROM audit_log;"
# → ERROR: permission denied for table audit_log
 
# 11. Inspect the trail
psql "postgresql://mcp_admin:${ADMIN_PW}@127.0.0.1:5432/deneva_mcp" \
  -c "SELECT event_type, outcome, count(*) FROM audit_log GROUP BY 1,2 ORDER BY 1,2;"
# → expect rows for api_key.auth_success/failure, mcp.tool_called, rate_limit.exceeded