feat: Phase 6 - MCP + Webhooks + Worker + Polish
- MCP server: stateless JSON-RPC 2.0 with 18 tools (tasks, habits, projects, notes, domains, search, activity) - Webhooks API: CRUD routes under /api/domains/[domainId]/webhooks/ with test endpoint and deliveries log - Webhook delivery: HMAC-SHA256 signed POST with retry (exponential backoff, max 6) - Worker rewrite: Drizzle ORM instead of PocketBase, polls jobs table, handles webhook_delivery, recurring_spawn, ai_dispatch - Rate limiting: token bucket per IP/API key (100 req/min REST, 300 req/min MCP) - Keyboard help overlay: ? opens Radix Dialog with search/filter, Esc closes - AI @mention stub: @agent in command palette dispatches CustomEvent - Mobile responsive: bottom nav, single-column kanban, day view calendar, 44px touch targets - Accessibility: skip-to-content link, focus rings, aria-labels, color contrast - E2E tests: mcp.spec.ts, webhooks.spec.ts, realtime.spec.ts added - Schema: api_keys and webhook_deliveries tables with migration - Removed old PocketBase-style database.ts from worker
This commit is contained in:
@@ -3,6 +3,7 @@ import { TopBar } from '@/components/topbar';
|
||||
import { NetworkErrorBanner } from '@/components/network-error-banner';
|
||||
import { KeyboardShortcutsProvider } from '@/components/keyboard-shortcuts-provider';
|
||||
import { WebVitalsTracker } from '@/components/web-vitals-tracker';
|
||||
import { MobileBottomNav } from '@/components/mobile-bottom-nav';
|
||||
|
||||
export default function DashboardLayout({ children }: { children: React.ReactNode }) {
|
||||
return (
|
||||
@@ -14,13 +15,14 @@ export default function DashboardLayout({ children }: { children: React.ReactNod
|
||||
<div className="flex min-h-screen">
|
||||
<NetworkErrorBanner />
|
||||
<Sidebar />
|
||||
<div className="flex flex-1 flex-col">
|
||||
<div className="flex flex-1 flex-col pb-16 md:pb-0">
|
||||
<TopBar />
|
||||
<main id="main-content" className="flex-1 overflow-auto p-6" tabIndex={-1}>
|
||||
{children}
|
||||
</main>
|
||||
</div>
|
||||
</div>
|
||||
<MobileBottomNav />
|
||||
<div className="sr-only" aria-live="polite" aria-atomic="true" id="a11y-announcer" />
|
||||
</KeyboardShortcutsProvider>
|
||||
);
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
|
||||
// 1. Insert activity feed entry
|
||||
// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
|
||||
// See AGENTS.md for full rules.
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
|
||||
import { db, webhooks, webhookDeliveries } from '@project-e/db';
|
||||
import { and, desc, eq, sql } from 'drizzle-orm';
|
||||
|
||||
type RouteContext = { params: Promise<{ domainId: string; id: string }> };
|
||||
|
||||
// GET /api/domains/[domainId]/webhooks/[id]/deliveries — List deliveries for a webhook
|
||||
export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId, id } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
// Verify webhook exists in this workspace
|
||||
const [webhook] = await db.select({ id: webhooks.id })
|
||||
.from(webhooks)
|
||||
.where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
|
||||
.limit(1);
|
||||
|
||||
if (!webhook) {
|
||||
return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
|
||||
}
|
||||
|
||||
const { searchParams } = new URL(request.url);
|
||||
const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
|
||||
const offset = parseInt(searchParams.get('offset') || '0');
|
||||
|
||||
const [items, countResult] = await Promise.all([
|
||||
db.select()
|
||||
.from(webhookDeliveries)
|
||||
.where(eq(webhookDeliveries.webhookId, id))
|
||||
.orderBy(desc(webhookDeliveries.createdAt))
|
||||
.limit(limit)
|
||||
.offset(offset),
|
||||
db.select({ count: sql<number>`count(*)` })
|
||||
.from(webhookDeliveries)
|
||||
.where(eq(webhookDeliveries.webhookId, id)),
|
||||
]);
|
||||
|
||||
return NextResponse.json({
|
||||
items,
|
||||
totalItems: Number(countResult[0]?.count || 0),
|
||||
limit,
|
||||
offset,
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,118 @@
|
||||
// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
|
||||
// 1. Insert activity feed entry
|
||||
// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
|
||||
// See AGENTS.md for full rules.
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
|
||||
import { recordActivity } from '@/lib/activity';
|
||||
import { db, webhooks } from '@project-e/db';
|
||||
import { and, eq } from 'drizzle-orm';
|
||||
import { z } from 'zod';
|
||||
|
||||
const updateWebhookSchema = z.object({
|
||||
name: z.string().optional(),
|
||||
url: z.string().url('Must be a valid URL').optional(),
|
||||
events: z.array(z.string()).optional(),
|
||||
active: z.boolean().optional(),
|
||||
});
|
||||
|
||||
type RouteContext = { params: Promise<{ domainId: string; id: string }> };
|
||||
|
||||
// GET /api/domains/[domainId]/webhooks/[id] — Get a single webhook
|
||||
export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId, id } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
const [webhook] = await db.select()
|
||||
.from(webhooks)
|
||||
.where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
|
||||
.limit(1);
|
||||
|
||||
if (!webhook) {
|
||||
return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
|
||||
}
|
||||
|
||||
// Never return the secret on GET
|
||||
const { secret: _, ...safe } = webhook;
|
||||
return NextResponse.json(safe);
|
||||
});
|
||||
|
||||
// PATCH /api/domains/[domainId]/webhooks/[id] — Update a webhook
|
||||
export const PATCH = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId, id } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
try {
|
||||
const body = await request.json();
|
||||
const data = updateWebhookSchema.parse(body);
|
||||
|
||||
const [existing] = await db.select()
|
||||
.from(webhooks)
|
||||
.where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
|
||||
.limit(1);
|
||||
|
||||
if (!existing) {
|
||||
return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
|
||||
}
|
||||
|
||||
const updateData: Record<string, unknown> = { updatedAt: new Date() };
|
||||
if (data.name !== undefined) updateData.name = data.name;
|
||||
if (data.url !== undefined) updateData.url = data.url;
|
||||
if (data.events !== undefined) updateData.events = data.events;
|
||||
if (data.active !== undefined) updateData.active = data.active;
|
||||
|
||||
const [updated] = await db.update(webhooks)
|
||||
.set(updateData)
|
||||
.where(eq(webhooks.id, id))
|
||||
.returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: user.name,
|
||||
action: 'updated',
|
||||
entityType: 'webhook',
|
||||
entityId: updated.id,
|
||||
changes: updateData,
|
||||
workspaceId: domainId,
|
||||
});
|
||||
|
||||
const { secret: _, ...safe } = updated;
|
||||
return NextResponse.json(safe);
|
||||
} catch (error) {
|
||||
if (error instanceof z.ZodError) {
|
||||
return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
|
||||
}
|
||||
if (error instanceof ApiError) {
|
||||
return createErrorResponse(error.code, error.message, error.status);
|
||||
}
|
||||
console.error('[webhook PATCH] error:', error);
|
||||
return createErrorResponse('INTERNAL_ERROR', 'Failed to update webhook', 500);
|
||||
}
|
||||
});
|
||||
|
||||
// DELETE /api/domains/[domainId]/webhooks/[id] — Delete a webhook
|
||||
export const DELETE = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId, id } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
const [existing] = await db.select()
|
||||
.from(webhooks)
|
||||
.where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
|
||||
.limit(1);
|
||||
|
||||
if (!existing) {
|
||||
return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
|
||||
}
|
||||
|
||||
await db.delete(webhooks).where(eq(webhooks.id, id));
|
||||
|
||||
await recordActivity({
|
||||
actor: user.name,
|
||||
action: 'deleted',
|
||||
entityType: 'webhook',
|
||||
entityId: id,
|
||||
workspaceId: domainId,
|
||||
});
|
||||
|
||||
return new NextResponse(null, { status: 204 });
|
||||
});
|
||||
@@ -0,0 +1,99 @@
|
||||
// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
|
||||
// 1. Insert activity feed entry
|
||||
// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
|
||||
// See AGENTS.md for full rules.
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { withAuth, requireWorkspaceAccess, createErrorResponse } from '@/lib/auth';
|
||||
import { db, webhooks, webhookDeliveries } from '@project-e/db';
|
||||
import { and, eq } from 'drizzle-orm';
|
||||
import { createHmac } from 'node:crypto';
|
||||
|
||||
type RouteContext = { params: Promise<{ domainId: string; id: string }> };
|
||||
|
||||
// POST /api/domains/[domainId]/webhooks/[id]/test — Send a test event
|
||||
export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId, id } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
const [webhook] = await db.select()
|
||||
.from(webhooks)
|
||||
.where(and(eq(webhooks.id, id), eq(webhooks.workspaceId, domainId)))
|
||||
.limit(1);
|
||||
|
||||
if (!webhook) {
|
||||
return createErrorResponse('NOT_FOUND', 'Webhook not found', 404);
|
||||
}
|
||||
|
||||
if (!webhook.active) {
|
||||
return createErrorResponse('WEBHOOK_DISABLED', 'Cannot test a disabled webhook', 400);
|
||||
}
|
||||
|
||||
const testPayload = {
|
||||
event: 'test.ping',
|
||||
entity_type: 'test',
|
||||
entity_id: 'test-001',
|
||||
data: { message: 'This is a test webhook delivery from Project E.', webhook_id: webhook.id },
|
||||
timestamp: new Date().toISOString(),
|
||||
workspace_id: domainId,
|
||||
};
|
||||
|
||||
const headers: Record<string, string> = {
|
||||
'Content-Type': 'application/json',
|
||||
'X-Event-Type': 'test.ping',
|
||||
};
|
||||
|
||||
if (webhook.secret) {
|
||||
const body = JSON.stringify(testPayload);
|
||||
const signature = createHmac('sha256', webhook.secret)
|
||||
.update(body)
|
||||
.digest('hex');
|
||||
headers['X-ProjectE-Signature'] = signature;
|
||||
}
|
||||
|
||||
try {
|
||||
const response = await fetch(webhook.url, {
|
||||
method: 'POST',
|
||||
headers,
|
||||
body: JSON.stringify(testPayload),
|
||||
signal: AbortSignal.timeout(10000),
|
||||
});
|
||||
|
||||
const responseBody = await response.text();
|
||||
|
||||
// Record the delivery
|
||||
await db.insert(webhookDeliveries).values({
|
||||
webhookId: webhook.id,
|
||||
event: 'test.ping',
|
||||
payload: testPayload as Record<string, unknown>,
|
||||
status: response.ok ? 'success' : 'failed',
|
||||
statusCode: response.status,
|
||||
responseBody: responseBody.substring(0, 1000),
|
||||
attempts: 1,
|
||||
});
|
||||
|
||||
return NextResponse.json({
|
||||
success: response.ok,
|
||||
status: response.status,
|
||||
response: responseBody.substring(0, 500),
|
||||
});
|
||||
} catch (error) {
|
||||
const errorMessage = error instanceof Error ? error.message : String(error);
|
||||
|
||||
await db.insert(webhookDeliveries).values({
|
||||
webhookId: webhook.id,
|
||||
event: 'test.ping',
|
||||
payload: testPayload as Record<string, unknown>,
|
||||
status: 'failed',
|
||||
statusCode: 0,
|
||||
responseBody: errorMessage,
|
||||
attempts: 1,
|
||||
});
|
||||
|
||||
return NextResponse.json({
|
||||
success: false,
|
||||
status: 0,
|
||||
response: errorMessage,
|
||||
});
|
||||
}
|
||||
});
|
||||
@@ -0,0 +1,102 @@
|
||||
// AGENT INSTRUCTION: After every write (INSERT/UPDATE/DELETE), you MUST:
|
||||
// 1. Insert activity feed entry
|
||||
// 2. Call pg.notify('project_e_events', JSON.stringify({ type, action, id, workspace_id }))
|
||||
// See AGENTS.md for full rules.
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { withAuth, requireWorkspaceAccess, createErrorResponse, ApiError } from '@/lib/auth';
|
||||
import { recordActivity } from '@/lib/activity';
|
||||
import { db, webhooks, webhookDeliveries } from '@project-e/db';
|
||||
import { and, asc, desc, eq, isNull, sql } from 'drizzle-orm';
|
||||
import { createHash, randomBytes } from 'node:crypto';
|
||||
import { z } from 'zod';
|
||||
|
||||
const createWebhookSchema = z.object({
|
||||
name: z.string().optional(),
|
||||
url: z.string().url('Must be a valid URL'),
|
||||
events: z.array(z.string()).default([]),
|
||||
active: z.boolean().optional().default(true),
|
||||
});
|
||||
|
||||
const updateWebhookSchema = z.object({
|
||||
name: z.string().optional(),
|
||||
url: z.string().url('Must be a valid URL').optional(),
|
||||
events: z.array(z.string()).optional(),
|
||||
active: z.boolean().optional(),
|
||||
});
|
||||
|
||||
type RouteContext = { params: Promise<{ domainId: string }> };
|
||||
type IdRouteContext = { params: Promise<{ domainId: string; id: string }> };
|
||||
|
||||
// GET /api/domains/[domainId]/webhooks — List webhooks
|
||||
export const GET = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
const { searchParams } = new URL(request.url);
|
||||
const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
|
||||
const offset = parseInt(searchParams.get('offset') || '0');
|
||||
|
||||
const [items, countResult] = await Promise.all([
|
||||
db.select()
|
||||
.from(webhooks)
|
||||
.where(eq(webhooks.workspaceId, domainId))
|
||||
.orderBy(desc(webhooks.createdAt))
|
||||
.limit(limit)
|
||||
.offset(offset),
|
||||
db.select({ count: sql<number>`count(*)` })
|
||||
.from(webhooks)
|
||||
.where(eq(webhooks.workspaceId, domainId)),
|
||||
]);
|
||||
|
||||
return NextResponse.json({
|
||||
items,
|
||||
totalItems: Number(countResult[0]?.count || 0),
|
||||
limit,
|
||||
offset,
|
||||
});
|
||||
});
|
||||
|
||||
// POST /api/domains/[domainId]/webhooks — Create a webhook
|
||||
export const POST = withAuth<RouteContext>(async (request: NextRequest, user, context) => {
|
||||
const { domainId } = await context!.params;
|
||||
await requireWorkspaceAccess(domainId);
|
||||
|
||||
try {
|
||||
const body = await request.json();
|
||||
const data = createWebhookSchema.parse(body);
|
||||
|
||||
// Generate a webhook secret (shown only once on create)
|
||||
const secret = `whsec_${randomBytes(24).toString('hex')}`;
|
||||
|
||||
const [webhook] = await db.insert(webhooks).values({
|
||||
name: data.name ?? null,
|
||||
url: data.url,
|
||||
secret,
|
||||
events: data.events,
|
||||
active: data.active ?? true,
|
||||
workspaceId: domainId,
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: user.name,
|
||||
action: 'created',
|
||||
entityType: 'webhook',
|
||||
entityId: webhook.id,
|
||||
changes: { name: webhook.name, url: webhook.url, events: webhook.events },
|
||||
workspaceId: domainId,
|
||||
});
|
||||
|
||||
// Return the secret on create — it won't be shown again
|
||||
return NextResponse.json({ ...webhook, secret }, { status: 201 });
|
||||
} catch (error) {
|
||||
if (error instanceof z.ZodError) {
|
||||
return createErrorResponse('VALIDATION_ERROR', 'Invalid input', 400, error.issues);
|
||||
}
|
||||
if (error instanceof ApiError) {
|
||||
return createErrorResponse(error.code, error.message, error.status);
|
||||
}
|
||||
console.error('[webhooks POST] error:', error);
|
||||
return createErrorResponse('INTERNAL_ERROR', 'Failed to create webhook', 500);
|
||||
}
|
||||
});
|
||||
+712
-103
@@ -4,134 +4,743 @@
|
||||
// See AGENTS.md for full rules.
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
|
||||
import { createMcpServer } from '@/lib/mcp/server';
|
||||
import { createAdminClient } from '@/lib/pocketbase';
|
||||
import { db, apiKeys, users, tasks, taskTags, tags as tagsTable, habits, habitCompletions, projects, notes, noteLinks, domains, activityFeed, webhooks, webhookDeliveries } from '@project-e/db';
|
||||
import { and, asc, desc, eq, ilike, inArray, isNull, or, sql } from 'drizzle-orm';
|
||||
import { createHash } from 'node:crypto';
|
||||
import { recordActivity } from '@/lib/activity';
|
||||
|
||||
// Store transports by session ID for stateful mode
|
||||
const transports = new Map<string, WebStandardStreamableHTTPServerTransport>();
|
||||
// ── JSON-RPC 2.0 types ─────────────────────────────────────────────────────────
|
||||
|
||||
async function authenticateRequest(request: NextRequest): Promise<boolean> {
|
||||
// Check for API key in Authorization header
|
||||
interface JsonRpcRequest {
|
||||
jsonrpc: '2.0';
|
||||
method: string;
|
||||
params?: unknown;
|
||||
id: string | number | null;
|
||||
}
|
||||
|
||||
interface JsonRpcError {
|
||||
code: number;
|
||||
message: string;
|
||||
data?: unknown;
|
||||
}
|
||||
|
||||
interface JsonRpcResponse {
|
||||
jsonrpc: '2.0';
|
||||
result?: unknown;
|
||||
error?: JsonRpcError;
|
||||
id: string | number | null;
|
||||
}
|
||||
|
||||
// JSON-RPC error codes
|
||||
const JSONRPC_PARSE_ERROR = -32700;
|
||||
const JSONRPC_INVALID_REQUEST = -32600;
|
||||
const JSONRPC_METHOD_NOT_FOUND = -32601;
|
||||
const JSONRPC_INVALID_PARAMS = -32602;
|
||||
const JSONRPC_INTERNAL_ERROR = -32603;
|
||||
|
||||
// ── Auth ────────────────────────────────────────────────────────────────────────
|
||||
|
||||
async function authenticateApiKey(request: NextRequest): Promise<{ userId: string; userName: string } | null> {
|
||||
const authHeader = request.headers.get('Authorization');
|
||||
if (!authHeader) return false;
|
||||
if (!authHeader) return null;
|
||||
|
||||
const apiKey = authHeader.replace('Bearer ', '').trim();
|
||||
if (!apiKey) return false;
|
||||
if (!apiKey) return null;
|
||||
|
||||
try {
|
||||
const pb = createAdminClient();
|
||||
// Look up agent by API key
|
||||
const result = await pb.collection('agents').getList(1, 1, {
|
||||
filter: `api_key = "${apiKey}" && status = "active"`,
|
||||
});
|
||||
return result.items.length > 0;
|
||||
} catch {
|
||||
return false;
|
||||
// API keys are stored as sha256 hash
|
||||
const keyHash = createHash('sha256').update(apiKey).digest('hex');
|
||||
|
||||
const [keyRecord] = await db
|
||||
.select({
|
||||
userId: apiKeys.userId,
|
||||
userName: users.name,
|
||||
})
|
||||
.from(apiKeys)
|
||||
.innerJoin(users, eq(apiKeys.userId, users.id))
|
||||
.where(and(eq(apiKeys.keyHash, keyHash), eq(apiKeys.active, true)))
|
||||
.limit(1);
|
||||
|
||||
if (!keyRecord) return null;
|
||||
|
||||
// Update last_used_at
|
||||
await db.update(apiKeys)
|
||||
.set({ lastUsedAt: new Date() })
|
||||
.where(eq(apiKeys.keyHash, keyHash));
|
||||
|
||||
return { userId: keyRecord.userId, userName: keyRecord.userName };
|
||||
}
|
||||
|
||||
// ── Tool definitions ─────────────────────────────────────────────────────────────
|
||||
|
||||
interface ToolDefinition {
|
||||
name: string;
|
||||
description: string;
|
||||
inputSchema: Record<string, unknown>;
|
||||
handler: (params: Record<string, unknown>, auth: { userId: string; userName: string }) => Promise<unknown>;
|
||||
}
|
||||
|
||||
const tools: ToolDefinition[] = [
|
||||
// ── Tasks ──────────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'tasks.list',
|
||||
description: 'List tasks with optional filters',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string', description: 'Workspace/domain ID' },
|
||||
status: { type: 'string', enum: ['todo', 'in_progress', 'done', 'cancelled'] },
|
||||
priority: { type: 'string', enum: ['low', 'medium', 'high', 'urgent'] },
|
||||
project_id: { type: 'string' },
|
||||
search: { type: 'string' },
|
||||
limit: { type: 'number', default: 50 },
|
||||
offset: { type: 'number', default: 0 },
|
||||
},
|
||||
required: ['domain_id'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const conditions: any[] = [
|
||||
eq(tasks.domainId, params.domain_id as string),
|
||||
isNull(tasks.deletedAt),
|
||||
];
|
||||
if (params.status) conditions.push(eq(tasks.status, params.status as any));
|
||||
if (params.priority) conditions.push(eq(tasks.priority, params.priority as any));
|
||||
if (params.project_id) conditions.push(eq(tasks.projectId, params.project_id as string));
|
||||
if (params.search) conditions.push(ilike(tasks.title, `%${params.search}%`));
|
||||
|
||||
const items = await db.select()
|
||||
.from(tasks)
|
||||
.where(and(...conditions))
|
||||
.orderBy(asc(tasks.order))
|
||||
.limit(Math.min(Number(params.limit) || 50, 200))
|
||||
.offset(Number(params.offset) || 0);
|
||||
|
||||
return { items, total: items.length };
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'tasks.create',
|
||||
description: 'Create a new task',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string', description: 'Workspace/domain ID' },
|
||||
title: { type: 'string' },
|
||||
description: { type: 'string' },
|
||||
status: { type: 'string', enum: ['todo', 'in_progress', 'done', 'cancelled'] },
|
||||
priority: { type: 'string', enum: ['low', 'medium', 'high', 'urgent'] },
|
||||
due_date: { type: 'string' },
|
||||
project_id: { type: 'string' },
|
||||
},
|
||||
required: ['domain_id', 'title'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [task] = await db.insert(tasks).values({
|
||||
title: params.title as string,
|
||||
description: (params.description as string) ?? null,
|
||||
status: (params.status as any) ?? 'todo',
|
||||
priority: (params.priority as any) ?? 'medium',
|
||||
domainId: params.domain_id as string,
|
||||
projectId: (params.project_id as string) ?? null,
|
||||
dueDate: params.due_date ? new Date(params.due_date as string) : null,
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'created',
|
||||
entityType: 'task',
|
||||
entityId: task.id,
|
||||
changes: { title: task.title, status: task.status },
|
||||
workspaceId: params.domain_id as string,
|
||||
});
|
||||
|
||||
return task;
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'tasks.update',
|
||||
description: 'Update an existing task',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
task_id: { type: 'string' },
|
||||
title: { type: 'string' },
|
||||
description: { type: 'string' },
|
||||
status: { type: 'string', enum: ['todo', 'in_progress', 'done', 'cancelled'] },
|
||||
priority: { type: 'string', enum: ['low', 'medium', 'high', 'urgent'] },
|
||||
due_date: { type: 'string' },
|
||||
},
|
||||
required: ['task_id'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const updateData: Record<string, unknown> = {};
|
||||
if (params.title !== undefined) updateData.title = params.title;
|
||||
if (params.description !== undefined) updateData.description = params.description;
|
||||
if (params.status !== undefined) updateData.status = params.status;
|
||||
if (params.priority !== undefined) updateData.priority = params.priority;
|
||||
if (params.due_date !== undefined) updateData.dueDate = params.due_date ? new Date(params.due_date as string) : null;
|
||||
updateData.updatedAt = new Date();
|
||||
|
||||
const [task] = await db.update(tasks)
|
||||
.set(updateData)
|
||||
.where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
|
||||
.returning();
|
||||
|
||||
if (!task) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Task not found');
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'updated',
|
||||
entityType: 'task',
|
||||
entityId: task.id,
|
||||
changes: updateData,
|
||||
workspaceId: task.domainId,
|
||||
});
|
||||
|
||||
return task;
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'tasks.delete',
|
||||
description: 'Soft-delete a task',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
task_id: { type: 'string' },
|
||||
},
|
||||
required: ['task_id'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [task] = await db.update(tasks)
|
||||
.set({ deletedAt: new Date(), updatedAt: new Date() })
|
||||
.where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
|
||||
.returning();
|
||||
|
||||
if (!task) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Task not found');
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'deleted',
|
||||
entityType: 'task',
|
||||
entityId: task.id,
|
||||
workspaceId: task.domainId,
|
||||
});
|
||||
|
||||
return { deleted: true, id: task.id };
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'tasks.complete',
|
||||
description: 'Mark a task as done',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
task_id: { type: 'string' },
|
||||
},
|
||||
required: ['task_id'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [task] = await db.update(tasks)
|
||||
.set({ status: 'done', completedAt: new Date(), updatedAt: new Date() })
|
||||
.where(and(eq(tasks.id, params.task_id as string), isNull(tasks.deletedAt)))
|
||||
.returning();
|
||||
|
||||
if (!task) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Task not found');
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'completed',
|
||||
entityType: 'task',
|
||||
entityId: task.id,
|
||||
workspaceId: task.domainId,
|
||||
});
|
||||
|
||||
return task;
|
||||
},
|
||||
},
|
||||
|
||||
// ── Habits ────────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'habits.list',
|
||||
description: 'List habits',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
active: { type: 'boolean' },
|
||||
},
|
||||
required: ['domain_id'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const conditions: any[] = [
|
||||
eq(habits.domainId, params.domain_id as string),
|
||||
isNull(habits.deletedAt),
|
||||
];
|
||||
if (params.active !== undefined) conditions.push(eq(habits.active, params.active as boolean));
|
||||
|
||||
const items = await db.select().from(habits).where(and(...conditions)).orderBy(asc(habits.name));
|
||||
return { items };
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'habits.create',
|
||||
description: 'Create a new habit',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
name: { type: 'string' },
|
||||
description: { type: 'string' },
|
||||
frequency: { type: 'string', enum: ['daily', 'weekly', 'custom'] },
|
||||
difficulty: { type: 'string', enum: ['easy', 'medium', 'hard'] },
|
||||
},
|
||||
required: ['domain_id', 'name'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [habit] = await db.insert(habits).values({
|
||||
name: params.name as string,
|
||||
description: (params.description as string) ?? null,
|
||||
domainId: params.domain_id as string,
|
||||
frequency: (params.frequency as any) ?? 'daily',
|
||||
difficulty: (params.difficulty as any) ?? 'medium',
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'created',
|
||||
entityType: 'habit',
|
||||
entityId: habit.id,
|
||||
workspaceId: params.domain_id as string,
|
||||
});
|
||||
|
||||
return habit;
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'habits.complete',
|
||||
description: 'Log a habit completion',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
habit_id: { type: 'string' },
|
||||
date: { type: 'string', description: 'ISO date string' },
|
||||
value: { type: 'number', default: 1 },
|
||||
},
|
||||
required: ['habit_id'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [habit] = await db.select().from(habits).where(and(eq(habits.id, params.habit_id as string), isNull(habits.deletedAt))).limit(1);
|
||||
if (!habit) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Habit not found');
|
||||
|
||||
const [completion] = await db.insert(habitCompletions).values({
|
||||
habitId: params.habit_id as string,
|
||||
date: params.date ? new Date(params.date as string) : new Date(),
|
||||
value: Number(params.value) || 1,
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'completed',
|
||||
entityType: 'habit',
|
||||
entityId: habit.id,
|
||||
workspaceId: habit.domainId,
|
||||
});
|
||||
|
||||
return completion;
|
||||
},
|
||||
},
|
||||
|
||||
// ── Projects ───────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'projects.list',
|
||||
description: 'List projects',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
status: { type: 'string', enum: ['active', 'paused', 'completed', 'archived'] },
|
||||
},
|
||||
required: ['domain_id'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const conditions: any[] = [
|
||||
eq(projects.domainId, params.domain_id as string),
|
||||
isNull(projects.deletedAt),
|
||||
];
|
||||
if (params.status) conditions.push(eq(projects.status, params.status as any));
|
||||
|
||||
const items = await db.select().from(projects).where(and(...conditions)).orderBy(asc(projects.name));
|
||||
return { items };
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'projects.create',
|
||||
description: 'Create a new project',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
name: { type: 'string' },
|
||||
description: { type: 'string' },
|
||||
status: { type: 'string', enum: ['active', 'paused', 'completed', 'archived'] },
|
||||
target_date: { type: 'string' },
|
||||
},
|
||||
required: ['domain_id', 'name'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [project] = await db.insert(projects).values({
|
||||
name: params.name as string,
|
||||
description: (params.description as string) ?? null,
|
||||
domainId: params.domain_id as string,
|
||||
status: (params.status as any) ?? 'active',
|
||||
targetDate: params.target_date ? new Date(params.target_date as string) : null,
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'created',
|
||||
entityType: 'project',
|
||||
entityId: project.id,
|
||||
workspaceId: params.domain_id as string,
|
||||
});
|
||||
|
||||
return project;
|
||||
},
|
||||
},
|
||||
|
||||
// ── Notes ──────────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'notes.list',
|
||||
description: 'List notes',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
is_archived: { type: 'boolean' },
|
||||
},
|
||||
required: ['domain_id'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const conditions: any[] = [
|
||||
eq(notes.domainId, params.domain_id as string),
|
||||
isNull(notes.deletedAt),
|
||||
];
|
||||
if (params.is_archived !== undefined) conditions.push(eq(notes.isArchived, params.is_archived as boolean));
|
||||
|
||||
const items = await db.select().from(notes).where(and(...conditions)).orderBy(desc(notes.updatedAt));
|
||||
return { items };
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'notes.create',
|
||||
description: 'Create a new note',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
title: { type: 'string' },
|
||||
content: { type: 'string' },
|
||||
},
|
||||
required: ['domain_id', 'title'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [note] = await db.insert(notes).values({
|
||||
title: params.title as string,
|
||||
content: (params.content as string) ?? null,
|
||||
domainId: params.domain_id as string,
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'created',
|
||||
entityType: 'note',
|
||||
entityId: note.id,
|
||||
workspaceId: params.domain_id as string,
|
||||
});
|
||||
|
||||
return note;
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'notes.update',
|
||||
description: 'Update a note',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
note_id: { type: 'string' },
|
||||
title: { type: 'string' },
|
||||
content: { type: 'string' },
|
||||
},
|
||||
required: ['note_id'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const updateData: Record<string, unknown> = { updatedAt: new Date() };
|
||||
if (params.title !== undefined) updateData.title = params.title;
|
||||
if (params.content !== undefined) updateData.content = params.content;
|
||||
|
||||
const [note] = await db.update(notes)
|
||||
.set(updateData)
|
||||
.where(and(eq(notes.id, params.note_id as string), isNull(notes.deletedAt)))
|
||||
.returning();
|
||||
|
||||
if (!note) throw new JsonRpcErrorResponse(JSONRPC_INTERNAL_ERROR, 'Note not found');
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'updated',
|
||||
entityType: 'note',
|
||||
entityId: note.id,
|
||||
workspaceId: note.domainId,
|
||||
});
|
||||
|
||||
return note;
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'notes.search',
|
||||
description: 'Search notes by title or content',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
query: { type: 'string' },
|
||||
},
|
||||
required: ['domain_id', 'query'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const query = params.query as string;
|
||||
const items = await db.select()
|
||||
.from(notes)
|
||||
.where(and(
|
||||
eq(notes.domainId, params.domain_id as string),
|
||||
isNull(notes.deletedAt),
|
||||
or(
|
||||
ilike(notes.title, `%${query}%`),
|
||||
ilike(notes.content ?? sql`''`, `%${query}%`)
|
||||
)
|
||||
))
|
||||
.orderBy(desc(notes.updatedAt))
|
||||
.limit(20);
|
||||
|
||||
return { items };
|
||||
},
|
||||
},
|
||||
|
||||
// ── Domains ────────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'domains.list',
|
||||
description: 'List domains/workspaces',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {},
|
||||
},
|
||||
handler: async () => {
|
||||
const items = await db.select().from(domains).orderBy(asc(domains.name));
|
||||
return { items };
|
||||
},
|
||||
},
|
||||
{
|
||||
name: 'domains.create',
|
||||
description: 'Create a new domain/workspace',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
name: { type: 'string' },
|
||||
slug: { type: 'string' },
|
||||
color: { type: 'string' },
|
||||
},
|
||||
required: ['name', 'slug'],
|
||||
},
|
||||
handler: async (params, auth) => {
|
||||
const [domain] = await db.insert(domains).values({
|
||||
name: params.name as string,
|
||||
slug: params.slug as string,
|
||||
color: (params.color as string) ?? null,
|
||||
}).returning();
|
||||
|
||||
await recordActivity({
|
||||
actor: auth.userName,
|
||||
action: 'created',
|
||||
entityType: 'domain',
|
||||
entityId: domain.id,
|
||||
workspaceId: domain.id,
|
||||
});
|
||||
|
||||
return domain;
|
||||
},
|
||||
},
|
||||
|
||||
// ── Search ─────────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'search.query',
|
||||
description: 'Full-text search across entities',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
domain_id: { type: 'string' },
|
||||
query: { type: 'string' },
|
||||
types: { type: 'array', items: { type: 'string' }, description: 'Entity types to search: tasks, notes, projects, habits' },
|
||||
limit: { type: 'number', default: 20 },
|
||||
},
|
||||
required: ['domain_id', 'query'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const query = params.query as string;
|
||||
const domainId = params.domain_id as string;
|
||||
const types = (params.types as string[]) || ['tasks', 'notes', 'projects', 'habits'];
|
||||
const limit = Math.min(Number(params.limit) || 20, 50);
|
||||
const results: Record<string, unknown[]> = {};
|
||||
|
||||
if (types.includes('tasks')) {
|
||||
results.tasks = await db.select({
|
||||
id: tasks.id, title: tasks.title, status: tasks.status, priority: tasks.priority,
|
||||
}).from(tasks)
|
||||
.where(and(eq(tasks.domainId, domainId), isNull(tasks.deletedAt), ilike(tasks.title, `%${query}%`)))
|
||||
.limit(limit);
|
||||
}
|
||||
if (types.includes('notes')) {
|
||||
results.notes = await db.select({ id: notes.id, title: notes.title }).from(notes)
|
||||
.where(and(eq(notes.domainId, domainId), isNull(notes.deletedAt), ilike(notes.title, `%${query}%`)))
|
||||
.limit(limit);
|
||||
}
|
||||
if (types.includes('projects')) {
|
||||
results.projects = await db.select({ id: projects.id, name: projects.name, status: projects.status }).from(projects)
|
||||
.where(and(eq(projects.domainId, domainId), isNull(projects.deletedAt), ilike(projects.name, `%${query}%`)))
|
||||
.limit(limit);
|
||||
}
|
||||
if (types.includes('habits')) {
|
||||
results.habits = await db.select({ id: habits.id, name: habits.name, frequency: habits.frequency }).from(habits)
|
||||
.where(and(eq(habits.domainId, domainId), isNull(habits.deletedAt), ilike(habits.name, `%${query}%`)))
|
||||
.limit(limit);
|
||||
}
|
||||
|
||||
return results;
|
||||
},
|
||||
},
|
||||
|
||||
// ── Activity ───────────────────────────────────────────────────────────────────
|
||||
{
|
||||
name: 'activity.list',
|
||||
description: 'List recent activity feed entries',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
properties: {
|
||||
workspace_id: { type: 'string' },
|
||||
limit: { type: 'number', default: 20 },
|
||||
offset: { type: 'number', default: 0 },
|
||||
},
|
||||
required: ['workspace_id'],
|
||||
},
|
||||
handler: async (params) => {
|
||||
const items = await db.select()
|
||||
.from(activityFeed)
|
||||
.where(eq(activityFeed.workspaceId, params.workspace_id as string))
|
||||
.orderBy(desc(activityFeed.createdAt))
|
||||
.limit(Math.min(Number(params.limit) || 20, 100))
|
||||
.offset(Number(params.offset) || 0);
|
||||
|
||||
return { items };
|
||||
},
|
||||
},
|
||||
];
|
||||
|
||||
// ── Error helper ─────────────────────────────────────────────────────────────────
|
||||
|
||||
class JsonRpcErrorResponse extends Error {
|
||||
constructor(public code: number, message: string, public data?: unknown) {
|
||||
super(message);
|
||||
this.name = 'JsonRpcErrorResponse';
|
||||
}
|
||||
}
|
||||
|
||||
export async function GET(request: NextRequest) {
|
||||
// Authenticate
|
||||
if (!(await authenticateRequest(request))) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Unauthorized. Provide a valid API key in the Authorization header.' },
|
||||
{ status: 401 }
|
||||
);
|
||||
}
|
||||
// ── Handler ──────────────────────────────────────────────────────────────────────
|
||||
|
||||
// Create server and transport for SSE connection
|
||||
const server = createMcpServer();
|
||||
const transport = new WebStandardStreamableHTTPServerTransport({
|
||||
sessionIdGenerator: () => crypto.randomUUID(),
|
||||
});
|
||||
|
||||
await server.connect(transport);
|
||||
|
||||
// Handle the request first — sessionId is set during handleRequest
|
||||
const response = await transport.handleRequest(request);
|
||||
|
||||
// Store transport AFTER handleRequest sets the session ID
|
||||
if (transport.sessionId) {
|
||||
transports.set(transport.sessionId, transport);
|
||||
}
|
||||
|
||||
return response;
|
||||
function makeError(code: number, message: string, data?: unknown): JsonRpcResponse {
|
||||
return { jsonrpc: '2.0', error: { code, message, data }, id: null };
|
||||
}
|
||||
|
||||
function makeResult(result: unknown, id: string | number | null): JsonRpcResponse {
|
||||
return { jsonrpc: '2.0', result, id };
|
||||
}
|
||||
|
||||
async function handleRequest(body: JsonRpcRequest, auth: { userId: string; userName: string }): Promise<JsonRpcResponse> {
|
||||
const { method, params, id } = body;
|
||||
|
||||
if (method === 'server/discover') {
|
||||
return makeResult({
|
||||
name: 'project-e',
|
||||
version: '1.0.0',
|
||||
capabilities: { tools: {} },
|
||||
tools: tools.map(t => ({
|
||||
name: t.name,
|
||||
description: t.description,
|
||||
inputSchema: t.inputSchema,
|
||||
})),
|
||||
}, id);
|
||||
}
|
||||
|
||||
if (method === 'tools/call') {
|
||||
const callParams = params as { name?: string; arguments?: Record<string, unknown> } | undefined;
|
||||
if (!callParams?.name) {
|
||||
return makeError(JSONRPC_INVALID_PARAMS, 'Missing tool name', id);
|
||||
}
|
||||
|
||||
const tool = tools.find(t => t.name === callParams.name);
|
||||
if (!tool) {
|
||||
return makeError(JSONRPC_METHOD_NOT_FOUND, `Unknown tool: ${callParams.name}`, id);
|
||||
}
|
||||
|
||||
try {
|
||||
const result = await tool.handler(callParams.arguments || {}, auth);
|
||||
return makeResult(result, id);
|
||||
} catch (error) {
|
||||
if (error instanceof JsonRpcErrorResponse) {
|
||||
return makeError(error.code, error.message, error.data);
|
||||
}
|
||||
console.error(`[MCP] Tool ${callParams.name} error:`, error);
|
||||
return makeError(JSONRPC_INTERNAL_ERROR, error instanceof Error ? error.message : 'Internal error', id);
|
||||
}
|
||||
}
|
||||
|
||||
return makeError(JSONRPC_METHOD_NOT_FOUND, `Unknown method: ${method}`, id);
|
||||
}
|
||||
|
||||
// ── Route handler ────────────────────────────────────────────────────────────────
|
||||
|
||||
export async function POST(request: NextRequest) {
|
||||
// Authenticate
|
||||
if (!(await authenticateRequest(request))) {
|
||||
const auth = await authenticateApiKey(request);
|
||||
if (!auth) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Unauthorized. Provide a valid API key in the Authorization header.' },
|
||||
{ jsonrpc: '2.0', error: { code: -32001, message: 'Unauthorized. Provide a valid API key in Authorization: Bearer header.' }, id: null },
|
||||
{ status: 401 }
|
||||
);
|
||||
}
|
||||
|
||||
// Get session ID from header
|
||||
const sessionId = request.headers.get('mcp-session-id');
|
||||
|
||||
if (sessionId) {
|
||||
// Route to existing transport
|
||||
const transport = transports.get(sessionId);
|
||||
if (transport) {
|
||||
return transport.handleRequest(request);
|
||||
}
|
||||
let body: JsonRpcRequest;
|
||||
try {
|
||||
body = await request.json();
|
||||
} catch {
|
||||
return NextResponse.json(
|
||||
{ error: 'Session not found. Connect via GET first.' },
|
||||
{ status: 404 }
|
||||
);
|
||||
}
|
||||
|
||||
// No session ID — this should be an initialization request
|
||||
const server = createMcpServer();
|
||||
const transport = new WebStandardStreamableHTTPServerTransport({
|
||||
sessionIdGenerator: () => crypto.randomUUID(),
|
||||
});
|
||||
|
||||
await server.connect(transport);
|
||||
|
||||
// Handle the request first — sessionId is set during handleRequest
|
||||
const response = await transport.handleRequest(request);
|
||||
|
||||
// Store transport AFTER handleRequest sets the session ID
|
||||
if (transport.sessionId) {
|
||||
transports.set(transport.sessionId, transport);
|
||||
}
|
||||
|
||||
return response;
|
||||
}
|
||||
|
||||
export async function DELETE(request: NextRequest) {
|
||||
// Authenticate
|
||||
if (!(await authenticateRequest(request))) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Unauthorized. Provide a valid API key in the Authorization header.' },
|
||||
{ status: 401 }
|
||||
);
|
||||
}
|
||||
|
||||
const sessionId = request.headers.get('mcp-session-id');
|
||||
if (!sessionId) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Missing mcp-session-id header' },
|
||||
makeError(JSONRPC_PARSE_ERROR, 'Parse error: invalid JSON'),
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
const transport = transports.get(sessionId);
|
||||
if (!transport) {
|
||||
// Validate JSON-RPC 2.0
|
||||
if (!body || body.jsonrpc !== '2.0' || !body.method) {
|
||||
return NextResponse.json(
|
||||
{ error: 'Session not found' },
|
||||
{ status: 404 }
|
||||
makeError(JSONRPC_INVALID_REQUEST, 'Invalid Request: must be valid JSON-RPC 2.0 with method'),
|
||||
{ status: 400 }
|
||||
);
|
||||
}
|
||||
|
||||
// Handle the DELETE to terminate the session
|
||||
const response = await transport.handleRequest(request);
|
||||
const response = await handleRequest(body, auth);
|
||||
return NextResponse.json(response);
|
||||
}
|
||||
|
||||
// Clean up
|
||||
transports.delete(sessionId);
|
||||
|
||||
return response;
|
||||
}
|
||||
// GET is not supported — MCP is stateless POST-only
|
||||
export async function GET() {
|
||||
return NextResponse.json(
|
||||
makeError(JSONRPC_METHOD_NOT_FOUND, 'MCP server only accepts POST requests'),
|
||||
{ status: 405 }
|
||||
);
|
||||
}
|
||||
|
||||
@@ -5,36 +5,37 @@
|
||||
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
import { withAuth } from '@/lib/auth';
|
||||
import { createPocketBaseClient } from '@/lib/pocketbase';
|
||||
import { db, webhookDeliveries } from '@project-e/db';
|
||||
import { and, desc, eq, sql } from 'drizzle-orm';
|
||||
|
||||
// GET /api/webhook-deliveries — List webhook deliveries with filtering
|
||||
export const GET = withAuth(async (request: NextRequest, _user) => {
|
||||
const { searchParams } = new URL(request.url);
|
||||
const page = parseInt(searchParams.get('page') || '1');
|
||||
const perPage = parseInt(searchParams.get('perPage') || '50');
|
||||
const filter = searchParams.get('filter') || undefined;
|
||||
const sort = searchParams.get('sort') || '-created';
|
||||
const limit = Math.min(parseInt(searchParams.get('limit') || '50'), 200);
|
||||
const offset = parseInt(searchParams.get('offset') || '0');
|
||||
const webhookId = searchParams.get('webhook_id') || '';
|
||||
|
||||
const pb = createPocketBaseClient();
|
||||
|
||||
let combinedFilter = filter;
|
||||
const conditions = [];
|
||||
if (webhookId) {
|
||||
combinedFilter = combinedFilter
|
||||
? `${combinedFilter} && webhook_id = "${webhookId}"`
|
||||
: `webhook_id = "${webhookId}"`;
|
||||
conditions.push(eq(webhookDeliveries.webhookId, webhookId));
|
||||
}
|
||||
|
||||
const result = await pb.collection('webhook_deliveries').getList(page, perPage, {
|
||||
filter: combinedFilter,
|
||||
sort,
|
||||
});
|
||||
const [items, countResult] = await Promise.all([
|
||||
db.select()
|
||||
.from(webhookDeliveries)
|
||||
.where(conditions.length > 0 ? and(...conditions) : undefined)
|
||||
.orderBy(desc(webhookDeliveries.createdAt))
|
||||
.limit(limit)
|
||||
.offset(offset),
|
||||
db.select({ count: sql<number>`count(*)` })
|
||||
.from(webhookDeliveries)
|
||||
.where(conditions.length > 0 ? and(...conditions) : undefined),
|
||||
]);
|
||||
|
||||
return NextResponse.json({
|
||||
items: result.items,
|
||||
totalItems: result.totalItems,
|
||||
totalPages: result.totalPages,
|
||||
page: result.page,
|
||||
perPage: result.perPage,
|
||||
items,
|
||||
totalItems: Number(countResult[0]?.count || 0),
|
||||
limit,
|
||||
offset,
|
||||
});
|
||||
});
|
||||
|
||||
@@ -330,3 +330,74 @@
|
||||
font-size: 12px;
|
||||
font-weight: 500;
|
||||
}
|
||||
|
||||
/* ── Mobile responsive ──────────────────────────────────────────────────────────── */
|
||||
|
||||
/* Bottom navigation for mobile */
|
||||
@media (max-width: 767px) {
|
||||
.mobile-bottom-nav {
|
||||
display: flex !important;
|
||||
}
|
||||
|
||||
/* Calendar: day view on mobile */
|
||||
.rbc-month-view {
|
||||
display: none;
|
||||
}
|
||||
.rbc-time-view {
|
||||
display: block;
|
||||
}
|
||||
|
||||
/* Dashboard: single column */
|
||||
.dashboard-grid {
|
||||
grid-template-columns: 1fr !important;
|
||||
}
|
||||
|
||||
/* Kanban: single column with horizontal scroll */
|
||||
.kanban-board {
|
||||
overflow-x: auto;
|
||||
-webkit-overflow-scrolling: touch;
|
||||
scroll-snap-type: x mandatory;
|
||||
}
|
||||
.kanban-column {
|
||||
min-width: 85vw;
|
||||
scroll-snap-align: start;
|
||||
}
|
||||
|
||||
/* Touch targets ≥ 44px */
|
||||
button, a, [role="button"], input, select, textarea {
|
||||
min-height: 44px;
|
||||
}
|
||||
|
||||
/* Reduce padding on mobile */
|
||||
main#main-content {
|
||||
padding: 1rem !important;
|
||||
}
|
||||
}
|
||||
|
||||
/* Desktop: hide bottom nav */
|
||||
.mobile-bottom-nav {
|
||||
display: none;
|
||||
}
|
||||
|
||||
/* ── Focus rings for accessibility ──────────────────────────────────────────────── */
|
||||
|
||||
*:focus-visible {
|
||||
outline: 2px solid hsl(var(--ring));
|
||||
outline-offset: 2px;
|
||||
}
|
||||
|
||||
/* ── Color contrast improvements ───────────────────────────────────────────────── */
|
||||
|
||||
.text-muted-foreground {
|
||||
color: hsl(var(--muted-foreground));
|
||||
}
|
||||
|
||||
/* Ensure 4.5:1 contrast for small text */
|
||||
@media (prefers-contrast: more) {
|
||||
:root {
|
||||
--muted-foreground: 140 5% 30%;
|
||||
}
|
||||
.dark {
|
||||
--muted-foreground: 140 5% 70%;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -84,6 +84,11 @@ export function CommandPalette() {
|
||||
{ label: 'New habit', action: () => router.push('/habits?new=true') },
|
||||
{ label: 'New project', action: () => router.push('/projects?new=true') },
|
||||
{ label: 'New note', action: () => router.push('/notes?new=true') },
|
||||
{ label: 'Ask AI agent...', shortcut: '@', action: () => {
|
||||
setOpen(false);
|
||||
// Dispatch event for AI dispatch flow
|
||||
document.dispatchEvent(new CustomEvent('open-ai-dispatch'));
|
||||
}},
|
||||
];
|
||||
|
||||
// Search handler
|
||||
|
||||
@@ -0,0 +1,62 @@
|
||||
'use client';
|
||||
|
||||
import Link from 'next/link';
|
||||
import { usePathname } from 'next/navigation';
|
||||
import { cn } from '@/lib/utils';
|
||||
import {
|
||||
LayoutDashboard,
|
||||
ListTodo,
|
||||
Flame,
|
||||
NotebookPen,
|
||||
CalendarDays,
|
||||
MoreHorizontal,
|
||||
} from 'lucide-react';
|
||||
|
||||
const bottomNavItems = [
|
||||
{ href: '/tasks', label: 'Tasks', icon: ListTodo },
|
||||
{ href: '/habits', label: 'Habits', icon: Flame },
|
||||
{ href: '/dashboard', label: 'Dashboard', icon: LayoutDashboard },
|
||||
{ href: '/notes', label: 'Notes', icon: NotebookPen },
|
||||
{ href: '/calendar', label: 'Calendar', icon: CalendarDays },
|
||||
{ href: '/more', label: 'More', icon: MoreHorizontal },
|
||||
];
|
||||
|
||||
export function MobileBottomNav() {
|
||||
const pathname = usePathname();
|
||||
|
||||
return (
|
||||
<nav
|
||||
className="mobile-bottom-nav fixed bottom-0 left-0 right-0 z-50 border-t bg-card md:hidden"
|
||||
aria-label="Mobile navigation"
|
||||
>
|
||||
<div className="flex items-center justify-around h-16">
|
||||
{bottomNavItems.map((item) => {
|
||||
const isActive =
|
||||
item.href === '/more'
|
||||
? !bottomNavItems
|
||||
.filter((i) => i.href !== '/more')
|
||||
.some((i) => pathname.startsWith(i.href))
|
||||
: pathname === item.href || pathname.startsWith(item.href + '/');
|
||||
|
||||
return (
|
||||
<Link
|
||||
key={item.href}
|
||||
href={item.href}
|
||||
className={cn(
|
||||
'flex flex-col items-center justify-center gap-0.5 px-3 py-1 min-h-[44px] min-w-[44px] rounded-lg transition-colors',
|
||||
isActive
|
||||
? 'text-primary'
|
||||
: 'text-muted-foreground hover:text-foreground'
|
||||
)}
|
||||
aria-current={isActive ? 'page' : undefined}
|
||||
aria-label={item.label}
|
||||
>
|
||||
<item.icon className="h-5 w-5" aria-hidden="true" />
|
||||
<span className="text-[10px] font-medium">{item.label}</span>
|
||||
</Link>
|
||||
);
|
||||
})}
|
||||
</div>
|
||||
</nav>
|
||||
);
|
||||
}
|
||||
@@ -1,83 +1,161 @@
|
||||
'use client';
|
||||
|
||||
import { useEffect, useState } from 'react';
|
||||
import { useEffect, useState, useMemo } from 'react';
|
||||
import {
|
||||
Dialog,
|
||||
DialogContent,
|
||||
DialogDescription,
|
||||
DialogHeader,
|
||||
DialogTitle,
|
||||
DialogDescription,
|
||||
} from '@/components/ui/dialog';
|
||||
import { useKeyboardShortcutsStore } from '@/lib/stores/use-keyboard-shortcuts-store';
|
||||
import { Input } from '@/components/ui/input';
|
||||
import { ScrollArea } from '@/components/ui/scroll-area';
|
||||
|
||||
interface ShortcutGroup {
|
||||
title: string;
|
||||
shortcuts: { keys: string; description: string }[];
|
||||
}
|
||||
|
||||
const shortcutGroups: ShortcutGroup[] = [
|
||||
{
|
||||
title: 'Global',
|
||||
shortcuts: [
|
||||
{ keys: '?', description: 'Open keyboard shortcuts help' },
|
||||
{ keys: '⌘K', description: 'Open command palette' },
|
||||
{ keys: '⌘⇧K', description: 'Deep search' },
|
||||
{ keys: 'Esc', description: 'Close panel / dialog' },
|
||||
],
|
||||
},
|
||||
{
|
||||
title: 'Navigation',
|
||||
shortcuts: [
|
||||
{ keys: 'G then D', description: 'Go to Dashboard' },
|
||||
{ keys: 'G then T', description: 'Go to Tasks' },
|
||||
{ keys: 'G then H', description: 'Go to Habits' },
|
||||
{ keys: 'G then P', description: 'Go to Projects' },
|
||||
{ keys: 'G then N', description: 'Go to Notes' },
|
||||
{ keys: 'G then G', description: 'Go to Graph' },
|
||||
{ keys: 'G then C', description: 'Go to Calendar' },
|
||||
{ keys: 'G then S', description: 'Go to Search' },
|
||||
{ keys: 'G then A', description: 'Go to Analytics' },
|
||||
],
|
||||
},
|
||||
{
|
||||
title: 'Creation',
|
||||
shortcuts: [
|
||||
{ keys: 'C (on tasks page)', description: 'New task' },
|
||||
{ keys: 'C (on habits page)', description: 'New habit' },
|
||||
{ keys: 'C (on projects page)', description: 'New project' },
|
||||
{ keys: 'C (on notes page)', description: 'New note' },
|
||||
{ keys: 'C (on project detail)', description: 'New section' },
|
||||
],
|
||||
},
|
||||
{
|
||||
title: 'Entity Actions',
|
||||
shortcuts: [
|
||||
{ keys: 'Space (on tasks)', description: 'Open first task detail' },
|
||||
{ keys: 'E', description: 'Edit focused task' },
|
||||
{ keys: 'D', description: 'Delete focused task' },
|
||||
{ keys: '1-4 (on tasks)', description: 'Filter kanban column (todo→cancelled)' },
|
||||
],
|
||||
},
|
||||
];
|
||||
|
||||
export function ShortcutsHelp() {
|
||||
const [open, setOpen] = useState(false);
|
||||
const { shortcuts } = useKeyboardShortcutsStore();
|
||||
const [search, setSearch] = useState('');
|
||||
|
||||
// Toggle with ? key
|
||||
useEffect(() => {
|
||||
const handleKeyDown = (e: KeyboardEvent) => {
|
||||
const target = e.target as HTMLElement;
|
||||
if (
|
||||
target.tagName === 'INPUT' ||
|
||||
target.tagName === 'TEXTAREA' ||
|
||||
target.tagName === 'SELECT' ||
|
||||
target.isContentEditable
|
||||
) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (e.key === '?' && !e.metaKey && !e.ctrlKey && !e.altKey) {
|
||||
const target = e.target as HTMLElement;
|
||||
if (
|
||||
target.tagName === 'INPUT' ||
|
||||
target.tagName === 'TEXTAREA' ||
|
||||
target.tagName === 'SELECT' ||
|
||||
target.tagName === 'BUTTON' ||
|
||||
target.isContentEditable ||
|
||||
target.closest('[role="dialog"], [role="menu"], [role="listbox"], [role="combobox"]')
|
||||
) {
|
||||
return;
|
||||
}
|
||||
setOpen((prev) => !prev);
|
||||
e.preventDefault();
|
||||
setOpen((prev) => !prev);
|
||||
}
|
||||
if (e.key === 'Escape' && open) {
|
||||
setOpen(false);
|
||||
}
|
||||
};
|
||||
|
||||
document.addEventListener('keydown', handleKeyDown);
|
||||
return () => document.removeEventListener('keydown', handleKeyDown);
|
||||
}, []);
|
||||
}, [open]);
|
||||
|
||||
const filteredGroups = useMemo(() => {
|
||||
if (!search.trim()) return shortcutGroups;
|
||||
const q = search.toLowerCase();
|
||||
return shortcutGroups
|
||||
.map((group) => ({
|
||||
...group,
|
||||
shortcuts: group.shortcuts.filter(
|
||||
(s) =>
|
||||
s.keys.toLowerCase().includes(q) ||
|
||||
s.description.toLowerCase().includes(q)
|
||||
),
|
||||
}))
|
||||
.filter((group) => group.shortcuts.length > 0);
|
||||
}, [search]);
|
||||
|
||||
return (
|
||||
<Dialog open={open} onOpenChange={setOpen}>
|
||||
<DialogContent className="max-w-2xl">
|
||||
<DialogContent className="max-w-lg max-h-[80vh]">
|
||||
<DialogHeader>
|
||||
<DialogTitle>Keyboard shortcuts</DialogTitle>
|
||||
<DialogTitle>Keyboard Shortcuts</DialogTitle>
|
||||
<DialogDescription>
|
||||
Press <kbd className="rounded border bg-muted px-1">?</kbd> to toggle this help
|
||||
All available keyboard shortcuts for Project E.
|
||||
</DialogDescription>
|
||||
</DialogHeader>
|
||||
<div className="grid grid-cols-2 gap-4 max-h-[60vh] overflow-y-auto">
|
||||
<div>
|
||||
<h2 className="mb-2 text-sm font-semibold">Navigation</h2>
|
||||
<div className="space-y-1">
|
||||
{shortcuts
|
||||
.filter((s) => s.action.startsWith('navigate_'))
|
||||
.map((shortcut) => (
|
||||
<div key={shortcut.key} className="flex items-center justify-between text-sm">
|
||||
<span className="text-muted-foreground">{shortcut.description}</span>
|
||||
<kbd className="rounded border bg-muted px-2 py-0.5 text-xs font-mono">
|
||||
{shortcut.key}
|
||||
</kbd>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<h2 className="mb-2 text-sm font-semibold">Actions</h2>
|
||||
<div className="space-y-1">
|
||||
{shortcuts
|
||||
.filter((s) => !s.action.startsWith('navigate_'))
|
||||
.map((shortcut) => (
|
||||
<div key={shortcut.key} className="flex items-center justify-between text-sm">
|
||||
<span className="text-muted-foreground">{shortcut.description}</span>
|
||||
<kbd className="rounded border bg-muted px-2 py-0.5 text-xs font-mono">
|
||||
{shortcut.key}
|
||||
</kbd>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<Input
|
||||
placeholder="Search shortcuts..."
|
||||
value={search}
|
||||
onChange={(e) => setSearch(e.target.value)}
|
||||
className="mb-4"
|
||||
aria-label="Search shortcuts"
|
||||
/>
|
||||
|
||||
<ScrollArea className="flex-1 max-h-[50vh]">
|
||||
{filteredGroups.length === 0 ? (
|
||||
<p className="text-sm text-muted-foreground text-center py-8">
|
||||
No shortcuts match your search.
|
||||
</p>
|
||||
) : (
|
||||
filteredGroups.map((group) => (
|
||||
<div key={group.title} className="mb-6">
|
||||
<h3 className="text-sm font-semibold mb-2 text-muted-foreground uppercase tracking-wider">
|
||||
{group.title}
|
||||
</h3>
|
||||
<div className="space-y-2">
|
||||
{group.shortcuts.map((shortcut) => (
|
||||
<div
|
||||
key={shortcut.keys}
|
||||
className="flex items-center justify-between text-sm"
|
||||
>
|
||||
<span>{shortcut.description}</span>
|
||||
<kbd className="ml-4 inline-flex h-5 select-none items-center gap-1 rounded border bg-muted px-1.5 font-mono text-[10px] font-medium text-muted-foreground whitespace-nowrap">
|
||||
{shortcut.keys}
|
||||
</kbd>
|
||||
</div>
|
||||
))}
|
||||
</div>
|
||||
</div>
|
||||
))
|
||||
)}
|
||||
</ScrollArea>
|
||||
|
||||
<p className="text-xs text-muted-foreground text-center pt-2 border-t">
|
||||
Press <kbd className="rounded border bg-muted px-1 font-mono">?</kbd> to toggle this overlay
|
||||
</p>
|
||||
</DialogContent>
|
||||
</Dialog>
|
||||
);
|
||||
|
||||
+121
-5
@@ -1,26 +1,142 @@
|
||||
import { NextRequest, NextResponse } from 'next/server';
|
||||
|
||||
// ── Token bucket rate limiter ─────────────────────────────────────────────────────
|
||||
|
||||
interface TokenBucket {
|
||||
tokens: number;
|
||||
lastRefill: number;
|
||||
}
|
||||
|
||||
const buckets = new Map<string, TokenBucket>();
|
||||
|
||||
// REST API: 100 req/min, MCP: 300 req/min
|
||||
const RATE_LIMITS: Record<string, { maxTokens: number; refillMs: number }> = {
|
||||
rest: { maxTokens: 100, refillMs: 60000 },
|
||||
mcp: { maxTokens: 300, refillMs: 60000 },
|
||||
};
|
||||
|
||||
function getBucketKey(request: NextRequest): string {
|
||||
// Use API key if present, otherwise IP
|
||||
const apiKey = request.headers.get('Authorization')?.replace('Bearer ', '').trim();
|
||||
if (apiKey) return `apikey:${apiKey}`;
|
||||
|
||||
const forwardedFor = request.headers.get('x-forwarded-for');
|
||||
const ip = forwardedFor?.split(',')[0]?.trim() || '127.0.0.1';
|
||||
return `ip:${ip}`;
|
||||
}
|
||||
|
||||
function getRateLimitType(request: NextRequest): 'mcp' | 'rest' {
|
||||
const pathname = request.nextUrl.pathname;
|
||||
if (pathname === '/api/mcp') return 'mcp';
|
||||
return 'rest';
|
||||
}
|
||||
|
||||
function checkRateLimit(request: NextRequest): { allowed: boolean; limit: number; remaining: number; resetMs: number } {
|
||||
const key = getBucketKey(request);
|
||||
const type = getRateLimitType(request);
|
||||
const config = RATE_LIMITS[type];
|
||||
const now = Date.now();
|
||||
|
||||
let bucket = buckets.get(key);
|
||||
if (!bucket) {
|
||||
bucket = { tokens: config.maxTokens, lastRefill: now };
|
||||
buckets.set(key, bucket);
|
||||
}
|
||||
|
||||
// Refill tokens
|
||||
const elapsed = now - bucket.lastRefill;
|
||||
const tokensToAdd = Math.floor(elapsed / config.refillMs) * config.maxTokens;
|
||||
if (tokensToAdd > 0) {
|
||||
bucket.tokens = Math.min(config.maxTokens, bucket.tokens + tokensToAdd);
|
||||
bucket.lastRefill = now;
|
||||
}
|
||||
|
||||
const allowed = bucket.tokens >= 1;
|
||||
if (allowed) {
|
||||
bucket.tokens -= 1;
|
||||
}
|
||||
|
||||
// Calculate reset time
|
||||
const resetMs = bucket.lastRefill + config.refillMs;
|
||||
|
||||
return {
|
||||
allowed,
|
||||
limit: config.maxTokens,
|
||||
remaining: Math.max(0, Math.floor(bucket.tokens)),
|
||||
resetMs,
|
||||
};
|
||||
}
|
||||
|
||||
// Periodically clean up stale buckets (every 5 minutes)
|
||||
setInterval(() => {
|
||||
const now = Date.now();
|
||||
for (const [key, bucket] of buckets.entries()) {
|
||||
if (now - bucket.lastRefill > 120000) { // 2 minutes stale
|
||||
buckets.delete(key);
|
||||
}
|
||||
}
|
||||
}, 300000).unref();
|
||||
|
||||
// ── Excluded routes ──────────────────────────────────────────────────────────────
|
||||
|
||||
const EXCLUDED_ROUTES = [
|
||||
'/api/health',
|
||||
'/api/realtime',
|
||||
'/api/auth',
|
||||
'/_next',
|
||||
'/favicon.ico',
|
||||
];
|
||||
|
||||
function isExcluded(pathname: string): boolean {
|
||||
return EXCLUDED_ROUTES.some(route => pathname.startsWith(route));
|
||||
}
|
||||
|
||||
// ── Middleware ────────────────────────────────────────────────────────────────────
|
||||
|
||||
export function middleware(request: NextRequest) {
|
||||
const pathname = request.nextUrl.pathname;
|
||||
|
||||
// Skip rate limiting for excluded routes
|
||||
if (isExcluded(pathname)) {
|
||||
return NextResponse.next();
|
||||
}
|
||||
|
||||
// Check if user is authenticated
|
||||
const token = request.cookies.get('next-auth.session-token')?.value
|
||||
|| request.cookies.get('__Secure-next-auth.session-token')?.value;
|
||||
|
||||
// Protected routes (v1 + v2)
|
||||
// If no token and trying to access protected routes, redirect to login
|
||||
const protectedRoutes = [
|
||||
'/dashboard', '/tasks', '/habits', '/projects', '/notes', '/reports',
|
||||
'/calendar', '/analytics', '/agents', '/settings',
|
||||
'/graph', '/domains',
|
||||
];
|
||||
if (!token && protectedRoutes.some((route) => request.nextUrl.pathname === route || request.nextUrl.pathname.startsWith(`${route}/`))) {
|
||||
if (!token && protectedRoutes.some((route) => pathname === route || pathname.startsWith(`${route}/`))) {
|
||||
const loginUrl = new URL('/login', request.url);
|
||||
return NextResponse.redirect(loginUrl);
|
||||
}
|
||||
|
||||
// Create response
|
||||
// Rate limiting for API routes
|
||||
if (pathname.startsWith('/api/')) {
|
||||
const result = checkRateLimit(request);
|
||||
|
||||
const response = result.allowed
|
||||
? NextResponse.next()
|
||||
: NextResponse.json(
|
||||
{ error: { code: 'RATE_LIMITED', message: 'Too many requests. Please slow down.' } },
|
||||
{ status: 429 }
|
||||
);
|
||||
|
||||
response.headers.set('X-RateLimit-Limit', String(result.limit));
|
||||
response.headers.set('X-RateLimit-Remaining', String(result.remaining));
|
||||
response.headers.set('X-RateLimit-Reset', String(Math.ceil(result.resetMs / 1000)));
|
||||
|
||||
return response;
|
||||
}
|
||||
|
||||
// Create response for non-API routes
|
||||
const response = NextResponse.next();
|
||||
|
||||
// Forward proxy headers for proper client IP detection
|
||||
// Nginx Proxy Manager sets X-Forwarded-For and X-Forwarded-Proto
|
||||
const forwardedFor = request.headers.get('x-forwarded-for');
|
||||
const forwardedProto = request.headers.get('x-forwarded-proto');
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user