Building MCP Servers in Go: Social Media Graph Administration at Scale

package graph

import (
	"sync"
	"time"
)

// Node represents any entity in the social graph
type Node interface {
	ID() string
	Type() NodeType
}

type NodeType string

const (
	NodeTypeUser      NodeType = "user"
	NodeTypePost      NodeType = "post"
	NodeTypeComment   NodeType = "comment"
	NodeTypeCommunity NodeType = "community"
)

// User represents a social media user
type User struct {
	id              string
	Username        string
	Email           string
	CreatedAt       time.Time
	Role            Role
	Status          UserStatus
	ModerationFlags []ModerationFlag
}

func (u *User) ID() string       { return u.id }
func (u *User) Type() NodeType   { return NodeTypeUser }

type Role string

const (
	RoleUser      Role = "user"
	RoleModerator Role = "moderator"
	RoleAdmin     Role = "admin"
)

type UserStatus string

const (
	StatusActive    UserStatus = "active"
	StatusSuspended UserStatus = "suspended"
	StatusBanned    UserStatus = "banned"
	StatusDeleted   UserStatus = "deleted"
)

type ModerationFlag struct {
	Type      FlagType
	Reason    string
	CreatedAt time.Time
	CreatedBy string // Moderator user ID
	ExpiresAt *time.Time
}

type FlagType string

const (
	FlagWarning    FlagType = "warning"
	FlagRestricted FlagType = "restricted"
	FlagSilenced   FlagType = "silenced"
)

// Post represents content created by users
type Post struct {
	id            string
	AuthorID      string
	CommunityID   string
	Content       string
	CreatedAt     time.Time
	Status        PostStatus
	ModerationLog []ModerationEntry
}

func (p *Post) ID() string     { return p.id }
func (p *Post) Type() NodeType { return NodeTypePost }

type PostStatus string

const (
	PostStatusVisible   PostStatus = "visible"
	PostStatusHidden    PostStatus = "hidden"
	PostStatusRemoved   PostStatus = "removed"
	PostStatusQuarantined PostStatus = "quarantined"
)

type ModerationEntry struct {
	Action    ModerationAction
	Reason    string
	ActorID   string // Moderator or system
	Timestamp time.Time
}

type ModerationAction string

const (
	ActionApprove   ModerationAction = "approve"
	ActionHide      ModerationAction = "hide"
	ActionRemove    ModerationAction = "remove"
	ActionQuarantine ModerationAction = "quarantine"
)

// Community represents a group/subreddit/forum
type Community struct {
	id          string
	Name        string
	Description string
	CreatedAt   time.Time
	Moderators  []string // User IDs with moderation permission
}

func (c *Community) ID() string     { return c.id }
func (c *Community) Type() NodeType { return NodeTypeCommunity }

// Edge represents a relationship between nodes
type Edge struct {
	From     string
	To       string
	Type     EdgeType
	Metadata map[string]interface{}
}

type EdgeType string

const (
	EdgeFollow    EdgeType = "follow"
	EdgeBlock     EdgeType = "block"
	EdgeMute      EdgeType = "mute"
	EdgeCreates   EdgeType = "creates"
	EdgeComments  EdgeType = "comments"
	EdgeModerates EdgeType = "moderates"
)

// Graph stores the social media graph in memory
type Graph struct {
	mu    sync.RWMutex
	nodes map[string]Node
	edges map[string][]Edge // Key: from node ID
}

func NewGraph() *Graph {
	return &Graph{
		nodes: make(map[string]Node),
		edges: make(map[string][]Edge),
	}
}

func (g *Graph) AddNode(node Node) {
	g.mu.Lock()
	defer g.mu.Unlock()
	g.nodes[node.ID()] = node
}

func (g *Graph) GetNode(id string) (Node, bool) {
	g.mu.RLock()
	defer g.mu.RUnlock()
	node, ok := g.nodes[id]
	return node, ok
}

func (g *Graph) AddEdge(edge Edge) {
	g.mu.Lock()
	defer g.mu.Unlock()
	g.edges[edge.From] = append(g.edges[edge.From], edge)
}

func (g *Graph) GetEdges(fromID string, edgeType EdgeType) []Edge {
	g.mu.RLock()
	defer g.mu.RUnlock()

	edges := g.edges[fromID]
	if edgeType == "" {
		return edges
	}

	filtered := make([]Edge, 0)
	for _, e := range edges {
		if e.Type == edgeType {
			filtered = append(filtered, e)
		}
	}
	return filtered
}

// RemoveEdge removes a specific edge
func (g *Graph) RemoveEdge(from, to string, edgeType EdgeType) bool {
	g.mu.Lock()
	defer g.mu.Unlock()

	edges := g.edges[from]
	for i, e := range edges {
		if e.To == to && e.Type == edgeType {
			// Fast removal using "swap and pop": swap target with last element,
			// then truncate slice. This is O(1) instead of O(n) since edge order
			// doesn't matter for graph semantics. Works even when removing the
			// last element (it swaps with itself, then truncates).
			g.edges[from][i] = g.edges[from][len(edges)-1]
			g.edges[from] = g.edges[from][:len(edges)-1]
			return true
		}
	}
	return false
}

package access

import (
	"errors"
	"fmt"

	"social-mcp/graph"
)

var (
	ErrPermissionDenied = errors.New("permission denied")
	ErrResourceNotFound = errors.New("resource not found")
)

// Action represents an operation on a resource
type Action string

const (
	ActionRead           Action = "read"
	ActionCreate         Action = "create"
	ActionUpdate         Action = "update"
	ActionDelete         Action = "delete"
	ActionModerate       Action = "moderate"
	ActionBlock          Action = "block"
	ActionMute           Action = "mute"
	ActionAssignModerator Action = "assign_moderator"
)

// Permission checker
type Checker struct {
	graph *graph.Graph
}

func NewChecker(g *graph.Graph) *Checker {
	return &Checker{graph: g}
}

// CanPerformAction checks if actor can perform action on target
func (c *Checker) CanPerformAction(actorID string, action Action, targetID string) error {
	actor, ok := c.graph.GetNode(actorID)
	if !ok {
		return ErrResourceNotFound
	}

	target, ok := c.graph.GetNode(targetID)
	if !ok {
		return ErrResourceNotFound
	}

	user, ok := actor.(*graph.User)
	if !ok {
		return fmt.Errorf("actor is not a user")
	}

	// Check if user is banned/suspended
	if user.Status == graph.StatusBanned || user.Status == graph.StatusSuspended {
		return fmt.Errorf("user is %s", user.Status)
	}

	// Admin can do anything
	if user.Role == graph.RoleAdmin {
		return nil
	}

	switch target.Type() {
	case graph.NodeTypePost:
		return c.canActOnPost(user, action, target.(*graph.Post))
	case graph.NodeTypeUser:
		return c.canActOnUser(user, action, target.(*graph.User))
	case graph.NodeTypeComment:
		return c.canActOnComment(user, action, target)
	default:
		return ErrPermissionDenied
	}
}

func (c *Checker) canActOnPost(actor *graph.User, action Action, post *graph.Post) error {
	switch action {
	case ActionRead:
		// Check if post is blocked or actor has blocked author
		if c.hasBlockedRelationship(actor.ID(), post.AuthorID) {
			return ErrPermissionDenied
		}
		return nil

	case ActionUpdate, ActionDelete:
		// Only author can edit/delete their own posts
		if post.AuthorID == actor.ID() {
			return nil
		}
		return ErrPermissionDenied

	case ActionModerate:
		// Moderators can moderate posts in their communities
		if actor.Role == graph.RoleModerator {
			return c.canModerateInCommunity(actor.ID(), post.CommunityID)
		}
		return ErrPermissionDenied

	default:
		return ErrPermissionDenied
	}
}

func (c *Checker) canActOnUser(actor *graph.User, action Action, target *graph.User) error {
	switch action {
	case ActionRead:
		return nil // Public profiles

	case ActionBlock, ActionMute:
		// Users can block/mute anyone except admins
		if target.Role == graph.RoleAdmin {
			return ErrPermissionDenied
		}
		return nil

	case ActionModerate:
		// Only moderators/admins can moderate users
		if actor.Role == graph.RoleModerator || actor.Role == graph.RoleAdmin {
			return nil
		}
		return ErrPermissionDenied

	case ActionAssignModerator:
		// Only admins can assign moderators
		if actor.Role == graph.RoleAdmin {
			return nil
		}
		return ErrPermissionDenied

	default:
		return ErrPermissionDenied
	}
}

func (c *Checker) canActOnComment(actor *graph.User, action Action, comment graph.Node) error {
	// TODO: Implement comment-specific permission checks
	// Should verify:
	// - Author can edit/delete own comments
	// - Moderators can moderate comments in their communities
	// - Block/mute relationships apply to comment visibility
	// - Post author can delete comments on their post
	return nil
}

func (c *Checker) hasBlockedRelationship(userA, userB string) bool {
	// Check if either user has blocked the other
	blocksAB := c.graph.GetEdges(userA, graph.EdgeBlock)
	for _, edge := range blocksAB {
		if edge.To == userB {
			return true
		}
	}

	blocksBA := c.graph.GetEdges(userB, graph.EdgeBlock)
	for _, edge := range blocksBA {
		if edge.To == userA {
			return true
		}
	}

	return false
}

func (c *Checker) canModerateInCommunity(moderatorID, communityID string) error {
	// Check if moderator has moderates edge to community
	edges := c.graph.GetEdges(moderatorID, graph.EdgeModerates)
	for _, edge := range edges {
		if edge.To == communityID {
			return nil
		}
	}
	return ErrPermissionDenied
}

package moderation

import (
	"context"
	"regexp"
	"strings"
	"time"

	"social-mcp/graph"
)

// ContentAnalysis represents moderation analysis result
type ContentAnalysis struct {
	PostID      string
	Score       float64 // 0.0-1.0, higher = more likely violation
	Categories  []ViolationCategory
	Confidence  float64
	NeedsReview bool
	Reasoning   string
}

type ViolationCategory string

const (
	ViolationHateSpeech    ViolationCategory = "hate_speech"
	ViolationHarassment    ViolationCategory = "harassment"
	ViolationViolence      ViolationCategory = "violence"
	ViolationSexualContent ViolationCategory = "sexual_content"
	ViolationMisinformation ViolationCategory = "misinformation"
	ViolationSpam          ViolationCategory = "spam"
)

// Moderator handles content moderation operations
type Moderator struct {
	graph    *graph.Graph
	rules    []ModerationRule
	detector *ContentDetector
}

func NewModerator(g *graph.Graph) *Moderator {
	return &Moderator{
		graph:    g,
		rules:    defaultRules(),
		detector: NewContentDetector(),
	}
}

// AnalyzePost analyzes post content for violations
// The context.Context is passed through all operations, enabling request
// cancellation and timeouts. If an upstream AI model cancels its request
// (e.g., due to timeout or user cancellation), the context propagates down,
// stopping expensive graph traversals and preventing wasted work. This is
// critical for social media moderation where a single query might trigger
// dozens of graph lookups (check blocks, check mutes, check community membership).
func (m *Moderator) AnalyzePost(ctx context.Context, postID string) (*ContentAnalysis, error) {
	node, ok := m.graph.GetNode(postID)
	if !ok {
		return nil, graph.ErrResourceNotFound
	}

	post, ok := node.(*graph.Post)
	if !ok {
		return nil, errors.New("not a post")
	}

	// Run automated detection
	analysis := &ContentAnalysis{
		PostID:     postID,
		Categories: make([]ViolationCategory, 0),
	}

	// Check against rules
	for _, rule := range m.rules {
		if rule.Matches(post.Content) {
			analysis.Categories = append(analysis.Categories, rule.Category)
			analysis.Score = max(analysis.Score, rule.Severity)
		}
	}

	// Enhanced detection using patterns
	detectionResult := m.detector.Analyze(post.Content)
	analysis.Score = max(analysis.Score, detectionResult.Score)
	analysis.Categories = append(analysis.Categories, detectionResult.Categories...)
	analysis.Confidence = detectionResult.Confidence

	// Determine if human review needed
	analysis.NeedsReview = analysis.Score > 0.6 && analysis.Confidence < 0.9

	return analysis, nil
}

// TakeAction applies moderation action to post
func (m *Moderator) TakeAction(
	ctx context.Context,
	postID string,
	action graph.ModerationAction,
	moderatorID string,
	reason string,
) error {
	node, ok := m.graph.GetNode(postID)
	if !ok {
		return graph.ErrResourceNotFound
	}

	post, ok := node.(*graph.Post)
	if !ok {
		return errors.New("not a post")
	}

	// Update post status
	switch action {
	case graph.ActionHide:
		post.Status = graph.PostStatusHidden
	case graph.ActionRemove:
		post.Status = graph.PostStatusRemoved
	case graph.ActionQuarantine:
		post.Status = graph.PostStatusQuarantined
	case graph.ActionApprove:
		post.Status = graph.PostStatusVisible
	}

	// Log moderation action
	post.ModerationLog = append(post.ModerationLog, graph.ModerationEntry{
		Action:    action,
		Reason:    reason,
		ActorID:   moderatorID,
		Timestamp: time.Now(),
	})

	return nil
}

// ModerationRule defines a content rule
type ModerationRule struct {
	Category ViolationCategory
	Pattern  *regexp.Regexp
	Severity float64 // 0.0-1.0
}

func (r *ModerationRule) Matches(content string) bool {
	return r.Pattern.MatchString(strings.ToLower(content))
}

func defaultRules() []ModerationRule {
	// SAFETY NOTE: These are placeholder patterns for demonstration purposes.
	// Production systems must use comprehensive hate speech detection including:
	// - Actual slur/epithet lists (not placeholder text like "racial slur")
	// - Unicode normalization to catch obfuscation (e.g., replacing 'o' with '0')
	// - Context-aware ML models (word meaning depends on usage)
	// - Multi-language support (different hate speech patterns per language)
	// - Regular updates as language evolves
	//
	// Regex-only approaches have high false positive/negative rates.
	// Integrate with ML models like Perspective API or train custom classifiers.
	return []ModerationRule{
		{
			Category: ViolationHateSpeech,
			Pattern:  regexp.MustCompile(`\b(placeholder_for_slur_detection)\b`),
			Severity: 0.95,
		},
		{
			Category: ViolationHarassment,
			Pattern:  regexp.MustCompile(`\b(kill yourself|kys)\b`),
			Severity: 0.90,
		},
		{
			Category: ViolationSpam,
			Pattern:  regexp.MustCompile(`(https?://[^\s]+){5,}`), // 5+ links
			Severity: 0.70,
		},
	}
}

// ContentDetector performs advanced content analysis
type ContentDetector struct {
	// In production, this would integrate with ML models
}

func NewContentDetector() *ContentDetector {
	return &ContentDetector{}
}

type DetectionResult struct {
	Score      float64
	Confidence float64
	Categories []ViolationCategory
}

func (d *ContentDetector) Analyze(content string) DetectionResult {
	// Placeholder for ML model integration
	// In production: call to classification model, toxicity API, etc.

	result := DetectionResult{
		Score:      0.0,
		Confidence: 0.8,
		Categories: make([]ViolationCategory, 0),
	}

	// Simple heuristics for demonstration
	content = strings.ToLower(content)

	if strings.Contains(content, "hate") || strings.Contains(content, "attack") {
		result.Score = 0.65
		result.Categories = append(result.Categories, ViolationHateSpeech)
	}

	if len(content) > 1000 && strings.Count(content, "http") > 3 {
		result.Score = 0.70
		result.Categories = append(result.Categories, ViolationSpam)
	}

	return result
}

package operations

import (
	"context"
	"errors"
	"time"

	"social-mcp/access"
	"social-mcp/graph"
)

// UserManager handles user relationship operations
type UserManager struct {
	graph   *graph.Graph
	checker *access.Checker
}

func NewUserManager(g *graph.Graph, checker *access.Checker) *UserManager {
	return &UserManager{
		graph:   g,
		checker: checker,
	}
}

// BlockUser creates a block relationship
func (um *UserManager) BlockUser(ctx context.Context, blockerID, blockedID string) error {
	// Check permission
	if err := um.checker.CanPerformAction(blockerID, access.ActionBlock, blockedID); err != nil {
		return err
	}

	// Add block edge
	um.graph.AddEdge(graph.Edge{
		From: blockerID,
		To:   blockedID,
		Type: graph.EdgeBlock,
		Metadata: map[string]interface{}{
			"created_at": time.Now(),
		},
	})

	// Remove follow edges if they exist
	um.graph.RemoveEdge(blockerID, blockedID, graph.EdgeFollow)
	um.graph.RemoveEdge(blockedID, blockerID, graph.EdgeFollow)

	return nil
}

// UnblockUser removes a block relationship
func (um *UserManager) UnblockUser(ctx context.Context, blockerID, blockedID string) error {
	return um.graph.RemoveEdge(blockerID, blockedID, graph.EdgeBlock)
}

// MuteUser creates a mute relationship (different from block)
func (um *UserManager) MuteUser(ctx context.Context, muterID, mutedID string) error {
	if err := um.checker.CanPerformAction(muterID, access.ActionMute, mutedID); err != nil {
		return err
	}

	um.graph.AddEdge(graph.Edge{
		From: muterID,
		To:   mutedID,
		Type: graph.EdgeMute,
		Metadata: map[string]interface{}{
			"created_at": time.Now(),
		},
	})

	return nil
}

// SuspendUser suspends a user account (moderator action)
func (um *UserManager) SuspendUser(
	ctx context.Context,
	moderatorID,
	targetID string,
	reason string,
	duration time.Duration,
) error {
	// Check moderator permission
	if err := um.checker.CanPerformAction(moderatorID, access.ActionModerate, targetID); err != nil {
		return err
	}

	node, ok := um.graph.GetNode(targetID)
	if !ok {
		return access.ErrResourceNotFound
	}

	user, ok := node.(*graph.User)
	if !ok {
		return errors.New("target is not a user")
	}

	// Apply suspension
	user.Status = graph.StatusSuspended
	expiresAt := time.Now().Add(duration)
	user.ModerationFlags = append(user.ModerationFlags, graph.ModerationFlag{
		Type:      graph.FlagRestricted,
		Reason:    reason,
		CreatedAt: time.Now(),
		CreatedBy: moderatorID,
		ExpiresAt: &expiresAt,
	})

	return nil
}

// BanUser permanently bans a user account
func (um *UserManager) BanUser(ctx context.Context, moderatorID, targetID, reason string) error {
	if err := um.checker.CanPerformAction(moderatorID, access.ActionModerate, targetID); err != nil {
		return err
	}

	node, ok := um.graph.GetNode(targetID)
	if !ok {
		return access.ErrResourceNotFound
	}

	user, ok := node.(*graph.User)
	if !ok {
		return errors.New("target is not a user")
	}

	// Apply permanent ban
	user.Status = graph.StatusBanned
	user.ModerationFlags = append(user.ModerationFlags, graph.ModerationFlag{
		Type:      graph.FlagRestricted,
		Reason:    reason,
		CreatedAt: time.Now(),
		CreatedBy: moderatorID,
		ExpiresAt: nil, // Permanent
	})

	return nil
}

// GetUserRelationship returns relationship between two users
func (um *UserManager) GetUserRelationship(userA, userB string) (*Relationship, error) {
	rel := &Relationship{
		UserA: userA,
		UserB: userB,
	}

	// Check all edge types
	edgesAB := um.graph.GetEdges(userA, "")
	for _, edge := range edgesAB {
		if edge.To == userB {
			switch edge.Type {
			case graph.EdgeFollow:
				rel.AFollowsB = true
			case graph.EdgeBlock:
				rel.ABlocksB = true
			case graph.EdgeMute:
				rel.AMutesB = true
			}
		}
	}

	edgesBA := um.graph.GetEdges(userB, "")
	for _, edge := range edgesBA {
		if edge.To == userA {
			switch edge.Type {
			case graph.EdgeFollow:
				rel.BFollowsA = true
			case graph.EdgeBlock:
				rel.BBlocksA = true
			case graph.EdgeMute:
				rel.BMutesA = true
			}
		}
	}

	return rel, nil
}

type Relationship struct {
	UserA     string
	UserB     string
	AFollowsB bool
	BFollowsA bool
	ABlocksB  bool
	BBlocksA  bool
	AMutesB   bool
	BMutesA   bool
}

package mcp

import (
	"bufio"
	"context"
	"encoding/json"
	"fmt"
	"io"
	"log"
	"os"
)

// Request represents a JSON-RPC 2.0 request
type Request struct {
	JSONRPC string          `json:"jsonrpc"`
	ID      interface{}     `json:"id,omitempty"`
	Method  string          `json:"method"`
	Params  json.RawMessage `json:"params,omitempty"`
}

// Response represents a JSON-RPC 2.0 response
type Response struct {
	JSONRPC string      `json:"jsonrpc"`
	ID      interface{} `json:"id,omitempty"`
	Result  interface{} `json:"result,omitempty"`
	Error   *Error      `json:"error,omitempty"`
}

// Error represents a JSON-RPC 2.0 error
type Error struct {
	Code    int         `json:"code"`
	Message string      `json:"message"`
	Data    interface{} `json:"data,omitempty"`
}

const (
	ParseError     = -32700
	InvalidRequest = -32600
	MethodNotFound = -32601
	InvalidParams  = -32602
	InternalError  = -32603
)

// Tool represents an MCP tool definition
type Tool struct {
	Name        string `json:"name"`
	Description string `json:"description"`
	InputSchema Schema `json:"inputSchema"`
}

// Schema represents a JSON Schema
type Schema struct {
	Type       string              `json:"type"`
	Properties map[string]Property `json:"properties,omitempty"`
	Required   []string            `json:"required,omitempty"`
}

// Property represents a JSON Schema property
type Property struct {
	Type        string   `json:"type"`
	Description string   `json:"description,omitempty"`
	Enum        []string `json:"enum,omitempty"`
}

// ServerInfo contains MCP server capabilities
type ServerInfo struct {
	Name    string `json:"name"`
	Version string `json:"version"`
	Tools   []Tool `json:"tools,omitempty"`
}

// Handler processes MCP requests
type Handler interface {
	Handle(ctx context.Context, method string, params json.RawMessage) (interface{}, error)
}

// Server implements an MCP server over stdio
type Server struct {
	info    ServerInfo
	handler Handler
	stdin   io.Reader
	stdout  io.Writer
}

func NewServer(info ServerInfo, handler Handler) *Server {
	return &Server{
		info:    info,
		handler: handler,
		stdin:   os.Stdin,
		stdout:  os.Stdout,
	}
}

func (s *Server) Run(ctx context.Context) error {
	scanner := bufio.NewScanner(s.stdin)
	scanner.Buffer(make([]byte, 1024*1024), 1024*1024)

	for scanner.Scan() {
		select {
		case <-ctx.Done():
			return ctx.Err()
		default:
		}

		line := scanner.Bytes()
		if len(line) == 0 {
			continue
		}

		var req Request
		if err := json.Unmarshal(line, &req); err != nil {
			s.sendError(nil, ParseError, "Parse error", err)
			continue
		}

		s.handleRequest(ctx, &req)
	}

	return scanner.Err()
}

func (s *Server) handleRequest(ctx context.Context, req *Request) {
	if req.Method == "initialize" {
		result := map[string]interface{}{
			"protocolVersion": "2024-11-05",
			"capabilities":    s.info,
		}
		s.sendResponse(req.ID, result)
		return
	}

	if req.Method == "tools/list" {
		s.sendResponse(req.ID, map[string]interface{}{
			"tools": s.info.Tools,
		})
		return
	}

	if req.Method == "tools/call" {
		var params struct {
			Name      string                 `json:"name"`
			Arguments map[string]interface{} `json:"arguments"`
		}
		if err := json.Unmarshal(req.Params, &params); err != nil {
			s.sendError(req.ID, InvalidParams, "Invalid params", err)
			return
		}

		argsJSON, err := json.Marshal(params.Arguments)
		if err != nil {
			s.sendError(req.ID, InternalError, "Failed to marshal arguments", err)
			return
		}

		result, err := s.handler.Handle(ctx, params.Name, argsJSON)
		if err != nil {
			s.sendError(req.ID, InternalError, err.Error(), nil)
			return
		}

		// Marshal result as JSON to preserve type fidelity
		// MCP clients expect structured data, not stringified output
		resultJSON, err := json.Marshal(result)
		if err != nil {
			s.sendError(req.ID, InternalError, "Failed to marshal result", err)
			return
		}

		s.sendResponse(req.ID, map[string]interface{}{
			"content": []map[string]interface{}{
				{
					"type": "text",
					"text": string(resultJSON),
				},
			},
		})
		return
	}

	s.sendError(req.ID, MethodNotFound, "Method not found", nil)
}

// **Security note**: This demo server has NO authentication or authorization
// on MCP methods. Any client with stdio access can invoke tools. Production
// deployments MUST implement:
// - Authentication: Verify client identity (API keys, JWTs, mTLS certificates)
// - Authorization: Check if authenticated client has permission for requested tool
// - Rate limiting: Prevent abuse (e.g., 100 moderation actions/minute per client)
// - Audit logging: Record who invoked which tools with what parameters
//
// For stdio transport, the security boundary is the process boundary (only
// processes with terminal access can connect). For HTTP transport, implement
// standard web API security (OAuth, API keys, etc.).

func (s *Server) sendResponse(id interface{}, result interface{}) {
	resp := Response{
		JSONRPC: "2.0",
		ID:      id,
		Result:  result,
	}
	s.send(resp)
}

func (s *Server) sendError(id interface{}, code int, message string, data interface{}) {
	resp := Response{
		JSONRPC: "2.0",
		ID:      id,
		Error: &Error{
			Code:    code,
			Message: message,
			Data:    data,
		},
	}
	s.send(resp)
}

func (s *Server) send(resp Response) {
	data, err := json.Marshal(resp)
	if err != nil {
		log.Printf("Failed to marshal response: %v", err)
		return
	}

	data = append(data, '\n')
	if _, err := s.stdout.Write(data); err != nil {
		log.Printf("Failed to write response: %v", err)
	}
}

package tools

import (
	"context"
	"encoding/json"
	"fmt"

	"social-mcp/mcp"
	"social-mcp/operations"
)

type BlockUserTool struct {
	userManager *operations.UserManager
}

func NewBlockUserTool(um *operations.UserManager) *BlockUserTool {
	return &BlockUserTool{userManager: um}
}

func (t *BlockUserTool) Definition() mcp.Tool {
	return mcp.Tool{
		Name:        "block_user",
		Description: "Block a user to prevent all interactions",
		InputSchema: mcp.Schema{
			Type: "object",
			Properties: map[string]mcp.Property{
				"blocker_id": {
					Type:        "string",
					Description: "ID of user creating the block",
				},
				"blocked_id": {
					Type:        "string",
					Description: "ID of user to be blocked",
				},
			},
			Required: []string{"blocker_id", "blocked_id"},
		},
	}
}

func (t *BlockUserTool) Execute(ctx context.Context, params json.RawMessage) (interface{}, error) {
	var input struct {
		BlockerID string `json:"blocker_id"`
		BlockedID string `json:"blocked_id"`
	}

	if err := json.Unmarshal(params, &input); err != nil {
		return nil, fmt.Errorf("invalid parameters: %w", err)
	}

	if err := t.userManager.BlockUser(ctx, input.BlockerID, input.BlockedID); err != nil {
		return nil, err
	}

	return map[string]interface{}{
		"success": true,
		"message": fmt.Sprintf("User %s blocked %s", input.BlockerID, input.BlockedID),
	}, nil
}

package tools

import (
	"context"
	"encoding/json"
	"fmt"

	"social-mcp/graph"
	"social-mcp/mcp"
	"social-mcp/moderation"
)

type ModeratePostTool struct {
	moderator *moderation.Moderator
}

func NewModeratePostTool(mod *moderation.Moderator) *ModeratePostTool {
	return &ModeratePostTool{moderator: mod}
}

func (t *ModeratePostTool) Definition() mcp.Tool {
	return mcp.Tool{
		Name:        "moderate_post",
		Description: "Analyze and take moderation action on a post",
		InputSchema: mcp.Schema{
			Type: "object",
			Properties: map[string]mcp.Property{
				"post_id": {
					Type:        "string",
					Description: "ID of post to moderate",
				},
				"moderator_id": {
					Type:        "string",
					Description: "ID of moderator taking action",
				},
				"action": {
					Type:        "string",
					Description: "Moderation action to take",
					Enum:        []string{"approve", "hide", "remove", "quarantine"},
				},
				"reason": {
					Type:        "string",
					Description: "Reason for moderation action",
				},
			},
			Required: []string{"post_id", "moderator_id", "action", "reason"},
		},
	}
}

func (t *ModeratePostTool) Execute(ctx context.Context, params json.RawMessage) (interface{}, error) {
	var input struct {
		PostID      string `json:"post_id"`
		ModeratorID string `json:"moderator_id"`
		Action      string `json:"action"`
		Reason      string `json:"reason"`
	}

	if err := json.Unmarshal(params, &input); err != nil {
		return nil, fmt.Errorf("invalid parameters: %w", err)
	}

	// Map string action to ModerationAction
	var action graph.ModerationAction
	switch input.Action {
	case "approve":
		action = graph.ActionApprove
	case "hide":
		action = graph.ActionHide
	case "remove":
		action = graph.ActionRemove
	case "quarantine":
		action = graph.ActionQuarantine
	default:
		return nil, fmt.Errorf("invalid action: %s", input.Action)
	}

	if err := t.moderator.TakeAction(ctx, input.PostID, action, input.ModeratorID, input.Reason); err != nil {
		return nil, err
	}

	return map[string]interface{}{
		"success": true,
		"post_id": input.PostID,
		"action":  input.Action,
		"reason":  input.Reason,
	}, nil
}

package tools

import (
	"context"
	"encoding/json"
	"fmt"

	"social-mcp/mcp"
	"social-mcp/moderation"
)

type AnalyzeContentTool struct {
	moderator *moderation.Moderator
}

func NewAnalyzeContentTool(mod *moderation.Moderator) *AnalyzeContentTool {
	return &AnalyzeContentTool{moderator: mod}
}

func (t *AnalyzeContentTool) Definition() mcp.Tool {
	return mcp.Tool{
		Name:        "analyze_content",
		Description: "Analyze post content for policy violations",
		InputSchema: mcp.Schema{
			Type: "object",
			Properties: map[string]mcp.Property{
				"post_id": {
					Type:        "string",
					Description: "ID of post to analyze",
				},
			},
			Required: []string{"post_id"},
		},
	}
}

func (t *AnalyzeContentTool) Execute(ctx context.Context, params json.RawMessage) (interface{}, error) {
	var input struct {
		PostID string `json:"post_id"`
	}

	if err := json.Unmarshal(params, &input); err != nil {
		return nil, fmt.Errorf("invalid parameters: %w", err)
	}

	analysis, err := t.moderator.AnalyzePost(ctx, input.PostID)
	if err != nil {
		return nil, err
	}

	return map[string]interface{}{
		"post_id":      analysis.PostID,
		"score":        analysis.Score,
		"categories":   analysis.Categories,
		"confidence":   analysis.Confidence,
		"needs_review": analysis.NeedsReview,
		"reasoning":    analysis.Reasoning,
	}, nil
}

package tools

import (
	"context"
	"encoding/json"
	"fmt"

	"social-mcp/access"
	"social-mcp/mcp"
)

type CheckAccessTool struct {
	checker *access.Checker
}

func NewCheckAccessTool(checker *access.Checker) *CheckAccessTool {
	return &CheckAccessTool{checker: checker}
}

func (t *CheckAccessTool) Definition() mcp.Tool {
	return mcp.Tool{
		Name:        "check_access",
		Description: "Check if user has permission to perform action on resource",
		InputSchema: mcp.Schema{
			Type: "object",
			Properties: map[string]mcp.Property{
				"actor_id": {
					Type:        "string",
					Description: "ID of user attempting action",
				},
				"action": {
					Type:        "string",
					Description: "Action to check",
					Enum:        []string{"read", "create", "update", "delete", "moderate", "block", "mute"},
				},
				"target_id": {
					Type:        "string",
					Description: "ID of resource being acted upon",
				},
			},
			Required: []string{"actor_id", "action", "target_id"},
		},
	}
}

func (t *CheckAccessTool) Execute(ctx context.Context, params json.RawMessage) (interface{}, error) {
	var input struct {
		ActorID  string `json:"actor_id"`
		Action   string `json:"action"`
		TargetID string `json:"target_id"`
	}

	if err := json.Unmarshal(params, &input); err != nil {
		return nil, fmt.Errorf("invalid parameters: %w", err)
	}

	err := t.checker.CanPerformAction(input.ActorID, access.Action(input.Action), input.TargetID)

	return map[string]interface{}{
		"allowed": err == nil,
		"error":   func() string {
			if err != nil {
				return err.Error()
			}
			return ""
		}(),
	}, nil
}

package main

import (
	"context"
	"encoding/json"
	"log"
	"os"
	"os/signal"
	"syscall"

	"social-mcp/access"
	"social-mcp/graph"
	"social-mcp/mcp"
	"social-mcp/moderation"
	"social-mcp/operations"
	"social-mcp/tools"
)

type ToolRegistry struct {
	tools map[string]Tool
}

type Tool interface {
	Definition() mcp.Tool
	Execute(ctx context.Context, params json.RawMessage) (interface{}, error)
}

func NewToolRegistry(
	g *graph.Graph,
	checker *access.Checker,
	userManager *operations.UserManager,
	moderator *moderation.Moderator,
) *ToolRegistry {
	registry := &ToolRegistry{
		tools: make(map[string]Tool),
	}

	// Register tools
	registry.Register(tools.NewBlockUserTool(userManager))
	registry.Register(tools.NewModeratePostTool(moderator))
	registry.Register(tools.NewAnalyzeContentTool(moderator))
	registry.Register(tools.NewCheckAccessTool(checker))

	return registry
}

func (r *ToolRegistry) Register(tool Tool) {
	def := tool.Definition()
	r.tools[def.Name] = tool
}

func (r *ToolRegistry) Handle(ctx context.Context, method string, params json.RawMessage) (interface{}, error) {
	tool, ok := r.tools[method]
	if !ok {
		return nil, fmt.Errorf("tool not found: %s", method)
	}

	return tool.Execute(ctx, params)
}

func (r *ToolRegistry) Definitions() []mcp.Tool {
	defs := make([]mcp.Tool, 0, len(r.tools))
	for _, tool := range r.tools {
		defs = append(defs, tool.Definition())
	}
	return defs
}

func main() {
	// Initialize graph
	g := graph.NewGraph()

	// Seed with sample data
	seedGraph(g)

	// Create services
	checker := access.NewChecker(g)
	userManager := operations.NewUserManager(g, checker)
	moderator := moderation.NewModerator(g)

	// Create tool registry
	registry := NewToolRegistry(g, checker, userManager, moderator)

	// Create MCP server
	server := mcp.NewServer(
		mcp.ServerInfo{
			Name:    "social-media-mcp",
			Version: "1.0.0",
			Tools:   registry.Definitions(),
		},
		registry,
	)

	// Setup context
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()

	// Handle shutdown
	sigChan := make(chan os.Signal, 1)
	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)

	go func() {
		<-sigChan
		log.Println("Shutdown signal received")
		cancel()
	}()

	// Run server
	log.Println("Social Media MCP server starting...")
	if err := server.Run(ctx); err != nil {
		log.Fatalf("Server error: %v", err)
	}
}

func seedGraph(g *graph.Graph) {
	// Create sample users
	admin := &graph.User{
		id:       "user-admin",
		Username: "admin",
		Role:     graph.RoleAdmin,
		Status:   graph.StatusActive,
	}
	g.AddNode(admin)

	moderator := &graph.User{
		id:       "user-mod",
		Username: "moderator1",
		Role:     graph.RoleModerator,
		Status:   graph.StatusActive,
	}
	g.AddNode(moderator)

	user1 := &graph.User{
		id:       "user-1",
		Username: "alice",
		Role:     graph.RoleUser,
		Status:   graph.StatusActive,
	}
	g.AddNode(user1)

	user2 := &graph.User{
		id:       "user-2",
		Username: "bob",
		Role:     graph.RoleUser,
		Status:   graph.StatusActive,
	}
	g.AddNode(user2)

	// Create sample post
	post := &graph.Post{
		id:       "post-1",
		AuthorID: "user-1",
		Content:  "This is a sample post",
		Status:   graph.PostStatusVisible,
	}
	g.AddNode(post)

	// Create relationships
	g.AddEdge(graph.Edge{
		From: "user-1",
		To:   "user-2",
		Type: graph.EdgeFollow,
	})
}

package access_test

import (
	"testing"

	"social-mcp/access"
	"social-mcp/graph"
)

func TestBlockPermissions(t *testing.T) {
	g := graph.NewGraph()

	// Setup users
	regular := &graph.User{
		id:     "user-1",
		Role:   graph.RoleUser,
		Status: graph.StatusActive,
	}
	g.AddNode(regular)

	admin := &graph.User{
		id:     "admin-1",
		Role:   graph.RoleAdmin,
		Status: graph.StatusActive,
	}
	g.AddNode(admin)

	target := &graph.User{
		id:     "user-2",
		Role:   graph.RoleUser,
		Status: graph.StatusActive,
	}
	g.AddNode(target)

	checker := access.NewChecker(g)

	// User can block another user
	err := checker.CanPerformAction("user-1", access.ActionBlock, "user-2")
	if err != nil {
		t.Errorf("User should be able to block: %v", err)
	}

	// User cannot block admin
	err = checker.CanPerformAction("user-1", access.ActionBlock, "admin-1")
	if err == nil {
		t.Error("User should not be able to block admin")
	}
}

func TestModeratorScope(t *testing.T) {
	g := graph.NewGraph()

	// Create moderator
	mod := &graph.User{
		id:     "mod-1",
		Role:   graph.RoleModerator,
		Status: graph.StatusActive,
	}
	g.AddNode(mod)

	// Create community (proper Community node, not a Post)
	community := &graph.Community{
		id:   "comm-1",
		Name: "Test Community",
	}
	g.AddNode(community)

	// Create post in community
	post := &graph.Post{
		id:          "post-1",
		CommunityID: "comm-1",
		Status:      graph.PostStatusVisible,
	}
	g.AddNode(post)

	// Grant moderator permission in community
	g.AddEdge(graph.Edge{
		From: "mod-1",
		To:   "comm-1",
		Type: graph.EdgeModerates,
	})

	checker := access.NewChecker(g)

	// Moderator can moderate post in their community
	err := checker.CanPerformAction("mod-1", access.ActionModerate, "post-1")
	if err != nil {
		t.Errorf("Moderator should be able to moderate post: %v", err)
	}
}

func TestBlockedUserCannotSeeContent(t *testing.T) {
	g := graph.NewGraph()

	userA := &graph.User{id: "user-a", Status: graph.StatusActive}
	userB := &graph.User{id: "user-b", Status: graph.StatusActive}
	g.AddNode(userA)
	g.AddNode(userB)

	post := &graph.Post{
		id:       "post-1",
		AuthorID: "user-b",
		Status:   graph.PostStatusVisible,
	}
	g.AddNode(post)

	// User A blocks User B
	g.AddEdge(graph.Edge{
		From: "user-a",
		To:   "user-b",
		Type: graph.EdgeBlock,
	})

	checker := access.NewChecker(g)

	// User A cannot read User B's posts
	err := checker.CanPerformAction("user-a", access.ActionRead, "post-1")
	if err == nil {
		t.Error("Blocked user should not be able to read posts")
	}
}

package graph_test

import (
	"fmt"
	"testing"

	"social-mcp/graph"
)

func BenchmarkGraphAddEdge(b *testing.B) {
	g := graph.NewGraph()

	// Setup nodes
	for i := 0; i < 1000; i++ {
		g.AddNode(&graph.User{id: fmt.Sprintf("user-%d", i)})
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		g.AddEdge(graph.Edge{
			From: "user-0",
			To:   fmt.Sprintf("user-%d", i%1000),
			Type: graph.EdgeFollow,
		})
	}
}

func BenchmarkGraphGetEdges(b *testing.B) {
	g := graph.NewGraph()

	// Setup graph with 1000 users, 10 edges each
	for i := 0; i < 1000; i++ {
		userID := fmt.Sprintf("user-%d", i)
		g.AddNode(&graph.User{id: userID})

		for j := 0; j < 10; j++ {
			g.AddEdge(graph.Edge{
				From: userID,
				To:   fmt.Sprintf("user-%d", (i+j+1)%1000),
				Type: graph.EdgeFollow,
			})
		}
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_ = g.GetEdges(fmt.Sprintf("user-%d", i%1000), graph.EdgeFollow)
	}
}

$ go test -bench=. -benchmem

BenchmarkGraphAddEdge-8         2000000      782 ns/op     128 B/op    2 allocs/op
BenchmarkGraphGetEdges-8       10000000      145 ns/op       0 B/op    0 allocs/op

def moderate_post(post_id):
    post = db.query("SELECT * FROM posts WHERE id = ?", post_id)

    # Check keywords
    for keyword in BANNED_KEYWORDS:
        if keyword in post.content.lower():
            mark_for_review(post_id)
            return

    # Check user history
    user = db.query("SELECT * FROM users WHERE id = ?", post.author_id)
    if user.violation_count > 5:
        mark_for_review(post_id)

# Build stage
FROM golang:1.22-alpine AS builder

WORKDIR /build
COPY go.mod go.sum ./
RUN go mod download

COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o server .

# Runtime stage
FROM alpine:latest

RUN apk --no-cache add ca-certificates
WORKDIR /app

COPY --from=builder /build/server .

# Run as non-root
RUN adduser -D -u 1000 mcpuser
USER mcpuser

EXPOSE 8080

CMD ["./server"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: social-mcp
spec:
  replicas: 3
  selector:
    matchLabels:
      app: social-mcp
  template:
    metadata:
      labels:
        app: social-mcp
    spec:
      containers:
      - name: social-mcp
        image: social-mcp:1.0.0
        resources:
          requests:
            memory: "256Mi"
            cpu: "250m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 30