@coffer-org/server 1.9.0 → 1.11.0

package/dist/index.js

@@ -31,6 +31,7 @@ import { maskTree, preserveTree } from "./field-masking.js";
 import { writePluginSettings } from "./settings-write.js";
 import { rootLogger, getLogger } from "./log.js";
 import { uploadsDir } from "./uploads.js";
+import { verifyUploadTicket } from "./upload-ticket.js";
 const ENV_FILE = join(process.cwd(), '.env');
 if (existsSync(ENV_FILE))
     process.loadEnvFile(ENV_FILE);
@@ -75,6 +76,11 @@ app.addHook('onRequest', async (req, reply) => {
         return;
     if (PUBLIC_API_PATHS.some((p) => req.url.startsWith(p)))
         return;
+    if (req.method === 'POST' && req.url === '/api/upload') {
+        const auth = req.headers.authorization;
+        if (auth?.startsWith('Bearer ') && verifyUploadTicket(auth.slice('Bearer '.length)))
+            return;
+    }
     const user = await resolveRequestUser(req);
     if (!user) {
         if (isMcp) {

package/dist/mcp-tools.d.ts

@@ -10,7 +10,7 @@ export interface McpToolDef {
     httpName: string;
     description: string;
     inputSchema: z.ZodRawShape;
-    scope: 'crud' | 'plugin' | 'rag' | 'settings';
+    scope: 'crud' | 'plugin' | 'rag' | 'settings' | 'upload';
     role: AuthRole;
     handler: (args: Record<string, unknown>) => Promise<ToolResult>;
 }

package/dist/mcp-tools.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { buildTools } from '@coffer-org/mcp';
 import { SchemaCache } from '@coffer-org/mcp/schema';
 import { LocalClient } from "./mcp-local.js";
+import { mintUploadTicket } from "./upload-ticket.js";
 import { pluginHooks, pluginCtx } from "./plugin-hooks.js";
 import { getActiveRegistry } from "./registry-context.js";
 import { describeCondition } from '@coffer-org/sdk/condition';
@@ -49,6 +50,27 @@ export async function collectMcpTools(opts = {}) {
             handler: t.handler,
         });
     }
+    {
+        const actor = opts.actor ?? 'mcp';
+        out.push({
+            server: 'coffer',
+            bareName: 'create_upload_ticket',
+            httpName: 'create_upload_ticket',
+            description: 'Mint a short-lived (60 min) upload-only token for POST /api/upload. Use it as a Bearer header to stream local files to the server without sending their bytes through this conversation. The token cannot read or modify records. Response of each upload is {"filename":"<name>"} — store it in a file/image field as {"name":"<name>"}.',
+            inputSchema: {},
+            scope: 'upload',
+            role: 'member',
+            handler: async () => {
+                const { token, expiresInSec } = mintUploadTicket(actor);
+                return ok({
+                    token,
+                    upload_url: '/api/upload',
+                    expires_in: expiresInSec,
+                    how_to: 'curl -H "Authorization: Bearer <token>" -F "file=@<path>" <base-url>/api/upload  →  {"filename":"<name>"}. Then set a file field to {"name":"<name>"}.',
+                });
+            },
+        });
+    }
     for (const [id, h] of Object.entries(pluginHooks)) {
         for (const t of h.agent?.tools ?? []) {
             out.push({

package/dist/upload-ticket.d.ts

@@ -0,0 +1,7 @@
+export declare function mintUploadTicket(actor: string): {
+    token: string;
+    expiresInSec: number;
+};
+export declare function verifyUploadTicket(raw: string): boolean;
+export declare function __resetUploadTickets(): void;
+export declare function __injectUploadTicket(raw: string, exp: number): void;

package/dist/upload-ticket.js

@@ -0,0 +1,29 @@
+import { generateToken, hashToken } from "./auth-crypto.js";
+const TTL_MS = 60 * 60 * 1000;
+const store = new Map();
+export function mintUploadTicket(actor) {
+    const raw = generateToken();
+    const exp = Date.now() + TTL_MS;
+    store.set(hashToken(raw), { actor, exp });
+    const t = setTimeout(() => store.delete(hashToken(raw)), TTL_MS);
+    if (typeof t === 'object' && 'unref' in t)
+        t.unref();
+    return { token: raw, expiresInSec: TTL_MS / 1000 };
+}
+export function verifyUploadTicket(raw) {
+    const key = hashToken(raw);
+    const entry = store.get(key);
+    if (!entry)
+        return false;
+    if (entry.exp <= Date.now()) {
+        store.delete(key);
+        return false;
+    }
+    return true;
+}
+export function __resetUploadTickets() {
+    store.clear();
+}
+export function __injectUploadTicket(raw, exp) {
+    store.set(hashToken(raw), { actor: 'test', exp });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffer-org/server",
-  "version": "1.9.0",
+  "version": "1.11.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -32,6 +32,7 @@
     "@fastify/static": "^9.1.3",
     "@mikro-orm/core": "^7.1.6",
     "@mikro-orm/sqlite": "^7.1.6",
+    "@modelcontextprotocol/sdk": "^1.5.0",
     "fastify": "^5.2.1",
     "open-graph-scraper": "^6.11.0",
     "pino": "^9.14.0",