@com55/node-red-ai-access 0.2.0-beta.1 → 0.2.0-beta.2

package/CHANGELOG.md

@@ -8,6 +8,52 @@ and this project adheres to
 
 ## Unreleased
 
+## [0.2.0-beta.2] - 2026-10-28
+
+### Fixed
+
+- OAuth route collision check no longer counts disabled `http in` nodes or nodes
+  on disabled flows; collisions are re-evaluated from scratch on every deploy,
+  and an enabled `http in` node is reported once (not again as an Express "bound
+  dispatch" route).
+- OAuth route collision check ignores `http in` nodes in subflow templates
+  without a running instance, compares real mounted paths (`httpAdminRoot` /
+  `httpNodeRoot`), and matches paths case-insensitively like Express.
+- `GET /mcp/api/v1/oauth/status` no longer exposes absolute `httpStatic`
+  filesystem paths to users without full (`*`) permission.
+- Editor sidebar: OAuth lifetime number inputs and unit dropdowns sit on one
+  line, including the narrow Node-RED 5 sidebar.
+- Editor sidebar: OAuth route collisions are shown as a readable bulleted list,
+  one route per line with paths in `<code>`; `http in` nodes link to the node in
+  the editor.
+- Editor sidebar: Public URL "Check" result is shown as a clear green/red
+  status; loopback notes and the trust proxy state are moved into a muted,
+  collapsible "About the check" section with human-readable wording.
+- OAuth route collision check also honours `httpStaticRoot` (and per-entry
+  `httpStatic` roots).
+- `/mcp` page Access links: the area under the form now always shows generic
+  usage (with a `<YOUR_TOKEN>` placeholder) for the currently selected channel
+  and updates when the channel changes. The real token and client setup are
+  shown once in a modal right after creation; closing it removes the token from
+  the page.
+- Access link create/list responses are sent with `Cache-Control: no-store` and
+  `Pragma: no-cache`.
+- Access link tokens are kept in memory as a SHA-256 hash only (the raw token is
+  no longer retained after creation).
+
+### Breaking
+
+- **Access tokens can no longer be viewed or copied after creation:**
+  `GET /mcp/api/v1/links` no longer returns `token` (rest/mcp) or `url`
+  (get_link), and the links table only offers Revoke. Revoke and create a new
+  token instead.
+
+### Added
+
+- Editor sidebar: short "How to use MCP OAuth" help in the OAuth section.
+- `GET /mcp/api/v1/oauth/status` returns structured `details` (path, source,
+  node id/name) for each collision.
+
 ## [0.2.0-beta.1] - 2026-10-28
 
 First pre-release of 0.2.0, published under the npm `beta` dist-tag.

package/README.md

@@ -287,9 +287,9 @@ a `code`. `token_expired` also includes `expiredAt` and `accessLinksUrl` (the
 
 Access links are **in memory** (default TTL **4h**, max 10). Caps: **get_link ≤
 24h**, **rest/mcp ≤ 30d**. Creating a link returns the raw `token` plus a
-self-contained `url` for `get_link` (`/mcp/a/<token>`). While the link remains
-active, `GET /links` includes `url` again so admins can re-copy from `/mcp` (the
-raw `token` field stays create-only). After a restart every old token is
+self-contained `url` for `get_link` (`/mcp/a/<token>`). The token is shown only
+once: `GET /links` never returns `token` or `url`, so to give access again
+revoke the link and create a new one. After a restart every old token is
 invalid.
 
 Call `list_flows` or `get_flow` first and pass the returned `rev` as

package/ai-access.html

@@ -14,7 +14,7 @@
     }
     window.__com55AiAccessSidebarLoading = true;
 
-    var EDITOR_SIDEBAR_ASSET_VERSION = '0.2.0-beta.1';
+    var EDITOR_SIDEBAR_ASSET_VERSION = '0.2.0-beta.2';
     var root = (RED.settings.httpAdminRoot || '/').replace(/\/$/, '');
     var src =
       (root || '') +