Exposes the collection over the Model Context Protocol at /api/mcp, with 22 tools covering drinks, ratings, bar inventory, recipes, wishlist and taste preferences, plus search/fetch aliases for ChatGPT's deep-research mode. Authentication is a bearer token, the app's first header-borne credential - every other route derives identity from the NextAuth cookie, which a machine client cannot present. /api/mcp sits under the middleware's /api exclusion so it can answer a JSON 401 with an RFC 9728 WWW-Authenticate challenge instead of an HTML redirect to /login. Tokens are stored as a SHA-256 hash rather than plaintext like Invite.token and PasswordReset.token. Those are single-use and short-lived; this one is long-lived and grants read/write over a whole collection, and the nightly pg_dump keeps 14 days of history. Not encrypt(), which is reversible AES and right only for outbound keys we must replay; not bcrypt, which cannot be indexed and would turn verification into a table scan per request. verifyMcpToken joins User.status on every call, mirroring the jwt callback, so suspending a member kills their MCP access immediately rather than leaving the token as a documented way to outlive suspension. It fails closed on a database error, deliberately unlike the jwt callback, which keeps the session because a throw there would sign out every user at once. No tool reaches the Switchboard gateway. Claude and ChatGPT are language models already, so they can reason over a bar inventory without the app paying to do it a second time, and a remote client looping a vision call is not a failure mode worth having. Account deletion, restore, gateway keys, admin routes and shared-list creation are excluded too. The OAuth models ship now but are unused; the token endpoint will write the same McpAccessToken rows, so adding it later touches no verification code. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W1Ee4Mc1X1SX8HgYa52zu7
119 lines
3.8 KiB
TypeScript
119 lines
3.8 KiB
TypeScript
import type { McpServer } from "@modelcontextprotocol/server"
|
|
import type { Prisma } from "@prisma/client"
|
|
import { prisma } from "@/lib/prisma"
|
|
import { deleteImagesByUrl } from "@/lib/images"
|
|
import { defineTool } from "@/lib/mcp/define"
|
|
import { McpToolError } from "@/lib/mcp/context"
|
|
import {
|
|
deleteBarItemSchema,
|
|
listBarItemsSchema,
|
|
upsertBarItemSchema,
|
|
} from "@/lib/mcp/schemas"
|
|
import { formatBarItemLine, ok } from "@/lib/mcp/render"
|
|
|
|
/** Bar inventory - the bottles on hand, which is what recipe availability is computed from. */
|
|
export function registerBarTools(server: McpServer): void {
|
|
defineTool(
|
|
server,
|
|
{
|
|
name: "list_bar_items",
|
|
title: "List bar inventory",
|
|
description:
|
|
"Everything in the user's home bar, grouped by category, with how much is left of each. Use this to answer what they have on hand; use list_recipes when the question is what they can make.",
|
|
inputSchema: listBarItemsSchema,
|
|
scope: "bar:read",
|
|
readOnly: true,
|
|
},
|
|
async ({ category, includeEmpty }, caller) => {
|
|
const where: Prisma.BarItemWhereInput = { userId: caller.userId }
|
|
if (category) where.category = category
|
|
if (!includeEmpty) where.quantity = { not: "EMPTY" }
|
|
|
|
const items = await prisma.barItem.findMany({
|
|
where,
|
|
orderBy: [{ category: "asc" }, { name: "asc" }],
|
|
})
|
|
|
|
const text = items.length
|
|
? [...items.map(formatBarItemLine), `${items.length} items`].join("\n")
|
|
: "The bar is empty."
|
|
|
|
return ok(text, {
|
|
items: items.map((i) => ({
|
|
id: i.id,
|
|
name: i.name,
|
|
category: i.category,
|
|
quantity: i.quantity,
|
|
notes: i.notes,
|
|
hasImage: !!i.imageUrl,
|
|
})),
|
|
total: items.length,
|
|
})
|
|
}
|
|
)
|
|
|
|
defineTool(
|
|
server,
|
|
{
|
|
name: "upsert_bar_item",
|
|
title: "Add or update a bottle",
|
|
description:
|
|
"Add a bottle to the bar, or update one that is already there. Omit id to add; pass the id from list_bar_items to update. Set quantity to EMPTY when something runs out rather than deleting it.",
|
|
inputSchema: upsertBarItemSchema,
|
|
scope: "bar:write",
|
|
},
|
|
async ({ id, ...fields }, caller) => {
|
|
if (id) {
|
|
const existing = await prisma.barItem.findFirst({
|
|
where: { id, userId: caller.userId },
|
|
select: { id: true },
|
|
})
|
|
if (!existing)
|
|
throw new McpToolError("No bar item with that id.", "not_found")
|
|
|
|
const item = await prisma.barItem.update({ where: { id }, data: fields })
|
|
return {
|
|
result: ok(`Updated ${formatBarItemLine(item)}`, { id: item.id }),
|
|
recordId: item.id,
|
|
}
|
|
}
|
|
|
|
const item = await prisma.barItem.create({
|
|
data: { ...fields, userId: caller.userId },
|
|
})
|
|
return {
|
|
result: ok(`Added ${formatBarItemLine(item)}`, { id: item.id }),
|
|
recordId: item.id,
|
|
}
|
|
}
|
|
)
|
|
|
|
defineTool(
|
|
server,
|
|
{
|
|
name: "delete_bar_item",
|
|
title: "Remove a bottle",
|
|
description:
|
|
"Permanently remove a bottle from the bar. To record that something ran out but is usually stocked, set its quantity to EMPTY with upsert_bar_item instead.",
|
|
inputSchema: deleteBarItemSchema,
|
|
scope: "bar:write",
|
|
destructive: true,
|
|
},
|
|
async ({ id }, caller) => {
|
|
const item = await prisma.barItem.findFirst({
|
|
where: { id, userId: caller.userId },
|
|
select: { id: true, name: true, imageUrl: true },
|
|
})
|
|
if (!item) throw new McpToolError("No bar item with that id.", "not_found")
|
|
|
|
await prisma.barItem.delete({ where: { id } })
|
|
await deleteImagesByUrl([item.imageUrl])
|
|
|
|
return {
|
|
result: ok(`Removed ${item.name} from the bar.`, { id: item.id }),
|
|
recordId: item.id,
|
|
}
|
|
}
|
|
)
|
|
}
|