completion-kit 0.5.26 → 0.5.28

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 312676093066234886bea6d8cb908e669d045dfdb02660b2872266c6baeb3e59
-  data.tar.gz: '0974b8805e344059b9c063d7979b61ab9c08b2182a5438f230386d2244b29d91'
+  metadata.gz: e5b7b1f667eb85b17d7ae6302671129a1e68821bffd1a83f667a7336776f5927
+  data.tar.gz: 2f0e3642574d60e69a466bf0fe097c3287a104ba2a049c33afa6462a83dccaf2
 SHA512:
-  metadata.gz: 2ab3528c3521917d7309bb95b8639645e17cfa28b250245cf33eefd6d9220548c7424592180ab6c911ae2bf181a5443a77395f8e4434e1c9043510fa67827ba9
-  data.tar.gz: 6b8ae35b53a6a82d164155978a324f1915211153818b90e53e808d1d6368f7345e27a1fef185c98f275d9f729c654f48e21dd83811c325e138abb96d72d42062
+  metadata.gz: 19bc73fa1f422a5bee002c10681966fa263fe8a69f8928bb48d9630d53feca65721cbc81b3b3415c4dac9d60dc67a616dde7ac1d5e3154b2aa136b73e25a7077
+  data.tar.gz: 5ba36b81ebc2a7df4421423dc8614c624c73f8dde0477bf4a579e914a36ed7c36821840f8c2aed963eb04a50cf840db14119a81a794a251576026731648e49d8

data/app/controllers/completion_kit/application_controller.rb

@@ -22,7 +22,7 @@ module CompletionKit
           ActiveSupport::SecurityUtils.secure_compare(u, cfg.username) &
             ActiveSupport::SecurityUtils.secure_compare(p, cfg.password)
         end
-      elsif Rails.env.production?
+      elsif !Rails.env.local?
         render plain: "CompletionKit authentication not configured. See README for setup instructions.",
                status: :forbidden
       end

data/app/controllers/completion_kit/mcp_controller.rb

@@ -35,7 +35,8 @@ module CompletionKit
     rescue ActiveRecord::RecordInvalid, ActiveRecord::InvalidForeignKey => e
       render json: jsonrpc_error(request_body.dig("id"), -32602, e.message), status: :ok
     rescue StandardError => e
-      render json: jsonrpc_error(request_body.dig("id"), -32603, e.message), status: :ok
+      Rails.error.report(e, handled: true, context: { controller: "CompletionKit::McpController" })
+      render json: jsonrpc_error(request_body.dig("id"), -32603, "Internal error"), status: :ok
     end
 
     def destroy

data/app/models/completion_kit/provider_credential.rb

@@ -1,3 +1,6 @@
+require "ipaddr"
+require "resolv"
+
 module CompletionKit
   class ProviderCredential < ApplicationRecord
     include Turbo::Broadcastable
@@ -24,6 +27,7 @@ module CompletionKit
 
     validates :provider, presence: true, inclusion: { in: PROVIDERS }
     validates :provider, tenant_scoped_uniqueness: true
+    validate :api_endpoint_not_internal
 
     after_save :enqueue_discovery
 
@@ -131,5 +135,33 @@ module CompletionKit
       CompletionKit::Engine.warm_routes!
       CompletionKit::ApplicationController.render(partial: partial, locals: locals)
     end
+
+    def api_endpoint_not_internal
+      return if api_endpoint.blank?
+
+      uri = safe_http_uri(api_endpoint)
+      unless uri
+        errors.add(:api_endpoint, "must be a valid http or https URL")
+        return
+      end
+
+      if endpoint_addresses(uri.host).any? { |ip| ip.private? || ip.link_local? }
+        errors.add(:api_endpoint, "must not point at a private or internal address")
+      end
+    end
+
+    def safe_http_uri(value)
+      uri = URI.parse(value.to_s.strip)
+      uri if uri.is_a?(URI::HTTP) && uri.host.present?
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def endpoint_addresses(host)
+      bare = host.delete_prefix("[").delete_suffix("]")
+      [IPAddr.new(bare)]
+    rescue IPAddr::InvalidAddressError
+      Resolv.getaddresses(host).map { |addr| IPAddr.new(addr) }
+    end
   end
 end

data/lib/completion_kit/version.rb

@@ -1,3 +1,3 @@
 module CompletionKit
-  VERSION = "0.5.26"
+  VERSION = "0.5.28"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: completion-kit
 version: !ruby/object:Gem::Version
-  version: 0.5.26
+  version: 0.5.28
 platform: ruby
 authors:
 - Damien Bastin