clover's git

home-infra

1	use crate::*;
2	use rmcp::{
3	ErrorData, RoleServer, ServerHandler,
4	model::{
5	CallToolRequestParams, CallToolResponse, CallToolResult, ContentBlock, ListToolsResult,
6	PaginatedRequestParams, ServerCapabilities, ServerConfig, Tool, ToolAnnotations,
7	},
8	service::RequestContext,
9	};
10	use scraper::{Html, Selector};
11
12	pub struct Backend {
13	pub(crate) origin: url::Url,
14	http: reqwest::Client,
15	slots: Semaphore,
16	}
17	impl Backend {
18	pub fn new(address: &str, http: reqwest::ClientBuilder) -> Result<Self> {
19	let origin = url::Url::parse(address)?;
20	if origin.scheme() != "https"
21	|| origin.host_str().is_none()
22	|| !origin.username().is_empty()
23	|| origin.password().is_some()
24	|| origin.path() != "/"
25	|| origin.query().is_some()
26	|| origin.fragment().is_some()
27	{
28	return Err(Error::new(500, "Set an HTTPS origin for Shale."));
29	}
30	Ok(Self {
31	origin,
32	http: http
33	.redirect(reqwest::redirect::Policy::none())
34	.retry(reqwest::retry::never())
35	.build()?,
36	slots: Semaphore::new(8),
37	})
38	}
39	async fn get(
40	&self,
41	path: &str,
42	session: Option<&str>,
43	) -> Result<(StatusCode, HeaderMap, String)> {
44	self.request(Method::GET, self.origin.join(path)?, session, None)
45	.await
46	}
47	async fn request(
48	&self,
49	method: Method,
50	target: url::Url,
51	session: Option<&str>,
52	form: Option<&HashMap<String, String>>,
53	) -> Result<(StatusCode, HeaderMap, String)> {
54	if target.origin() != self.origin.origin()
55	|| !target.username().is_empty()
56	|| target.password().is_some()
57	|| target.fragment().is_some()
58	{
59	return Err(Error::new(400, "Open a page on this Shale instance."));
60	}
61	let _slot = tokio::time::timeout(Duration::from_secs(5), self.slots.acquire())
62	.await
63	.map_err(|_| Error::new(429, "Shale is busy. Try again in a moment."))??;
64	let mut request = self.http.request(method, target.clone());
65	if let Some(session) = session {
66	let mut cookie = axum::http::HeaderValue::from_str(&format!("SessionID={session}"))?;
67	cookie.set_sensitive(true);
68	request = request.header("cookie", cookie);
69	}
70	if let Some(form) = form {
71	request = request
72	.header("origin", self.origin.origin().ascii_serialization())
73	.header("referer", target.as_str())
74	.form(form);
75	}
76	let mut response = request
77	.send()
78	.await
79	.map_err(|_| Error::new(502, "Shale couldn't answer. Open it and check its status."))?;
80	let status = response.status();
81	let headers = response.headers().clone();
82	let mut body = Vec::new();
83	while let Some(chunk) = response.chunk().await.map_err(|_| {
84	Error::new(
85	502,
86	"The Shale response was interrupted. Open it to check the result.",
87	)
88	})? {
89	if body.len() + chunk.len() > 4 * 1024 * 1024 {
90	return Err(Error::new(
91	502,
92	"The Shale page is too large. Narrow the selection.",
93	));
94	}
95	body.extend_from_slice(&chunk);
96	}
97	Ok((status, headers, String::from_utf8(body)?))
98	}
99	async fn page(&self, target: &url::Url, session: &str) -> Result<String> {
100	let (status, _, body) = self
101	.request(Method::GET, target.clone(), Some(session), None)
102	.await?;
103	match status {
104	StatusCode::OK => Ok(body),
105	StatusCode::BAD_REQUEST => Err(Error::new(
106	400,
107	"Shale rejected this request. Check the fields or use Shale's issue filter syntax.",
108	)),
109	StatusCode::FORBIDDEN | StatusCode::NOT_FOUND => Err(Error::new(
110	403,
111	"Shale doesn't allow access to this repository. Check your account's permissions.",
112	)),
113	status if status.is_redirection() || status == StatusCode::UNAUTHORIZED => {
114	Err(Error::new(401, "The Shale session expired. Link it again."))
115	}
116	_ => Err(Error::new(
117	502,
118	"Shale couldn't open this page. Check it in Shale.",
119	)),
120	}
121	}
122	}
123
124	fn document(html: &str, page: &str, repository: Option<&str>) -> Result<Html> {
125	let document = Html::parse_document(html);
126	if document
127	.select(&Selector::parse("body").unwrap())
128	.next()
129	.and_then(|body| body.attr("id"))
130	!= Some(page)
131	|| repository.is_some_and(|name| {
132	document
133	.select(&Selector::parse("meta[name='astheno.shale.repo.name']").unwrap())
134	.next()
135	.and_then(|meta| meta.attr("content"))
136	!= Some(name)
137	})
138	{
139	return Err(Error::new(
140	502,
141	"Shale's page changed. Open it to check the result.",
142	));
143	}
144	Ok(document)
145	}
146	fn text(element: scraper::ElementRef<'_>) -> String {
147	element.text().collect::<String>().trim().to_owned()
148	}
149	fn repository_path(origin: &url::Url, repository: &str, suffix: &[&str]) -> Result<url::Url> {
150	if repository.is_empty()
151	|| repository.len() > 255
152	|| matches!(repository, "." | ".." | "-")
153	|| repository
154	.chars()
155	.any(|c| c.is_control() || c.is_whitespace() || "/\\%?#".contains(c))
156	{
157	return Err(Error::new(
158	400,
159	"Choose a repository from this connection's access.",
160	));
161	}
162	let mut target = origin.clone();
163	target
164	.path_segments_mut()
165	.unwrap()
166	.clear()
167	.push(repository)
168	.extend(suffix.iter().copied());
169	Ok(target)
170	}
171	fn session(app: &App, owner: &str) -> Result<String> {
172	let credential = mcp::get(
173	&app.mcp.db.lock().unwrap(),
174	&format!("shale-session:{owner}"),
175	)?;
176	if credential["origin"] != app.shale.origin.as_str() {
177	return Err(Error::new(
178	401,
179	"Link your Shale account from the dashboard's MCP tab.",
180	));
181	}
182	credential["session"]
183	.as_str()
184	.map(str::to_owned)
185	.ok_or_else(|| Error::new(401, "Link your Shale account from the dashboard's MCP tab."))
186	}
187	pub async fn repositories(app: &App, owner: &str) -> Result<Vec<Value>> {
188	let session = session(app, owner)?;
189	username(
190	&app.shale
191	.page(&app.shale.origin.join("/-/settings")?, &session)
192	.await?,
193	)?;
194	let body = app.shale.page(&app.shale.origin, &session).await?;
195	let document = document(&body, "page-index", None)?;
196	let mut repositories = Vec::new();
197	for row in document.select(&Selector::parse(".grid-container table tbody tr").unwrap()) {
198	let cells: Vec<_> = row.select(&Selector::parse("td").unwrap()).collect();
199	if cells.len() != 3 {
200	return Err(Error::new(
201	502,
202	"Shale's repository list changed. Open Shale to browse it.",
203	));
204	}
205	let link = cells[0]
206	.select(&Selector::parse("a").unwrap())
207	.next()
208	.ok_or_else(|| {
209	Error::new(
210	502,
211	"Shale's repository list changed. Open Shale to browse it.",
212	)
213	})?;
214	let name = text(link);
215	let target = app
216	.shale
217	.origin
218	.join(link.attr("href").unwrap_or_default())?;
219	if target != repository_path(&app.shale.origin, &name, &[""])?
220	|| repositories.iter().any(|r: &Value| r["id"] == name)
221	{
222	return Err(Error::new(
223	502,
224	"Shale's repository list changed. Open Shale to browse it.",
225	));
226	}
227	repositories.push(json!({"id":name,"name":name,"description":text(cells[1])}));
228	}
229	if repositories.len() > 1024 {
230	return Err(Error::new(
231	502,
232	"The repository list is too large. Open Shale to narrow it.",
233	));
234	}
235	Ok(repositories)
236	}
237	fn issue(html: &str, repository: &str, id: Option<u64>) -> Result<Value> {
238	let document = document(html, "page-issue", Some(repository))?;
239	let spans: Vec<_> = document
240	.select(&Selector::parse("h1 > span").unwrap())
241	.collect();
242	let issue_id = spans.first().and_then(|s| {
243	text(*s)
244	.strip_prefix('#')
245	.and_then(|s| s.parse::<u64>().ok())
246	});
247	let status = document
248	.select(&Selector::parse("select[name=status] option[selected]").unwrap())
249	.next()
250	.and_then(|e| e.attr("value"));
251	if spans.len() != 2
252	|| issue_id.is_none_or(|n| n == 0 || id.is_some_and(|id| n != id))
253	|| status.is_none()
254	{
255	return Err(Error::new(
256	502,
257	"Shale's issue page changed. Open the issue to check it.",
258	));
259	}
260	let mut comments = Vec::new();
261	for comment in document.select(&Selector::parse("li.comment").unwrap()) {
262	let content = comment
263	.select(&Selector::parse(".markdown").unwrap())
264	.next()
265	.ok_or_else(|| {
266	Error::new(
267	502,
268	"Shale's comments changed. Open the issue to read them.",
269	)
270	})?;
271	let author = comment
272	.select(&Selector::parse(".n-card__header a[href^='/~']").unwrap())
273	.next()
274	.map(text);
275	let time = comment
276	.select(&Selector::parse(".n-card__header span[title]").unwrap())
277	.next()
278	.and_then(|e| e.attr("title"));
279	comments.push(
280	json!({"id":comment.attr("id"),"author":author,"createdAt":time,"text":text(content)}),
281	);
282	}
283	let labels: Vec<_> = document
284	.select(&Selector::parse("dd.sidebar-labels a").unwrap())
285	.map(text)
286	.collect();
287	Ok(
288	json!({"repository":repository,"id":issue_id,"title":text(spans[1]),"status":status,"labels":labels,"comments":comments}),
289	)
290	}
291	fn current(app: &App, grant: &Value, credential: &str) -> Result<()> {
292	let db = app.mcp.db.lock().unwrap();
293	if mcp::get(&db, &format!("grant:{}", string(&grant["id"])))? != *grant
294	|| mcp::get(&db, &format!("shale-session:{}", string(&grant["user"])))?["session"]
295	!= credential
296	{
297	return Err(Error::new(
298	401,
299	"This connection changed or was revoked. Connect again.",
300	));
301	}
302	Ok(())
303	}
304
305	#[derive(Clone)]
306	struct Shale(Arc<App>);
307	impl ServerHandler for Shale {
308	fn get_info(&self) -> ServerConfig {
309	ServerConfig::new(ServerCapabilities::builder().enable_tools().build())
310	}
311	async fn list_tools(
312	&self,
313	_: Option<PaginatedRequestParams>,
314	_: RequestContext<RoleServer>,
315	) -> std::result::Result<ListToolsResult, ErrorData> {
316	let tools = [
317	("list_repositories", "List repositories granted to this connection.", json!({}), json!([]), true),
318	("list_issues", "List issues in one granted repository.", json!({"repository":{"type":"string"},"q":{"type":"string","maxLength":4096,"description":"Shale filters using is, status, sort, limit, label, or author prefixes, such as is:open. Plain text search is unsupported."}}), json!(["repository"]), true),
319	("get_issue", "Read an issue with rendered comment text and labels.", json!({"repository":{"type":"string"},"id":{"type":"integer","minimum":1}}), json!(["repository","id"]), true),
320	("create_issue", "Create an issue. If the outcome is unknown, inspect the repository before retrying.", json!({"repository":{"type":"string"},"title":{"type":"string","minLength":1,"maxLength":4096},"description":{"type":"string","maxLength":262144}}), json!(["repository","title"]), false),
321	("comment_issue", "Add a comment. If the outcome is unknown, inspect the issue before retrying.", json!({"repository":{"type":"string"},"id":{"type":"integer","minimum":1},"comment":{"type":"string","minLength":1,"maxLength":262144}}), json!(["repository","id","comment"]), false),
322	("set_issue_status", "Change issue status using an available Shale status.", json!({"repository":{"type":"string"},"id":{"type":"integer","minimum":1},"status":{"type":"string","maxLength":64}}), json!(["repository","id","status"]), false),
323	("set_issue_title", "Change an issue title.", json!({"repository":{"type":"string"},"id":{"type":"integer","minimum":1},"title":{"type":"string","minLength":1,"maxLength":4096}}), json!(["repository","id","title"]), false),
324	].into_iter().map(|(name, description, properties, required, read)| {
325	Tool::new(name, description, json!({"type":"object","properties":properties,"required":required,"additionalProperties":false}).as_object().unwrap().clone())
326	.with_annotations(ToolAnnotations::new().read_only(read).idempotent(read))
327	}).collect();
328	Ok(ListToolsResult {
329	tools,
330	..Default::default()
331	})
332	}
333	async fn call_tool(
334	&self,
335	request: CallToolRequestParams,
336	context: RequestContext<RoleServer>,
337	) -> std::result::Result<CallToolResponse, ErrorData> {
338	let result: Result<Value> = async {
339	let app = &self.0;
340	let grant = &context.extensions.get::<axum::http::request::Parts>()
341	.and_then(|p| p.extensions.get::<mcp::Grant>())
342	.ok_or_else(|| Error::new(401, "This connection expired. Connect again."))?.0;
343	let name = request.name.as_ref();
344	let arguments = request.arguments.unwrap_or_default();
345	let allowed: &[&str] = match name {
346	"list_repositories" => &[], "list_issues" => &["repository", "q"], "get_issue" => &["repository", "id"],
347	"create_issue" => &["repository", "title", "description"], "comment_issue" => &["repository", "id", "comment"],
348	"set_issue_status" => &["repository", "id", "status"], "set_issue_title" => &["repository", "id", "title"],
349	_ => return Err(Error::new(404, "No tool with that name.")),
350	};
351	if arguments.keys().any(|key| !allowed.contains(&key.as_str())) {
352	return Err(Error::new(400, "Use the fields listed for this tool."));
353	}
354	let write = !matches!(name, "list_repositories" | "list_issues" | "get_issue");
355	if !array(&grant["scopes"]).iter().any(|s| s == if write {"shale:write"} else {"shale:read"}) {
356	return Err(Error::new(403, "This connection allows reads only. Connect again to request issue editing."));
357	}
358	let credential = session(app, string(&grant["user"]))?;
359	current(app, grant, &credential)?;
360	if name == "list_repositories" {
361	let mut repositories = repositories(app, string(&grant["user"])).await?;
362	repositories.retain(|r| array(&grant["resources"]).contains(&r["id"]));
363	current(app, grant, &credential)?;
364	return Ok(json!({"repositories":repositories}));
365	}
366	let repository = arguments.get("repository").and_then(Value::as_str)
367	.filter(|r| array(&grant["resources"]).iter().any(|id| id == *r))
368	.ok_or_else(|| Error::new(403, "Choose a repository granted to this connection."))?;
369	let mut target = repository_path(&app.shale.origin, repository, &["issues", ""])?;
370	let issue_id = if matches!(name, "list_issues" | "create_issue") { None } else {
371	Some(arguments.get("id").and_then(Value::as_u64).filter(|n| *n > 0)
372	.ok_or_else(|| Error::new(400, "Choose a positive issue ID."))?)
373	};
374	if let Some(id) = issue_id { target = repository_path(&app.shale.origin, repository, &["issues", &id.to_string()])?; }
375	if name == "create_issue" { target = repository_path(&app.shale.origin, repository, &["issues", "new"])?; }
376	if let Some(q) = arguments.get("q") {
377	let q = q.as_str().filter(|q| q.len() <= 4096).ok_or_else(|| Error::new(400, "Narrow the issue search."))?;
378	target.query_pairs_mut().append_pair("q", q);
379	}
380	let mut fields = HashMap::new();
381	for (key, max) in [("title", 4096), ("description", 262144), ("comment", 262144), ("status", 64)] {
382	if allowed.contains(&key) {
383	let value = arguments.get(key).and_then(Value::as_str)
384	.filter(|v| v.len() <= max && (key == "description" || !v.trim().is_empty()))
385	.or_else(|| (key == "description" && !arguments.contains_key(key)).then_some(""))
386	.ok_or_else(|| Error::new(400, format!("Enter {key} within the tool's size limit.")))?;
387	fields.insert(key.to_owned(), value.to_owned());
388	}
389	}
390	username(&app.shale.page(&app.shale.origin.join("/-/settings")?, &credential).await?)?;
391	let body = app.shale.page(&target, &credential).await?;
392	if name == "list_issues" {
393	let document = document(&body, "page-issues", Some(repository))?;
394	let mut issues = Vec::new();
395	for row in document.select(&Selector::parse(".grid-container table tbody tr").unwrap()) {
396	let cells: Vec<_> = row.select(&Selector::parse("td").unwrap()).collect();
397	if cells.len() != 6 { return Err(Error::new(502, "Shale's issue list changed. Open it in Shale.")); }
398	let id = text(cells[0]).strip_prefix('#').and_then(|s| s.parse::<u64>().ok()).filter(|n| *n > 0)
399	.ok_or_else(|| Error::new(502, "Shale's issue list changed. Open it in Shale."))?;
400	let status = cells[1].select(&Selector::parse("span[class]").unwrap())
401	.flat_map(|span| span.value().classes()).find_map(|class| class.strip_prefix("issuestatus-"))
402	.filter(|status| !status.is_empty())
403	.ok_or_else(|| Error::new(502, "Shale's issue list changed. Open it in Shale."))?;
404	issues.push(json!({"id":id,"title":text(cells[2]),"status":status,"author":text(cells[3]),
405	"modifiedAt":cells[4].select(&Selector::parse("span[title]").unwrap()).next().and_then(|e| e.attr("title")),
406	"createdAt":cells[5].select(&Selector::parse("span[title]").unwrap()).next().and_then(|e| e.attr("title"))}));
407	}
408	current(app, grant, &credential)?;
409	return Ok(json!({"repository":repository,"issues":issues}));
410	}
411	if !write {
412	let issue = issue(&body, repository, issue_id)?;
413	current(app, grant, &credential)?;
414	return Ok(json!({"issue":issue}));
415	}
416	let form_body = if name == "set_issue_title" {
417	issue(&body, repository, issue_id)?;
418	let mut edit = target.clone(); edit.query_pairs_mut().append_pair("edit", "title");
419	app.shale.page(&edit, &credential).await?
420	} else { body };
421	let post_target = {
422	let document = if name == "set_issue_title" { Html::parse_fragment(&form_body) } else {
423	document(&form_body, if name == "create_issue" {"page-new-issue"} else {"page-issue"}, Some(repository))?
424	};
425	let forms: Vec<_> = document.select(&Selector::parse("form[method=post]").unwrap())
426	.filter(|form| if name == "create_issue" { form.select(&Selector::parse("input[name=title]").unwrap()).next().is_some() }
427	else { form.select(&Selector::parse("input[name=t]").unwrap()).any(|input| input.attr("value") == Some(match name {
428	"comment_issue" => "comment", "set_issue_status" => "status", _ => "title",
429	})) }).collect();
430	if forms.len() != 1 { return Err(Error::new(502, "Shale's issue form changed. Open the issue to edit it.")); }
431	let form = forms[0];
432	let post_target = target.join(form.attr("action").unwrap_or_default())?;
433	if post_target != target || form.attr("enctype").is_some_and(|s| s != "application/x-www-form-urlencoded") {
434	return Err(Error::new(502, "Shale's form destination changed. Open the issue to edit it."));
435	}
436	if name == "set_issue_status" && !form.select(&Selector::parse("select[name=status] option").unwrap())
437	.any(|option| option.attr("value") == fields.get("status").map(String::as_str)) {
438	return Err(Error::new(400, "Choose a status available on this issue in Shale."));
439	}
440	for field in form.select(&Selector::parse("input[type=hidden], input[hidden]").unwrap()) {
441	if let Some(name) = field.attr("name") {
442	if fields.insert(name.to_owned(), field.attr("value").unwrap_or_default().to_owned()).is_some() {
443	return Err(Error::new(502, "Shale's form fields changed. Open the issue to edit it."));
444	}
445	}
446	}
447	fields.insert("timezone".to_owned(), "UTC".to_owned());
448	fields.insert("tzoffset".to_owned(), "+00:00".to_owned());
449	post_target
450	};
451	current(app, grant, &credential)?;
452	let outcome: Result<Value> = async {
453	let (status, headers, body) = app.shale.request(Method::POST, post_target.clone(), Some(&credential), Some(&fields)).await?;
454	let body = if matches!(status, StatusCode::SEE_OTHER | StatusCode::FOUND) {
455	let target = headers.get("location").and_then(|v| v.to_str().ok())
456	.and_then(|location| post_target.join(location).ok())
457	.ok_or_else(|| Error::new(502, "Shale didn't return an issue destination."))?;
458	let prefix = repository_path(&app.shale.origin, repository, &["issues", ""])?;
459	if target.origin() != app.shale.origin.origin() || !target.path().starts_with(prefix.path())
460	|| target.query().is_some() || target.fragment().is_some()
461	|| target.path()[prefix.path().len()..].parse::<u64>().ok().is_none_or(|n| n == 0)
462	|| !target.username().is_empty() || target.password().is_some()
463	{ return Err(Error::new(502, "Shale returned a different destination.")); }
464	app.shale.page(&target, &credential).await?
465	} else if status == StatusCode::OK { body } else {
466	return Err(Error::new(502, "Shale didn't confirm the issue change."));
467	};
468	let result = issue(&body, repository, issue_id)?;
469	current(app, grant, &credential)?;
470	Ok(json!({"issue":result}))
471	}.await;
472	outcome.map_err(|_| Error::new(502, "The write outcome is unknown. Check the issue in Shale before retrying."))
473	}.await;
474	Ok(match result {
475	Ok(value) => CallToolResult::structured(value),
476	Err(error) => CallToolResult::error(vec![ContentBlock::text(error.message)]),
477	}
478	.into())
479	}
480	}
481	pub fn router(app: Arc<App>) -> Router {
482	let state = app.clone();
483	mcp::router(app, "shale", move || Ok(Shale(state.clone())))
484	}
485
486	fn session_cookie(headers: &HeaderMap) -> Result<String> {
487	let sessions: Vec<_> = headers
488	.get_all("set-cookie")
489	.iter()
490	.filter_map(|value| value.to_str().ok())
491	.filter_map(|value| value.split(';').next()?.strip_prefix("SessionID="))
492	.collect();
493	if sessions.len() != 1
494	|| sessions[0].is_empty()
495	|| sessions[0].len() > 4096
496	|| !sessions[0]
497	.bytes()
498	.all(|b| matches!(b, 0x21 | 0x23..=0x2b | 0x2d..=0x3a | 0x3c..=0x5b | 0x5d..=0x7e))
499	{
500	return Err(Error::new(
501	502,
502	"Shale didn't return a session. Link it again.",
503	));
504	}
505	Ok(sessions[0].to_owned())
506	}
507	fn fields(query: &str) -> Result<HashMap<String, String>> {
508	if query.len() > 16384 {
509	return Err(Error::new(
510	400,
511	"This sign-in response is too large. Link Shale again.",
512	));
513	}
514	let mut fields = HashMap::new();
515	for (key, value) in url::form_urlencoded::parse(query.as_bytes()) {
516	if fields
517	.insert(key.into_owned(), value.into_owned())
518	.is_some()
519	{
520	return Err(Error::new(
521	400,
522	"This sign-in response has repeated fields. Link Shale again.",
523	));
524	}
525	}
526	Ok(fields)
527	}
528	fn username(page: &str) -> Result<String> {
529	let document = Html::parse_document(page);
530	if document
531	.select(&Selector::parse("body#page-user-settings").unwrap())
532	.next()
533	.is_none()
534	{
535	return Err(Error::new(401, "The Shale session expired. Link it again."));
536	}
537	let names: Vec<_> = document
538	.select(&Selector::parse("kbd").unwrap())
539	.map(|element| element.text().collect::<String>())
540	.collect();
541	if names.len() != 1 || names[0].is_empty() {
542	return Err(Error::new(
543	502,
544	"Shale's account page changed. Open Shale to check your account.",
545	));
546	}
547	Ok(names.into_iter().next().unwrap())
548	}
549
550	pub async fn manage(
551	app: Arc<App>,
552	method: &Method,
553	owner: &Value,
554	body: &Value,
555	) -> Result<Response> {
556	let owner_id = string(&owner["id"]);
557	let key = format!("shale-session:{owner_id}");
558	match *method {
559	Method::POST => {
560	let pending = if let Some(id) = body["request"].as_str() {
561	let db = app.mcp.db.lock().unwrap();
562	let key = format!("pending:{}", mcp::hash(id));
563	let pending = mcp::get(&db, &key)?;
564	if pending["owner"] != owner_id || pending["resource"] != app.mcp.resource("shale")
565	{
566	return Err(Error::new(
567	403,
568	"Open your Shale connection request before linking.",
569	));
570	}
571	Some(id.to_owned())
572	} else {
573	None
574	};
575	let (status, headers, _) = app.shale.get("/-/login", None).await?;
576	if status != StatusCode::FOUND {
577	return Err(Error::new(
578	502,
579	"Shale couldn't start sign-in. Open Shale and try again.",
580	));
581	}
582	let authorization = url::Url::parse(
583	headers
584	.get("location")
585	.and_then(|v| v.to_str().ok())
586	.unwrap_or_default(),
587	)?;
588	let issuer = url::Url::parse(&env(
589	"STUDIO_KEYCLOAK_URL",
590	&format!("https://auth.{}", env("STUDIO_DOMAIN", "studio.test")),
591	))?;
592	let parameters = fields(authorization.query().unwrap_or_default())?;
593	if authorization.origin() != issuer.origin()
594	|| authorization.path() != "/realms/master/protocol/openid-connect/auth"
595	|| !authorization.username().is_empty()
596	|| authorization.password().is_some()
597	|| authorization.fragment().is_some()
598	|| parameters.get("redirect_uri")
599	!= Some(&app.shale.origin.join("/-/callback")?.to_string())
600	|| parameters.get("response_type").map(String::as_str) != Some("code")
601	|| parameters
602	.get("state")
603	.is_none_or(|s| s.is_empty() || s.len() > 1024)
604	{
605	return Err(Error::new(
606	502,
607	"Shale's sign-in destination doesn't match this instance. Check its OIDC settings.",
608	));
609	}
610	let nonce = mcp::secret();
611	let mut db = app.mcp.db.lock().unwrap();
612	let tx = db.transaction()?;
613	tx.execute("DELETE FROM records WHERE substr(key,1,11)='shale-link:' AND json_extract(value,'$.owner')=?", [owner_id])?;
614	mcp::put(
615	&tx,
616	&format!("shale-link:{}", mcp::hash(&nonce)),
617	&json!({"owner":owner_id,"authorization":authorization.as_str(),"phase":"prepared","request":pending}),
618	600,
619	)?;
620	tx.commit()?;
621	Ok(axum::Json(json!({"redirect":app.shale.origin.join(&format!("/-/studio-mcp/{nonce}"))?.as_str()})).into_response())
622	}
623	Method::DELETE => {
624	let session = {
625	let mut db = app.mcp.db.lock().unwrap();
626	let tx = db.transaction()?;
627	let session = mcp::get(&tx, &key)?;
628	mcp::delete(&tx, &key)?;
629	for grant in mcp::list(&tx, "grant:")? {
630	if grant["user"] == owner_id && grant["resource"] == app.mcp.resource("shale") {
631	mcp::revoke(&tx, string(&grant["id"]))?;
632	}
633	}
634	tx.execute("DELETE FROM records WHERE substr(key,1,11)='shale-link:' AND json_extract(value,'$.owner')=?", [owner_id])?;
635	tx.commit()?;
636	session
637	};
638	if session["origin"] == app.shale.origin.as_str() {
639	app.shale
640	.get("/-/logout", session["session"].as_str())
641	.await?;
642	}
643	Ok(StatusCode::NO_CONTENT.into_response())
644	}
645	_ => Err(Error::new(405, "Link or unlink Shale from MCP settings.")),
646	}
647	}
648
649	pub async fn oauth(app: Arc<App>, request: Request) -> Response {
650	let callback = request.uri().path() == "/oauth/shale/callback";
651	let result: Result<Response> = async move {
652	if request.method() != Method::GET
653	|| request.headers().get("host").and_then(|v| v.to_str().ok()) != Some(&app.shale.origin[url::Position::BeforeHost..url::Position::AfterPort])
654	|| request.headers().get("origin").is_some_and(|v| v.to_str().ok() != Some(app.shale.origin.origin().ascii_serialization().as_str()))
655	{
656	return Err(Error::new(403, "Start Shale linking from your dashboard's MCP tab."));
657	}
658	if let Some(nonce) = request.uri().path().strip_prefix("/oauth/shale/link/") {
659	if nonce.len() != 43 || !nonce.bytes().all(|b| b.is_ascii_alphanumeric() || b"_-".contains(&b)) || request.uri().query().is_some() {
660	return Err(Error::new(400, "This Shale link is incomplete. Start linking again."));
661	}
662	let mut db = app.mcp.db.lock().unwrap();
663	let tx = db.transaction()?;
664	let key = format!("shale-link:{}", mcp::hash(nonce));
665	let mut link = mcp::get(&tx, &key)?;
666	if link.is_null() || link["phase"] != "prepared" {
667	return Err(Error::new(410, "This Shale link expired or was used. Start linking again."));
668	}
669	link["phase"] = json!("claimed");
670	tx.execute("UPDATE records SET value=? WHERE key=?", rusqlite::params![link.to_string(), key])?;
671	tx.commit()?;
672	return Ok((StatusCode::FOUND, [
673	("location", string(&link["authorization"]).to_owned()),
674	("set-cookie", format!("studio_mcp_shale_link={nonce}; Path=/-/callback; Secure; HttpOnly; SameSite=Lax; Max-Age=600")),
675	]).into_response());
676	}
677	if !callback {
678	return Err(Error::new(404, "No Shale sign-in endpoint here."));
679	}
680	let cookies: Vec<_> = request.headers().get_all("cookie").iter()
681	.filter_map(|v| v.to_str().ok()).flat_map(|v| v.split(';'))
682	.filter_map(|part| part.trim().strip_prefix("studio_mcp_shale_link=")).collect();
683	if cookies.len() != 1 || cookies[0].len() != 43 {
684	return Err(Error::new(400, "This Shale link cookie is missing. Start linking again."));
685	}
686	let query = request.uri().query().unwrap_or_default().to_owned();
687	let parameters = fields(&query)?;
688	let pending_key = format!("shale-link:{}", mcp::hash(cookies[0]));
689	let link = {
690	let mut db = app.mcp.db.lock().unwrap();
691	let tx = db.transaction()?;
692	let mut link = mcp::get(&tx, &pending_key)?;
693	if link.is_null() || link["phase"] != "claimed" {
694	return Err(Error::new(410, "This Shale link expired or was used. Start linking again."));
695	}
696	let authorization = url::Url::parse(string(&link["authorization"]))?;
697	let expected = fields(authorization.query().unwrap_or_default())?;
698	if parameters.get("state") != expected.get("state") {
699	return Err(Error::new(403, "This response belongs to another Shale sign-in. Start linking again."));
700	}
701	link["phase"] = json!("processing");
702	tx.execute("UPDATE records SET value=? WHERE key=?", rusqlite::params![link.to_string(), pending_key])?;
703	tx.commit()?;
704	link
705	};
706	if parameters.get("code").is_none_or(|code| code.is_empty() || code.len() > 4096) || parameters.contains_key("error") {
707	return Err(Error::new(400, "Shale sign-in was declined or incomplete. Start linking again."));
708	}
709	let identity = host::call(json!({"operation":"iam.request", "path":format!("/users/{}/shale-username", string(&link["owner"])), "method":"GET", "body":null})).await?;
710	if identity["body"]["enabled"] != true {
711	return Err(Error::new(403, "This dashboard account is disabled. Contact its administrator."));
712	}
713	let (status, headers, _) = app.shale.get(&format!("/-/callback?{query}"), None).await?;
714	if !status.is_redirection() {
715	return Err(Error::new(502, "Shale couldn't finish sign-in. Link it again."));
716	}
717	let session = session_cookie(&headers)?;
718	let verified: Result<()> = async {
719	let (status, _, body) = app.shale.get("/-/settings", Some(&session)).await?;
720	if status != StatusCode::OK || username(&body)? != identity["body"]["username"] {
721	return Err(Error::new(403, "Sign in to Shale with the same account as your dashboard, then link it again."));
722	}
723	let owner = string(&link["owner"]);
724	let session_key = format!("shale-session:{owner}");
725	let previous = mcp::get(&app.mcp.db.lock().unwrap(), &session_key)?;
726	if previous["origin"] == app.shale.origin.as_str() && previous["session"] != session {
727	app.shale.get("/-/logout", previous["session"].as_str()).await?;
728	}
729	let mut db = app.mcp.db.lock().unwrap();
730	let tx = db.transaction()?;
731	if mcp::get(&tx, &pending_key)?["phase"] != "processing" {
732	return Err(Error::new(410, "This Shale link was cancelled. Start linking again."));
733	}
734	mcp::put(&tx, &session_key, &json!({"origin":app.shale.origin.as_str(),"session":session,"linkedAt":now()}), 0)?;
735	mcp::delete(&tx, &pending_key)?;
736	tx.commit()?;
737	Ok(())
738	}.await;
739	if let Err(error) = verified {
740	let _ = app.shale.get("/-/logout", Some(&session)).await;
741	return Err(error);
742	}
743	let mut target = app.mcp.origin.join("mcp")?;
744	if let Some(request) = link["request"].as_str() {
745	target.query_pairs_mut().append_pair("request", request);
746	}
747	Ok((StatusCode::SEE_OTHER, [("location", target.to_string())]).into_response())
748	}.await;
749	let mut response = match result {
750	Ok(response) => response,
751	Err(error) => error.into_response(),
752	};
753	response
754	.headers_mut()
755	.insert("cache-control", "no-store".parse().unwrap());
756	response
757	.headers_mut()
758	.insert("referrer-policy", "no-referrer".parse().unwrap());
759	if callback {
760	response.headers_mut().append(
761	"set-cookie",
762	"studio_mcp_shale_link=; Path=/-/callback; Secure; HttpOnly; SameSite=Lax; Max-Age=0"
763	.parse()
764	.unwrap(),
765	);
766	}
767	response
768	}
769
770	#[cfg(test)]
771	mod tests {
772	use super::*;
773	#[test]
774	fn repository_names_cannot_change_origin_or_path_segments() {
775	let origin = url::Url::parse("https://shale.studio.test").unwrap();
776	for name in [
777	"",
778	".",
779	"..",
780	"-",
781	"../other",
782	"one/two",
783	"one\\two",
784	"%2e%2e",
785	"one?x",
786	"one#x",
787	"one\n",
788	"//foreign.test",
789	] {
790	assert!(
791	repository_path(&origin, name, &["issues", "1"]).is_err(),
792	"{name:?}"
793	);
794	}
795	let path = repository_path(&origin, "雪☃", &["issues", "1"]).unwrap();
796	assert_eq!(path.origin(), origin.origin());
797	assert_eq!(path.path(), "/%E9%9B%AA%E2%98%83/issues/1");
798	}
799	#[test]
800	fn issue_pages_must_match_repository_identity_and_issue_number() {
801	let page = "<meta name='astheno.shale.repo.name' content='owned'><body id=page-issue><h1><span>#3</span><span>Snow &amp; ☃</span></h1><select name=status><option selected value=done>Done</option></select>";
802	assert_eq!(issue(page, "owned", Some(3)).unwrap()["title"], "Snow & ☃");
803	assert!(issue(page, "other", Some(3)).is_err());
804	assert!(issue(page, "owned", Some(4)).is_err());
805	assert!(issue(&page.replace("page-issue", "page-login"), "owned", Some(3)).is_err());
806	assert!(issue(&page.replace("selected", ""), "owned", Some(3)).is_err());
807	}
808	#[test]
809	fn account_identity_uses_html_text_and_rejects_login_or_changed_markup() {
810	assert_eq!(
811	username("<body id=page-user-settings><kbd>snow&amp;flake☃</kbd>").unwrap(),
812	"snow&flake☃"
813	);
814	for html in [
815	"<body><kbd>snow</kbd>",
816	"<body id=page-user-settings>",
817	"<body id=page-user-settings><kbd>snow</kbd><kbd>other</kbd>",
818	] {
819	assert!(username(html).is_err());
820	}
821	}
822	#[test]
823	fn callback_fields_and_session_cookie_refuse_ambiguity_and_header_injection() {
824	assert!(fields("state=one&state=two").is_err());
825	assert!(fields(&"s".repeat(16385)).is_err());
826	let mut headers = HeaderMap::new();
827	headers.append(
828	"set-cookie",
829	"SessionID=owned:signature; Path=/; Secure; HttpOnly"
830	.parse()
831	.unwrap(),
832	);
833	assert_eq!(session_cookie(&headers).unwrap(), "owned:signature");
834	headers.append("set-cookie", "SessionID=other; Path=/".parse().unwrap());
835	assert!(session_cookie(&headers).is_err());
836	for value in [
837	"SessionID=",
838	"SessionID=with space",
839	"SessionID=bad,other",
840	"SessionID=\"quoted\"",
841	] {
842	let mut headers = HeaderMap::new();
843	headers.insert("set-cookie", value.parse().unwrap());
844	assert!(session_cookie(&headers).is_err());
845	}
846	}
847	}