aspera-cli 4.27.5 → 4.28.0

data/lib/aspera/cli/plugins/mcp.rb

@@ -1,11 +1,15 @@
 # frozen_string_literal: true
 
-# cspell:ignore ascli jsonrpc
+# cspell:ignore ascli jsonrpc pkce
 
 require 'aspera/cli/plugins/base'
 require 'aspera/cli/info'
 require 'aspera/cli/version'
-require 'json'
+require 'aspera/oauth/server/pkce'
+require 'aspera/cli/security'
+require 'aspera/cli/deprecation'
+require 'aspera/secret_strength'
+require 'securerandom'
 
 module Aspera
   module Cli
@@ -22,8 +26,17 @@ module Aspera
       #   # stdio transport:
       #   max_line_bytes:         Integer - max JSON frame size (default 4 MiB)
       #   # http transport:
-      #   port:                   Integer - TCP port (default 3000)
-      #   bind:                   String  - bind address (default "127.0.0.1")
+      #   url:                    String  - address and port the server listens on (default "http://127.0.0.1:3000"), https:// for TLS
+      #   cert, key, chain:       String  - TLS certificate, private key or PKCS12 passphrase, chain, see WebServerSimple
+      #   auth_token:             String  - if set, require "Authorization: Bearer <token>" on MCP requests,
+      #                                     and asked on the OAuth consent page (mandatory when url or public_url is not loopback)
+      #   auth_token_min_bits:    Integer - minimum estimated strength of auth_token in bits (default 80, 0 disables)
+      #   oauth:                  Boolean - enable OAuth 2.0 PKCE flow with dynamic client registration (RFC 7591)
+      #   oauth_access_token_ttl: Integer - access token lifetime in seconds (default 3600)
+      #   oauth_refresh_token_ttl: Integer - refresh token lifetime in seconds (default 2592000 = 30 days)
+      #   public_url:             String  - URL of the server for clients, used in OAuth metadata and secret pages
+      #                                     (default: from url, mandatory with oauth on a wildcard address)
+      #   port, bind:             deprecated, replaced by url
       #   stateless:              Boolean - stateless mode (default false)
       #   allowed_origins:        Array<String>
       #   allowed_hosts:          Array<String>
@@ -37,10 +50,19 @@ module Aspera
       # Examples:
       #   ascli mcp server
       #   ascli mcp server @json:{"instructions":"Aspera transfers"}
-      #   ascli mcp server @json:{"transport":"http","port":3000}
+      #   ascli mcp server @json:{"transport":"http","url":"http://127.0.0.1:3000"}
       #   ascli mcp server @json:{"protocol_version":"2024-11-05","max_line_bytes":1048576}
       class Mcp < Base
         application_name 'Model Context Protocol Server'
+
+        # Instruction for AI agents to always display the equivalent CLI command in their output.
+        COMMAND_DISPLAY_INSTRUCTIONS = <<~INST.strip
+          COMMAND DISPLAY (MANDATORY)
+            Whenever you execute an ascli command or present its results, you MUST ALWAYS explicitly
+            show the equivalent command line in your response to the user as bash syntax
+            (e.g. `ascli plugin command --option=value`).
+        INST
+
         # Default instructions shown to the AI client when none are provided by the user.
         DEFAULT_INSTRUCTIONS = <<~INST.strip
           This is the Aspera CLI (ascli) MCP server (IBM Aspera file transfer and management).
@@ -48,6 +70,8 @@ module Aspera
           Its description gives the syntax and the discovery sequence: follow it before any
           command whose syntax you have not verified in this session.
 
+          #{COMMAND_DISPLAY_INSTRUCTIONS}
+
           Plugins: aoc (Aspera on Cloud), faspex5 (Faspex 5), node (Node API), server (FASP/SSH
           server), config (local configuration), console, orchestrator, ats, preview, shares,
           cos, httpgw, faspio, alee.
@@ -58,6 +82,8 @@ module Aspera
           If the user provides credentials inline (--url, --username, --password, --private-key),
           use those exact values verbatim — never substitute a preset or another server.
           Some plugins support browser login (--auth=web).
+          For a secret the user did not give (password, passphrase), pass "@secret:<name>" as value:
+          the user enters it on a web page, you never see it. Prefer it to asking in the conversation.
           On error, report it as-is and stop.
 
           TRANSFERS
@@ -68,34 +94,68 @@ module Aspera
             monitor → ["config", "transfer", "status", "<job_id>"]
             list    → ["config", "transfer", "list"]
             cleanup → ["config", "transfer", "cleanup"]
+
+          ORCHESTRATOR WORKFLOW DEVELOPMENT
+          Before writing or modifying an Orchestrator workflow, read the documentation for workflow
+          development (file format, graph, execution, recipes, authoring checklist):
+            ["orchestrator", "workflows", "development", "authoring"]
+          For the template attributes (allowed values), inputs and outputs of an action plugin, and the
+          template settings they depend on, read its specification (fields: section "plugin-specifications"
+          of the authoring guide); without plugin name, the list of plugins:
+            ["orchestrator", "plugins", "spec", "<PluginClass>"]
+          For the functional description and the setup of a plugin (for example the API client of Faspex),
+          read its section of the Plugin Manual (large: read one section):
+            ["orchestrator", "workflows", "development", "manual", "<anchor>"]
+          The anchor "toc" lists the sections of a document, up to a default level, or the level given after it.
+          Before importing a workflow file, check it (graph, templates, inputs of steps) and fix all errors:
+            ["orchestrator", "workflows", "check_import", "<file>"]
         INST
 
         # Keys forwarded to MCP::Server constructor (symbolized)
-        SERVER_KEYS = %i[instructions description].freeze
+        SERVER_KEYS      = %i[instructions description].freeze
         # Keys forwarded to MCP::Configuration
-        CONFIG_KEYS = %i[protocol_version validate_tool_call_arguments].freeze
+        CONFIG_KEYS      = %i[protocol_version validate_tool_call_arguments].freeze
         # Keys forwarded to StdioTransport
-        STDIO_KEYS  = %i[max_line_bytes].freeze
+        STDIO_KEYS       = %i[max_line_bytes].freeze
         # Keys forwarded to StreamableHTTPTransport
-        HTTP_KEYS   = %i[stateless allowed_origins allowed_hosts session_idle_timeout max_sessions].freeze
+        HTTP_KEYS        = %i[stateless allowed_origins allowed_hosts session_idle_timeout max_sessions].freeze
+        # Keys of the HTTP server, consumed locally
+        HTTP_SERVER_KEYS = %i[url cert key chain port bind public_url auth_token auth_token_min_bits oauth oauth_access_token_ttl oauth_refresh_token_ttl].freeze
         # Keys consumed locally (not forwarded to MCP gem)
-        TOOL_KEYS   = %i[max_text_bytes extra_args].freeze
-        private_constant :SERVER_KEYS, :CONFIG_KEYS, :STDIO_KEYS, :HTTP_KEYS, :TOOL_KEYS
+        TOOL_KEYS        = %i[max_text_bytes extra_args].freeze
+        # Extended-value handlers disabled in MCP server mode whatever the security level:
+        # @stdin: is the JSON-RPC stream (stdio).
+        # Other unsafe handlers depend on the security level, see Security.
+        # @secret: is entered on a web page instead of the terminal, see Mcp::Secrets.
+        DISABLED_EXTENDED_VALUE_HANDLERS = %i[stdin].freeze
+        # Security level when not set by option `security`
+        DEFAULT_SECURITY_LEVEL = :high
+        private_constant :SERVER_KEYS, :CONFIG_KEYS, :STDIO_KEYS, :HTTP_KEYS, :HTTP_SERVER_KEYS, :TOOL_KEYS, :DISABLED_EXTENDED_VALUE_HANDLERS, :DEFAULT_SECURITY_LEVEL
 
         command :server, description: 'Start the MCP (Model Context Protocol) server',
           arguments:   [{name: :mcp_options, type: [Hash], mandatory: false, schema: 'opts:components.schemas.McpServerOptions'}]
 
         def action_server(mcp_options: nil, **)
-          require 'aspera/cli/mcp_tool'
+          require 'aspera/cli/mcp/tool'
+          require 'aspera/cli/extended_value'
           mcp_options = (mcp_options || {}).transform_keys(&:to_sym)
-          unknown = mcp_options.keys - SERVER_KEYS - CONFIG_KEYS - STDIO_KEYS - HTTP_KEYS - TOOL_KEYS - %i[transport port bind]
+          unknown = mcp_options.keys - SERVER_KEYS - CONFIG_KEYS - STDIO_KEYS - HTTP_KEYS - HTTP_SERVER_KEYS - TOOL_KEYS - %i[transport]
           Aspera.assert(unknown.empty?, type: Cli::BadArgument) { "Unknown MCP option(s): #{unknown.join(', ')}" }
-          Cli::McpTool.max_text_bytes = mcp_options.delete(:max_text_bytes)
-          Cli::McpTool.extra_args     = mcp_options.delete(:extra_args)
+          Cli::Mcp::Tool.max_text_bytes = mcp_options.delete(:max_text_bytes)
+          Cli::Mcp::Tool.extra_args     = mcp_options.delete(:extra_args)
           transport = mcp_options.delete(:transport) || 'stdio'
           raise Cli::BadArgument, "Unknown transport: #{transport}. Use 'stdio' or 'http'" \
             unless %w[stdio http].include?(transport.to_s)
-          Log.log.info { "Starting MCP server (transport=#{transport})..." }
+          # Options of the other transport would be ignored
+          ignored = mcp_options.keys & (transport.to_s.eql?('stdio') ? HTTP_KEYS + HTTP_SERVER_KEYS : STDIO_KEYS)
+          Aspera.assert(ignored.empty?, type: Cli::BadArgument) { "MCP option(s) not used with transport #{transport}: #{ignored.join(', ')}" }
+          DISABLED_EXTENDED_VALUE_HANDLERS.each do |handler|
+            ExtendedValue.instance.on(handler) { |_| raise Cli::BadArgument, "@#{handler}: extended value is disabled in MCP server mode" }
+          end
+          ExtendedValue.instance.on(:secret) { |prompt| Cli::Mcp::Secrets.value(prompt) }
+          # Applies to commands of the client, and to presets, which the client can modify
+          Security.instance.lock('in MCP server mode', default: DEFAULT_SECURITY_LEVEL)
+          Log.log.info { "Starting MCP server (transport=#{transport}, security level #{Security.instance.level})..." }
           start_mcp_server(transport: transport.to_sym, mcp_options: mcp_options)
           Result::Nothing.new
         end
@@ -106,17 +166,19 @@ module Aspera
         # @param mcp_options [Hash] symbolized options
         # @return [MCP::Server]
         def build_mcp_server(mcp_options)
-          tool = Cli::McpTool
+          tool = Cli::Mcp::Tool
           config_opts = mcp_options.slice(*CONFIG_KEYS)
           server_opts = mcp_options.slice(*SERVER_KEYS)
           server_opts[:instructions] ||= DEFAULT_INSTRUCTIONS
           server_opts[:description]  ||= "#{Info::GEM_NAME} MCP server (IBM Aspera file transfer and management)"
           configuration = config_opts.empty? ? nil : MCP::Configuration.new(**config_opts)
           MCP::Server.new(
-            name:          Info::GEM_NAME,
-            version:       VERSION,
-            tools:         [tool],
-            configuration: configuration,
+            name:                   Info::GEM_NAME,
+            version:                VERSION,
+            tools:                  [tool],
+            configuration:          configuration,
+            # The request state of secret requests (@secret:) goes through the client: encrypted and bound to the tool call
+            request_state_security: MCP::Server::RequestStateSecurity.new(key: SecureRandom.random_bytes(32), ttl: Cli::WebSecret::TTL),
             **server_opts
           )
         end
@@ -128,6 +190,8 @@ module Aspera
           server = build_mcp_server(mcp_options)
           case transport
           when :stdio
+            # Secret pages are served by a local web server, started on first use of @secret:
+            Cli::Mcp::Tool.web_secret = Cli::Mcp::Secrets.web_secret
             stdio_opts = mcp_options.slice(*STDIO_KEYS)
             MCP::Server::Transports::StdioTransport.new(server, **stdio_opts).open
           when :http
@@ -135,108 +199,103 @@ module Aspera
           end
         end
 
-        # Start HTTP transport using WEBrick (already a project dependency).
-        # Rack 3 removed Rack::Handler - we build a native WEBrick servlet that
-        # calls the Rack app directly instead of relying on Rack::Handler::WEBrick.
+        # Addresses listening on all interfaces: not a host name usable by clients
+        WILDCARD_BIND_ADDRESSES = %w[0.0.0.0 ::].freeze
+        # Address of the HTTP transport, when not set by option `url`
+        DEFAULT_HTTP_URL = 'http://127.0.0.1:3000'
+        private_constant :WILDCARD_BIND_ADDRESSES, :DEFAULT_HTTP_URL
+
+        # @param mcp_options [Hash] symbolized options
+        # @return [Hash] Parameters of WebServerSimple.serve: `url`, and `cert`, `key`, `chain` if set
+        def http_server_parameters(mcp_options)
+          url = mcp_options[:url]
+          bind, port = mcp_options.values_at(:bind, :port)
+          unless bind.nil? && port.nil?
+            Aspera.assert(url.nil?, type: Cli::BadArgument) { 'url cannot be used with bind or port' }
+            Log.log.warn { "MCP options bind and port are #{Deprecation.new(last: '4.27.5', message: 'use url')}" }
+            uri = URI.parse(DEFAULT_HTTP_URL)
+            uri.hostname = bind.to_s unless bind.nil?
+            uri.port = port unless port.nil?
+            url = uri.to_s
+          end
+          url ||= DEFAULT_HTTP_URL
+          # Paths of the servlet are absolute
+          Aspera.assert(['', '/'].include?(URI.parse(url).path), type: Cli::BadArgument) { "url shall have no path (the MCP endpoint is /mcp): #{url}" }
+          {url: url, **mcp_options.slice(:cert, :key, :chain)}
+        end
+
+        # @param uri      [URI]         Address the server listens on
+        # @param public_url [String, nil] URL of the server for clients, if provided by user
+        # @param oauth_enabled [Boolean] whether OAuth PKCE flow is enabled
+        # @return [String] URL of the server for clients, without trailing slash
+        def http_base_url(uri, public_url, oauth_enabled)
+          return public_url.to_s.chomp('/') unless public_url.nil?
+          wildcard = WILDCARD_BIND_ADDRESSES.include?(uri.hostname)
+          Aspera.assert(!oauth_enabled || !wildcard, type: Cli::BadArgument) do
+            "public_url is required with oauth when listening on #{uri.hostname}: URL used by clients, e.g. #{uri.scheme}://myhost:#{uri.port}"
+          end
+          URI.parse("#{uri.scheme}://#{wildcard ? 'localhost' : uri.host}:#{uri.port}").to_s
+        end
+
+        # Start HTTP transport, see Mcp::HttpServlet.
+        # On an address that is not loopback, `auth_token` is mandatory, also with OAuth:
+        # it is the secret asked on the consent page, else anyone could approve its own client.
         def start_http_transport(server, mcp_options)
-          require 'webrick'
-          http_opts = mcp_options.slice(*HTTP_KEYS)
-          port      = mcp_options.fetch(:port, 3000)
-          bind      = mcp_options.fetch(:bind, '127.0.0.1')
-          app       = MCP::Server::Transports::StreamableHTTPTransport.new(server, **http_opts)
-          rack_servlet = Class.new(WEBrick::HTTPServlet::AbstractServlet) do
-            define_method(:initialize) do |srv, rack_app, server_info|
-              @app = rack_app
-              @server_info = server_info
-              super(srv)
-            end
-            %w[GET POST DELETE].each do |http_method|
-              define_method(:"do_#{http_method}") do |req, res|
-                # Serve a discovery endpoint on GET / (used by Bob and other MCP clients
-                # to display server metadata without initiating a full MCP session).
-                if http_method == 'GET' && req.path == '/'
-                  body = JSON.generate(@server_info)
-                  res.status = 200
-                  res['Content-Type'] = 'application/json'
-                  res.body = body
-                  next
-                end
-                env = rack_env_from_webrick(req)
-                status, headers, rack_body = @app.call(env)
-                res.status = status
-                headers.each { |k, v| res[k] = v }
-                if rack_body.respond_to?(:call)
-                  # Rack streaming body (SSE): wrap the WEBrick socket in a stream object
-                  # that exposes write/flush/close, then hand off a Proc to WEBrick so it
-                  # calls us back with the raw socket once headers have been flushed.
-                  rack_proc = rack_body
-                  res.chunked = true
-                  res.body = proc do |socket|
-                    stream = Object.new
-                    stream.define_singleton_method(:write) { |data| socket.write(data) }
-                    stream.define_singleton_method(:flush) { socket.flush rescue nil }
-                    stream.define_singleton_method(:close) { socket.close rescue nil }
-                    rack_proc.call(stream)
-                  end
-                else
-                  buf = +''
-                  rack_body.each { |chunk| buf << chunk }
-                  rack_body.close if rack_body.respond_to?(:close)
-                  res.body = buf
-                end
-              end
-            end
-            define_method(:rack_env_from_webrick) do |req|
-              {
-                'REQUEST_METHOD'    => req.request_method,
-                'SCRIPT_NAME'       => '',
-                'PATH_INFO'         => req.path,
-                'QUERY_STRING'      => req.query_string || '',
-                'SERVER_NAME'       => req.host,
-                'SERVER_PORT'       => req.port.to_s,
-                'HTTP_VERSION'      => req.http_version,
-                'rack.input'        => StringIO.new(req.body.to_s),
-                'rack.errors'       => $stderr,
-                'rack.url_scheme'   => 'http',
-                'rack.multithread'  => true,
-                'rack.multiprocess' => false,
-                'rack.run_once'     => false
-              }.tap do |env|
-                req.header.each do |key, values|
-                  http_key = "HTTP_#{key.upcase.tr('-', '_')}"
-                  case key.downcase
-                  when 'content-type'   then env['CONTENT_TYPE']   = values.first
-                  when 'content-length' then env['CONTENT_LENGTH'] = values.first
-                  else                       env[http_key] = values.join(', ')
-                  end
-                end
-              end
+          require 'aspera/cli/mcp/http_servlet'
+          require 'aspera/web_server_simple'
+          parameters        = http_server_parameters(mcp_options)
+          uri               = WebServerSimple.url(parameters)
+          auth_token        = mcp_options[:auth_token]
+          oauth_enabled     = mcp_options.fetch(:oauth, false)
+          access_token_ttl  = mcp_options.fetch(:oauth_access_token_ttl, OAuth::Server::Pkce.default_access_token_ttl)
+          refresh_token_ttl = mcp_options.fetch(:oauth_refresh_token_ttl, OAuth::Server::Pkce.default_refresh_token_ttl)
+          min_bits          = mcp_options.fetch(:auth_token_min_bits, SecretStrength::DEFAULT_MIN_BITS)
+          SecretStrength.assert_strong(auth_token, name: 'auth_token', min_bits: min_bits, type: Cli::BadArgument) unless auth_token.nil?
+          base_url = http_base_url(uri, mcp_options[:public_url], oauth_enabled)
+          what = "auth_token#{' (asked on the consent page)' if oauth_enabled}"
+          # Clients reach the server at public_url (e.g. through a reverse proxy), whatever the address it listens on
+          unless mcp_options[:public_url].nil?
+            public_host = URI.parse(base_url).hostname
+            Aspera.assert(!auth_token.nil? || WebServerSimple.loopback?(public_host), type: Cli::BadArgument) do
+              "#{what} is required when public_url is not loopback (localhost, 127.0.0.0/8, ::1): #{public_host}"
             end
           end
-          # WEBrick logs Errno::ECONNRESET as ERROR when a client disconnects mid-stream
-          # (normal for SSE/streaming connections). Suppress those noisy non-fatal errors.
-          quiet_logger = WEBrick::Log.new($stderr).tap do |log|
-            log.define_singleton_method(:error) do |msg|
-              return if msg.to_s.include?('ECONNRESET') || msg.to_s.include?('Broken pipe')
-              super(msg)
+          WebServerSimple.serve(
+            parameters,
+            Cli::Mcp::HttpServlet,
+            protected: !auth_token.nil?,
+            what:      what,
+            type:      Cli::BadArgument
+          ) do
+            # Secret pages are served by this server: the static token, if any, is the access code asked on the page
+            web_secret = Cli::Mcp::Secrets.web_secret(base_url: base_url, access_code: auth_token)
+            Cli::Mcp::Tool.web_secret = web_secret
+            # Build OAuth::Server::Pkce only when OAuth is enabled.
+            # Pass MCP-specific branding via title: and description: so the external HTML
+            # template is used directly without a custom callback.
+            # The static token, if any, is the access code asked on the consent page.
+            oauth_server = if oauth_enabled
+              Log.log.info { 'OAuth 2.0 PKCE enabled (dynamic registration)' }
+              OAuth::Server::Pkce.new(
+                base_url:          base_url,
+                access_token_ttl:  access_token_ttl,
+                refresh_token_ttl: refresh_token_ttl,
+                title:             "Authorize #{Info::GEM_NAME} MCP server",
+                description:       "the <strong>#{Info::GEM_NAME} MCP server</strong>",
+                consent_secret:    auth_token
+              )
             end
+            [{
+              app:             MCP::Server::Transports::StreamableHTTPTransport.new(server, **mcp_options.slice(*HTTP_KEYS)),
+              server_info:     {name: server.name, version: server.version, description: server.description},
+              web_secret:      web_secret,
+              auth_token:      auth_token,
+              oauth_server:    oauth_server,
+              allowed_hosts:   mcp_options[:allowed_hosts],
+              # Pages of the server (consent, secret) are opened at base_url, also behind a reverse proxy that changes Host
+              allowed_origins: [*mcp_options[:allowed_origins], ServletHelpers.origin(base_url)]
+            }]
           end
-          webrick = WEBrick::HTTPServer.new(
-            BindAddress: bind,
-            Port:        port,
-            Logger:      quiet_logger,
-            AccessLog:   []
-          )
-          server_info = {
-            name:        server.name,
-            version:     server.version,
-            description: server.description
-          }
-          webrick.mount('/', rack_servlet, app, server_info)
-          Log.log.info { "MCP HTTP server listening on http://#{bind}:#{port}/" }
-          trap('INT') { webrick.shutdown }
-          trap('TERM') { webrick.shutdown }
-          webrick.start
         end
       end
     end

data/lib/aspera/cli/plugins/node.rb

@@ -10,7 +10,7 @@ require 'aspera/nagios'
 require 'aspera/hash_ext'
 require 'aspera/id_generator'
 require 'aspera/api/node'
-require 'aspera/oauth'
+require 'aspera/oauth/client/factory'
 require 'aspera/rest/list'
 require 'aspera/assert'
 require 'base64'
@@ -83,10 +83,12 @@ module Aspera
         # @param app_url [String] Tested URL
         # @return [Hash] :preset_value, :test_args
         def wizard(wizard, app_url)
+          username = options.get_option(:username, mandatory: true)
           return {
+            preset_ids:   [username],
             preset_value: {
               url:      app_url,
-              username: options.get_option(:username, mandatory: true),
+              username: username,
               password: options.get_option(:password, mandatory: true)
             },
             test_args:    'info'
@@ -1130,21 +1132,25 @@ module Aspera
         end
 
         def action_emulator(parameters: {}, **)
+          require 'aspera/secret_strength'
+          require 'aspera/web_server_simple'
           require 'aspera/node_emulator'
           # missing parameters take the default of the schema
           defaults = Schema::Registry.instance.reader(Schema::Registry::NODE_EMULATOR_OPTIONS).current['properties'].each_with_object({}) do |(name, property), result|
             result[name.to_sym] = property['default'] if property.key?('default')
           end
           parameters = defaults.merge(parameters.symbolize_keys)
-          uri = URI.parse(parameters.delete(:url))
-          config = parameters.except(*WebServerSimple::PARAMS)
+          config = WebServerSimple.servlet_parameters(parameters)
           docroot = config.delete(:docroot)
           retention_sec = config.delete(:retention_sec)
+          password_min_bits = config.delete(:password_min_bits)
           Aspera.assert(config[:username].nil? == config[:password].nil?, type: Cli::BadArgument) { 'Parameters username and password must be set together' }
-          Log.log.warn('No username and password: emulator accepts requests without authentication') if config[:username].nil?
-          server = WebServerSimple.new(uri, **parameters.slice(*WebServerSimple::PARAMS))
-          server.mount(uri.path, NodeEmulatorServlet, config, NodeEmulator.new(docroot: docroot, retention_sec: retention_sec))
-          server.start
+          SecretStrength.assert_strong(config[:password], name: 'password', min_bits: password_min_bits, type: Cli::BadArgument) unless config[:password].nil?
+          # Files of the docroot can be sent to, or received from, any host by anyone who can reach the server
+          WebServerSimple.serve(parameters, NodeEmulatorServlet, protected: !config[:username].nil?, what: 'username and password', type: Cli::BadArgument) do
+            Log.log.warn('No username and password: emulator accepts requests without authentication') if config[:username].nil?
+            [config, NodeEmulator.new(docroot: docroot, retention_sec: retention_sec)]
+          end
           return Result::Status.new('Emulator terminated')
         end