Mcp

.env.example

@@ -13,3 +13,7 @@ UMAMI_BASE_URL=
 
 # Google AI — Nano Banana Pro image generation for blog thumbnails
 GOOGLE_AI_API_KEY=
+
+# Rolebase MCP server — API access for the MCP server
+ROLEBASE_API_URL=http://local.graphql.nhost.run/v1/graphql # http://localhost:8888/graphql
+ROLEBASE_API_KEY=

.gitignore

@@ -28,3 +28,6 @@ stats.html
 # MCP cache
 .mcp-web-inspector
 .playwright-mcp
+
+# opencode
+opencode.jsonc

.mcp.json

@@ -11,6 +11,14 @@
     "tailwindcss": {
       "command": "npx",
       "args": ["-y", "tailwindcss-mcp-server"]
+    },
+    "rolebase": {
+      "command": "npx",
+      "args": ["tsx", "packages/mcp/src/index.ts"],
+      "env": {
+        "ROLEBASE_API_URL": "",
+        "ROLEBASE_API_KEY": ""
+      }
     }
   }
 }

README.md

@@ -11,6 +11,7 @@ It's an open source SaaS that helps various organizations implement Holacracy, S
 Install npm dependencies in all packages:
 
 ```
+npm install -g turbo
 npm i
 ```
 
@@ -20,7 +21,7 @@ Rolebase's backend is built with [Nhost](https://nhost.io). Follow these steps t
 
 1.  Create an account on nhost.io : https://app.nhost.io.
 
-2.  Install Nhost CLI (https://docs.nhost.io/platform/overview/get-started-with-nhost-cli)
+2.  Install Nhost CLI (https://docs.nhost.io/getting-started/quickstart/cli)
 
 ```
 sudo curl -L https://raw.githubusercontent.com/nhost/cli/main/get.sh | bash
@@ -60,7 +61,7 @@ nhost up
 npm run dev
 ```
 
-3.  Open in browser: http://localhost:3000
+3.  Open in browser: http://localhost:5175
 
 ### Storybook
 
@@ -83,6 +84,13 @@ Rolebase uses [Mailjet](https://www.mailjet.com/) to send some of its mail.
    - `MAILJET_PUBIC_KEY` : API Key displayed by Mailjet upon account creation or when resetting secret tokens
    - `MAILJET_PRIVATE_KEY` : Secret Key displayed by Mailjet upon account creation or when resetting secret tokens
 
+-> dans .secrets ? ou dans .env ?
+
+ajouter aussi (sinon erreurs dans Hasura)
+
+BACKEND_URL="http://host.docker.internal:8888"
+WEBAPP_URL="http://localhost:5175"
+
 ### Algolia
 
 To use the search engine across an organization, you need to configure an [Algolia](https://www.algolia.com/) index.

nhost/nhost.toml

@@ -1,20 +1,15 @@
 [global]
-[[global.environment]]
-name = 'WEBAPP_URL'
-value = '{{ secrets.WEBAPP_URL }}'
-
-[[global.environment]]
-name = 'BACKEND_URL'
-value = '{{ secrets.BACKEND_URL }}'
 
 [hasura]
 version = 'v2.48.10-ce'
 adminSecret = '{{ secrets.HASURA_GRAPHQL_ADMIN_SECRET }}'
 webhookSecret = '{{ secrets.NHOST_WEBHOOK_SECRET }}'
 
 [[hasura.jwtSecrets]]
-type = 'HS256'
-key = '{{ secrets.HASURA_GRAPHQL_JWT_SECRET }}'
+type = 'RS256'
+key = '{{ secrets.NHOST_JWT_PUBLIC_KEY }}'
+signingKey = '{{ secrets.NHOST_JWT_PRIVATE_KEY }}'
+kid = '{{ secrets.NHOST_JWT_KID }}'
 
 [hasura.settings]
 corsDomain = ['*']
@@ -23,47 +18,33 @@ enableAllowList = false
 enableConsole = true
 enableRemoteSchemaPermissions = false
 enabledAPIs = ['metadata', 'graphql', 'pgdump', 'config']
+inferFunctionPermissions = true
+liveQueriesMultiplexedRefetchInterval = 1000
+stringifyNumericTypes = false
 
 [hasura.logs]
 level = 'warn'
 
 [hasura.events]
 httpPoolSize = 100
 
-[hasura.resources]
-replicas = 1
-
-[hasura.resources.compute]
-cpu = 500
-memory = 1536
-
-[hasura.resources.networking]
-[[hasura.resources.networking.ingresses]]
-fqdn = ['hasura.rolebase.io']
-
 [functions]
 [functions.node]
 version = 22
 
 [auth]
-version = '0.50.0'
-
-[auth.resources]
-replicas = 1
-
-[auth.resources.compute]
-cpu = 250
-memory = 256
+version = '0.49.1'
 
-[auth.resources.networking]
-[[auth.resources.networking.ingresses]]
-fqdn = ['auth.rolebase.io']
+[auth.elevatedPrivileges]
+mode = 'disabled'
 
 [auth.redirections]
-clientUrl = '{{ secrets.WEBAPP_URL }}'
+clientUrl = 'http://localhost:5175'
 
 [auth.signUp]
 enabled = true
+disableNewUsers = false
+disableAutoSignup = false
 
 [auth.user]
 [auth.user.roles]
@@ -72,10 +53,10 @@ allowed = ['user', 'me']
 
 [auth.user.locale]
 default = 'en'
-allowed = ['en', 'fr']
+allowed = ['en']
 
 [auth.user.gravatar]
-enabled = false
+enabled = true
 default = 'blank'
 rating = 'g'
 
@@ -95,12 +76,16 @@ expiresIn = 2592000
 enabled = false
 
 [auth.method.emailPasswordless]
-enabled = true
+enabled = false
+
+[auth.method.otp]
+[auth.method.otp.email]
+enabled = false
 
 [auth.method.emailPassword]
 hibpEnabled = false
-emailVerificationRequired = false
-passwordMinLength = 8
+emailVerificationRequired = true
+passwordMinLength = 9
 
 [auth.method.smsPasswordless]
 enabled = false
@@ -119,6 +104,10 @@ enabled = false
 [auth.method.oauth.discord]
 enabled = false
 
+[auth.method.oauth.entraid]
+tenant = 'common'
+enabled = false
+
 [auth.method.oauth.facebook]
 enabled = false
 
@@ -155,53 +144,69 @@ enabled = false
 [auth.method.webauthn]
 enabled = false
 
-[auth.method.webauthn.relyingParty]
-name = 'Rolebase'
-
 [auth.method.webauthn.attestation]
-timeout = 0
-
-[auth.method.otp.email]
-enabled = true
+timeout = 60000
 
 [auth.totp]
 enabled = false
-issuer = 'nhost'
+
+[auth.oauth2Provider]
+enabled = false
+
+[auth.oauth2Provider.accessToken]
+expiresIn = 900
+
+[auth.oauth2Provider.refreshToken]
+expiresIn = 2592000
+
+[auth.oauth2Provider.clientIdMetadataDocument]
+enabled = false
+
+[auth.misc]
+concealErrors = false
+
+[auth.rateLimit]
+[auth.rateLimit.emails]
+limit = 10
+interval = '1h'
+
+[auth.rateLimit.sms]
+limit = 10
+interval = '1h'
+
+[auth.rateLimit.bruteForce]
+limit = 10
+interval = '5m'
+
+[auth.rateLimit.signups]
+limit = 10
+interval = '5m'
+
+[auth.rateLimit.global]
+limit = 100
+interval = '1m'
+
+[auth.rateLimit.oauth2Server]
+limit = 100
+interval = '5m'
 
 [postgres]
 version = '14.20-20251217-1'
 
 [postgres.resources]
-replicas = 1
-enablePublicAccess = true
-
-[postgres.resources.compute]
-cpu = 1000
-memory = 2048
-
 [postgres.resources.storage]
-capacity = 10
+capacity = 1
 
 [provider]
-[provider.smtp]
-user = '{{ secrets.MAILJET_PUBIC_KEY }}'
-password = '{{ secrets.MAILJET_SMTP_PASSWORD }}'
-sender = 'noreply@rolebase.io'
-host = 'smtp-relay.brevo.com'
-port = 465
-secure = true
-method = 'PLAIN'
 
 [storage]
-version = '0.13.0'
-
-[storage.resources]
-replicas = 1
-
-[storage.resources.compute]
-cpu = 250
-memory = 256
+version = '0.14.0'
 
 [observability]
 [observability.grafana]
 adminPassword = '{{ secrets.GRAFANA_ADMIN_PASSWORD }}'
+
+[observability.grafana.alerting]
+enabled = false
+
+[observability.grafana.contacts]

opencode copy.jsonc

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "mcp": {
+    "rolebase": {
+      "type": "local",
+      "command": ["npx", "tsx", "packages/mcp/src/index.ts"],
+      "environment": {
+        "ROLEBASE_API_URL": "{env:ROLEBASE_API_URL}",
+        "ROLEBASE_API_KEY": "{env:ROLEBASE_API_KEY}"
+      },
+      "enabled": true,
+      "timeout": 10000
+    }
+  },
+  "experimental": {
+    "mcp_timeout": 240000
+  }
+}