|
| 1 | +/** |
| 2 | + * Legacy SSE Server Transport (v1 compatibility shim) |
| 3 | + * |
| 4 | + * This module restores the v1 `SSEServerTransport` class for backwards |
| 5 | + * compatibility. It is a frozen port of the v1 implementation with imports |
| 6 | + * adapted to the v2 package layout. New code should use |
| 7 | + * `NodeStreamableHTTPServerTransport` from `@modelcontextprotocol/node` |
| 8 | + * instead. |
| 9 | + * |
| 10 | + * @module sse |
| 11 | + * @deprecated Use `NodeStreamableHTTPServerTransport` instead. |
| 12 | + */ |
| 13 | + |
| 14 | +import { randomUUID } from 'node:crypto'; |
| 15 | +import type { IncomingMessage, ServerResponse } from 'node:http'; |
| 16 | +import { URL } from 'node:url'; |
| 17 | + |
| 18 | +import type { AuthInfo, JSONRPCMessage, MessageExtraInfo, Transport } from '@modelcontextprotocol/core'; |
| 19 | +import { parseJSONRPCMessage } from '@modelcontextprotocol/server'; |
| 20 | +import contentType from 'content-type'; |
| 21 | +import getRawBody from 'raw-body'; |
| 22 | + |
| 23 | +const MAXIMUM_MESSAGE_SIZE = '4mb'; |
| 24 | + |
| 25 | +/** |
| 26 | + * Configuration options for `SSEServerTransport`. |
| 27 | + * |
| 28 | + * @deprecated Use `NodeStreamableHTTPServerTransport` from `@modelcontextprotocol/node` instead. |
| 29 | + */ |
| 30 | +export interface SSEServerTransportOptions { |
| 31 | + /** |
| 32 | + * List of allowed host header values for DNS rebinding protection. |
| 33 | + * If not specified, host validation is disabled. |
| 34 | + */ |
| 35 | + allowedHosts?: string[]; |
| 36 | + |
| 37 | + /** |
| 38 | + * List of allowed origin header values for DNS rebinding protection. |
| 39 | + * If not specified, origin validation is disabled. |
| 40 | + */ |
| 41 | + allowedOrigins?: string[]; |
| 42 | + |
| 43 | + /** |
| 44 | + * Enable DNS rebinding protection (requires allowedHosts and/or allowedOrigins to be configured). |
| 45 | + * Default is `false` for backwards compatibility. |
| 46 | + */ |
| 47 | + enableDnsRebindingProtection?: boolean; |
| 48 | +} |
| 49 | + |
| 50 | +/** |
| 51 | + * Server transport for the legacy HTTP+SSE protocol: sends messages over an SSE |
| 52 | + * connection and receives messages from separate HTTP POST requests. |
| 53 | + * |
| 54 | + * This transport is only available in Node.js environments. |
| 55 | + * |
| 56 | + * @deprecated Use `NodeStreamableHTTPServerTransport` from `@modelcontextprotocol/node` instead. |
| 57 | + */ |
| 58 | +export class SSEServerTransport implements Transport { |
| 59 | + private _sseResponse?: ServerResponse; |
| 60 | + private _sessionId: string; |
| 61 | + private _options: SSEServerTransportOptions; |
| 62 | + |
| 63 | + onclose?: () => void; |
| 64 | + onerror?: (error: Error) => void; |
| 65 | + onmessage?: (message: JSONRPCMessage, extra?: MessageExtraInfo) => void; |
| 66 | + |
| 67 | + /** |
| 68 | + * Creates a new SSE server transport, which will direct the client to POST |
| 69 | + * messages to the relative or absolute URL identified by `endpoint`. |
| 70 | + */ |
| 71 | + constructor( |
| 72 | + private _endpoint: string, |
| 73 | + private res: ServerResponse, |
| 74 | + options?: SSEServerTransportOptions |
| 75 | + ) { |
| 76 | + this._sessionId = randomUUID(); |
| 77 | + this._options = options ?? { enableDnsRebindingProtection: false }; |
| 78 | + } |
| 79 | + |
| 80 | + /** |
| 81 | + * Validates request headers for DNS rebinding protection. |
| 82 | + * @returns Error message if validation fails, undefined if validation passes. |
| 83 | + */ |
| 84 | + private validateRequestHeaders(req: IncomingMessage): string | undefined { |
| 85 | + // Skip validation if protection is not enabled |
| 86 | + if (!this._options.enableDnsRebindingProtection) { |
| 87 | + return undefined; |
| 88 | + } |
| 89 | + |
| 90 | + // Validate Host header if allowedHosts is configured |
| 91 | + if (this._options.allowedHosts && this._options.allowedHosts.length > 0) { |
| 92 | + const hostHeader = req.headers.host; |
| 93 | + if (!hostHeader || !this._options.allowedHosts.includes(hostHeader)) { |
| 94 | + return `Invalid Host header: ${hostHeader}`; |
| 95 | + } |
| 96 | + } |
| 97 | + |
| 98 | + // Validate Origin header if allowedOrigins is configured |
| 99 | + if (this._options.allowedOrigins && this._options.allowedOrigins.length > 0) { |
| 100 | + const originHeader = req.headers.origin; |
| 101 | + if (originHeader && !this._options.allowedOrigins.includes(originHeader)) { |
| 102 | + return `Invalid Origin header: ${originHeader}`; |
| 103 | + } |
| 104 | + } |
| 105 | + |
| 106 | + return undefined; |
| 107 | + } |
| 108 | + |
| 109 | + /** |
| 110 | + * Handles the initial SSE connection request. |
| 111 | + * |
| 112 | + * This should be called when a GET request is made to establish the SSE stream. |
| 113 | + */ |
| 114 | + async start(): Promise<void> { |
| 115 | + if (this._sseResponse) { |
| 116 | + throw new Error('SSEServerTransport already started! If using Server class, note that connect() calls start() automatically.'); |
| 117 | + } |
| 118 | + |
| 119 | + this.res.writeHead(200, { |
| 120 | + 'Content-Type': 'text/event-stream', |
| 121 | + 'Cache-Control': 'no-cache, no-transform', |
| 122 | + Connection: 'keep-alive' |
| 123 | + }); |
| 124 | + |
| 125 | + // Send the endpoint event. |
| 126 | + // Use a dummy base URL because this._endpoint is relative. |
| 127 | + // This allows using URL/URLSearchParams for robust parameter handling. |
| 128 | + const dummyBase = 'http://localhost'; // Any valid base works |
| 129 | + const endpointUrl = new URL(this._endpoint, dummyBase); |
| 130 | + endpointUrl.searchParams.set('sessionId', this._sessionId); |
| 131 | + |
| 132 | + // Reconstruct the relative URL string (pathname + search + hash) |
| 133 | + const relativeUrlWithSession = endpointUrl.pathname + endpointUrl.search + endpointUrl.hash; |
| 134 | + |
| 135 | + this.res.write(`event: endpoint\ndata: ${relativeUrlWithSession}\n\n`); |
| 136 | + |
| 137 | + this._sseResponse = this.res; |
| 138 | + this.res.on('close', () => { |
| 139 | + this._sseResponse = undefined; |
| 140 | + this.onclose?.(); |
| 141 | + }); |
| 142 | + } |
| 143 | + |
| 144 | + /** |
| 145 | + * Handles incoming POST messages. |
| 146 | + * |
| 147 | + * This should be called when a POST request is made to send a message to the server. |
| 148 | + */ |
| 149 | + async handlePostMessage(req: IncomingMessage & { auth?: AuthInfo }, res: ServerResponse, parsedBody?: unknown): Promise<void> { |
| 150 | + if (!this._sseResponse) { |
| 151 | + const message = 'SSE connection not established'; |
| 152 | + res.writeHead(500).end(message); |
| 153 | + throw new Error(message); |
| 154 | + } |
| 155 | + |
| 156 | + // Validate request headers for DNS rebinding protection |
| 157 | + const validationError = this.validateRequestHeaders(req); |
| 158 | + if (validationError) { |
| 159 | + res.writeHead(403).end(validationError); |
| 160 | + this.onerror?.(new Error(validationError)); |
| 161 | + return; |
| 162 | + } |
| 163 | + |
| 164 | + const authInfo: AuthInfo | undefined = req.auth; |
| 165 | + const request = toWebRequest(req); |
| 166 | + |
| 167 | + let body: string | unknown; |
| 168 | + try { |
| 169 | + const ct = contentType.parse(req.headers['content-type'] ?? ''); |
| 170 | + if (ct.type !== 'application/json') { |
| 171 | + throw new Error(`Unsupported content-type: ${ct.type}`); |
| 172 | + } |
| 173 | + |
| 174 | + body = |
| 175 | + parsedBody ?? |
| 176 | + (await getRawBody(req, { |
| 177 | + limit: MAXIMUM_MESSAGE_SIZE, |
| 178 | + encoding: ct.parameters.charset ?? 'utf8' |
| 179 | + })); |
| 180 | + } catch (error) { |
| 181 | + res.writeHead(400).end(String(error)); |
| 182 | + this.onerror?.(error as Error); |
| 183 | + return; |
| 184 | + } |
| 185 | + |
| 186 | + try { |
| 187 | + await this.handleMessage(typeof body === 'string' ? JSON.parse(body) : body, { request, authInfo }); |
| 188 | + } catch { |
| 189 | + res.writeHead(400).end(`Invalid message: ${body}`); |
| 190 | + return; |
| 191 | + } |
| 192 | + |
| 193 | + res.writeHead(202).end('Accepted'); |
| 194 | + } |
| 195 | + |
| 196 | + /** |
| 197 | + * Handle a client message, regardless of how it arrived. This can be used to |
| 198 | + * inform the server of messages that arrive via a means different than HTTP POST. |
| 199 | + */ |
| 200 | + async handleMessage(message: unknown, extra?: MessageExtraInfo): Promise<void> { |
| 201 | + let parsedMessage: JSONRPCMessage; |
| 202 | + try { |
| 203 | + parsedMessage = parseJSONRPCMessage(message); |
| 204 | + } catch (error) { |
| 205 | + this.onerror?.(error as Error); |
| 206 | + throw error; |
| 207 | + } |
| 208 | + |
| 209 | + this.onmessage?.(parsedMessage, extra); |
| 210 | + } |
| 211 | + |
| 212 | + async close(): Promise<void> { |
| 213 | + this._sseResponse?.end(); |
| 214 | + this._sseResponse = undefined; |
| 215 | + this.onclose?.(); |
| 216 | + } |
| 217 | + |
| 218 | + async send(message: JSONRPCMessage): Promise<void> { |
| 219 | + if (!this._sseResponse) { |
| 220 | + throw new Error('Not connected'); |
| 221 | + } |
| 222 | + |
| 223 | + this._sseResponse.write(`event: message\ndata: ${JSON.stringify(message)}\n\n`); |
| 224 | + } |
| 225 | + |
| 226 | + /** |
| 227 | + * Returns the session ID for this transport. |
| 228 | + * |
| 229 | + * This can be used to route incoming POST requests. |
| 230 | + */ |
| 231 | + get sessionId(): string { |
| 232 | + return this._sessionId; |
| 233 | + } |
| 234 | +} |
| 235 | + |
| 236 | +/** |
| 237 | + * Builds a Web-standard {@linkcode Request} (URL + headers only) from a Node |
| 238 | + * {@linkcode IncomingMessage} so v2 handler contexts can read `extra.request`. |
| 239 | + * The body is omitted because the transport consumes it separately. |
| 240 | + */ |
| 241 | +function toWebRequest(req: IncomingMessage): globalThis.Request | undefined { |
| 242 | + const host = req.headers.host; |
| 243 | + if (!host || !req.url) { |
| 244 | + return undefined; |
| 245 | + } |
| 246 | + // We can't reliably detect TLS at this layer (proxies, etc.); the scheme is |
| 247 | + // best-effort and only matters for handler-side URL inspection. |
| 248 | + const isEncrypted = (req.socket as { encrypted?: boolean } | undefined)?.encrypted === true; |
| 249 | + const protocol = isEncrypted ? 'https' : 'http'; |
| 250 | + const headers = new Headers(); |
| 251 | + for (const [key, value] of Object.entries(req.headers)) { |
| 252 | + if (value === undefined) continue; |
| 253 | + headers.set(key, Array.isArray(value) ? value.join(', ') : value); |
| 254 | + } |
| 255 | + return new Request(new URL(req.url, `${protocol}://${host}`), { |
| 256 | + method: req.method, |
| 257 | + headers |
| 258 | + }); |
| 259 | +} |
0 commit comments