@coffeerunhobby/mcp-ha-connect 1.3.0 → 1.3.1

package/dist/permissions/index.js

@@ -19,24 +19,39 @@ export const Role = {
     ADMIN: Permission.QUERY | Permission.CONTROL | Permission.NOTIFY | Permission.CONFIGURE | Permission.AI | Permission.ADMIN,
     SUPERUSER: 0xFF, // All permissions
 };
+/**
+ * Resolve a role name to its permission mask, case-insensitively.
+ *
+ * Config (and JSON) commonly use lowercase role names ("operator") while the
+ * `Role` map is keyed uppercase ("OPERATOR"). Normalize here so BOTH the per-user
+ * role and the `defaultRole` fall-back resolve consistently. An unknown/undefined
+ * name fails closed to `Role.NONE` (never `undefined`, which downstream coerces to
+ * a zero mask anyway but is easy to mishandle).
+ */
+function resolveRoleName(name) {
+    if (!name) {
+        return Role.NONE;
+    }
+    const key = name.toUpperCase();
+    return Role[key] ?? Role.NONE;
+}
 /**
  * Get permission mask for a user by their JWT sub claim
  */
 export function getUserPermissions(sub, config) {
+    const fallback = resolveRoleName(config.defaultRole);
     if (!sub) {
-        return config.defaultRole ? Role[config.defaultRole] : Role.NONE;
+        return fallback;
     }
     const user = config.users.find((u) => u.sub === sub);
     if (!user) {
-        return config.defaultRole ? Role[config.defaultRole] : Role.NONE;
+        return fallback;
     }
     // Direct mask takes precedence over role
     if (user.mask !== undefined) {
         return user.mask;
     }
-    // Convert role to uppercase for lookup (config may have lowercase)
-    const roleKey = user.role?.toUpperCase();
-    return roleKey && Role[roleKey] !== undefined ? Role[roleKey] : Role.NONE;
+    return resolveRoleName(user.role);
 }
 /**
  * Check if a permission mask includes required permission

package/dist/permissions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,KAAK,EAAE,CAAC,EAAO,6DAA6D;IAC5E,SAAS,EAAE,CAAC,EAAG,qCAAqC;IACpD,OAAO,EAAE,CAAC,EAAK,0CAA0C;IACzD,KAAK,EAAE,CAAC,EAAO,qCAAqC;IACpD,MAAM,EAAE,EAAE,EAAK,qBAAqB;IACpC,EAAE,EAAE,EAAE,EAAS,2BAA2B;CAClC,CAAC;AAIX,iDAAiD;AACjD,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,UAAU,CAAC,KAAK;IAC1B,QAAQ,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM;IACnE,WAAW,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,SAAS;IAC7F,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK;IAC1H,SAAS,EAAE,IAAI,EAAE,kBAAkB;CAC3B,CAAC;AAgBX;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB,EAAE,MAAyB;IACnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,yCAAyC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,EAA0B,CAAC;IACjE,OAAO,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,QAAgB;IAC9D,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACtD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,KAAK,EAAE,CAAC,EAAO,6DAA6D;IAC5E,SAAS,EAAE,CAAC,EAAG,qCAAqC;IACpD,OAAO,EAAE,CAAC,EAAK,0CAA0C;IACzD,KAAK,EAAE,CAAC,EAAO,qCAAqC;IACpD,MAAM,EAAE,EAAE,EAAK,qBAAqB;IACpC,EAAE,EAAE,EAAE,EAAS,2BAA2B;CAClC,CAAC;AAIX,iDAAiD;AACjD,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,UAAU,CAAC,KAAK;IAC1B,QAAQ,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM;IACnE,WAAW,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,SAAS;IAC7F,KAAK,EAAE,UAAU,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK;IAC1H,SAAS,EAAE,IAAI,EAAE,kBAAkB;CAC3B,CAAC;AAgBX;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,IAAwB;IAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAc,CAAC;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAuB,EAAE,MAAyB;IACnF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAErD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,yCAAyC;IACzC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,QAAgB;IAC9D,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC,KAAK,QAAQ,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACtD,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,MAAM;SAC1C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;AACH,CAAC"}

package/dist/version.d.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export declare const VERSION = "1.3.0";
+export declare const VERSION = "1.3.1";

package/dist/version.js

@@ -2,5 +2,5 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.3.0';
+export const VERSION = '1.3.1';
 //# sourceMappingURL=version.js.map

package/docs/CHANGELOG.md

@@ -1,3 +1,11 @@
+### 1.3.1
+**Patch — RBAC role-name case-insensitivity.** Follow-up to the v1.3.0 fail-closed
+permission change. `getUserPermissions` now resolves both the per-user `role` and the
+`defaultRole` fall-back case-insensitively: a lowercase `"operator"` / `"admin"` in
+`MCP_PERMISSIONS_CONFIG` (a common real-world spelling) maps to the correct mask instead
+of silently collapsing to an empty (no-permission) mask. Unknown role names still fail
+closed to `NONE`. Regression tests added under `tests/permissions/`.
+
 ### 1.3.0
 **Security hardening release.** A full OWASP-aligned audit (API Top 10 2023 + Top 10 2021)
 drove fixes across access control, authentication, injection, transport, configuration,

package/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Home Assistant MCP Wrapper",
-    "version": "1.3.0",
+    "version": "1.3.1",
     "description": "REST endpoints that wrap MCP tools for Home Assistant integration. Raw JSON-RPC passthrough available at POST / for n8n compatibility."
   },
   "servers": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffeerunhobby/mcp-ha-connect",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Smart home MCP server for Home Assistant plus Local AI integration",
   "type": "module",
   "main": "dist/index.js",

package/src/permissions/index.ts

@@ -38,17 +38,36 @@ export interface PermissionsConfig {
   defaultRole?: RoleName;
 }
 
+/**
+ * Resolve a role name to its permission mask, case-insensitively.
+ *
+ * Config (and JSON) commonly use lowercase role names ("operator") while the
+ * `Role` map is keyed uppercase ("OPERATOR"). Normalize here so BOTH the per-user
+ * role and the `defaultRole` fall-back resolve consistently. An unknown/undefined
+ * name fails closed to `Role.NONE` (never `undefined`, which downstream coerces to
+ * a zero mask anyway but is easy to mishandle).
+ */
+function resolveRoleName(name: string | undefined): number {
+  if (!name) {
+    return Role.NONE;
+  }
+  const key = name.toUpperCase() as RoleName;
+  return Role[key] ?? Role.NONE;
+}
+
 /**
  * Get permission mask for a user by their JWT sub claim
  */
 export function getUserPermissions(sub: string | undefined, config: PermissionsConfig): number {
+  const fallback = resolveRoleName(config.defaultRole);
+
   if (!sub) {
-    return config.defaultRole ? Role[config.defaultRole] : Role.NONE;
+    return fallback;
   }
 
   const user = config.users.find((u) => u.sub === sub);
   if (!user) {
-    return config.defaultRole ? Role[config.defaultRole] : Role.NONE;
+    return fallback;
   }
 
   // Direct mask takes precedence over role
@@ -56,9 +75,7 @@ export function getUserPermissions(sub: string | undefined, config: PermissionsC
     return user.mask;
   }
 
-  // Convert role to uppercase for lookup (config may have lowercase)
-  const roleKey = user.role?.toUpperCase() as RoleName | undefined;
-  return roleKey && Role[roleKey] !== undefined ? Role[roleKey] : Role.NONE;
+  return resolveRoleName(user.role);
 }
 
 /**

package/src/version.ts

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.3.0';
+export const VERSION = '1.3.1';

package/tests/permissions/index.test.ts

@@ -143,6 +143,27 @@ describe('getUserPermissions', () => {
     const configWithDefault = { ...config, defaultRole: 'READONLY' as const };
     expect(getUserPermissions('unknown', configWithDefault)).toBe(Role.READONLY);
   });
+
+  it('should resolve a lowercase defaultRole (case-insensitive)', () => {
+    // Real-world config commonly uses lowercase ("operator"); it must resolve to
+    // the OPERATOR mask, not silently fall through to an empty/undefined mask.
+    const cfg = { users: [], defaultRole: 'operator' as unknown as 'OPERATOR' };
+    expect(getUserPermissions('unlisted-sub', cfg)).toBe(Role.OPERATOR);
+    expect(getUserPermissions(undefined, cfg)).toBe(Role.OPERATOR);
+  });
+
+  it('should resolve a lowercase per-user role (case-insensitive)', () => {
+    const cfg = {
+      users: [{ sub: 'claude', role: 'admin' as unknown as 'ADMIN' }],
+      defaultRole: 'NONE' as const,
+    };
+    expect(getUserPermissions('claude', cfg)).toBe(Role.ADMIN);
+  });
+
+  it('should fail closed to NONE for an unrecognized role name', () => {
+    const cfg = { users: [], defaultRole: 'wizard' as unknown as 'ADMIN' };
+    expect(getUserPermissions('anyone', cfg)).toBe(Role.NONE);
+  });
 });
 
 describe('parsePermissionsConfig', () => {