@hachej/boring-mcp 0.1.82 → 0.1.83

package/dist/server/index.d.ts

@@ -358,6 +358,7 @@ interface RegisterBoringMcpRoutesOptions {
     provider?: ManagedConnectorProvider;
     env?: NodeJS.ProcessEnv;
     transport?: McpTransportClient;
+    resolveTrustedWorkspaceId?: (request: FastifyRequest) => string | undefined;
     /**
      * Behavior when boring-mcp is disabled for this deployment.
      * - `skip` (default): do not register the routes at all (client sees 404).

package/dist/server/index.js

@@ -1812,10 +1812,10 @@ function createBoringMcpAppAgentToolsForRequest(app, ctx, options) {
   if (!userId) return [];
   return createBoringMcpAppAgentTools(app, { workspaceId: ctx.workspaceId, userId }, options);
 }
-async function requireBoringMcpActor(app, request) {
+async function requireBoringMcpActor(app, request, admittedWorkspaceId) {
   const body = asRecord(request.body);
   const query = asRecord(request.query);
-  const workspaceId = validateWorkspaceId(
+  const workspaceId = admittedWorkspaceId ?? validateWorkspaceId(
     request.headers["x-boring-workspace-id"] ?? body.workspaceId ?? query.workspaceId,
     request.id
   );
@@ -1831,6 +1831,33 @@ function sourceActionRateLimitKey(request) {
   const workspaceId = typeof request.headers["x-boring-workspace-id"] === "string" ? request.headers["x-boring-workspace-id"] : "unknown-workspace";
   return `${request.user?.id ?? request.ip}:${workspaceId}`;
 }
+function d1HostScopeViolation(request) {
+  throw routeError(421, ERROR_CODES.D1_HOST_SCOPE_VIOLATION, ERROR_CODES.D1_HOST_SCOPE_VIOLATION, request.id);
+}
+function presentedWorkspaceIds(request) {
+  const presented = [];
+  const append = (value) => {
+    if (Array.isArray(value)) presented.push(...value.length > 0 ? value : [value]);
+    else presented.push(value);
+  };
+  let foundRawHeader = false;
+  for (let index = 0; index < request.raw.rawHeaders.length; index += 2) {
+    if (request.raw.rawHeaders[index]?.toLowerCase() !== "x-boring-workspace-id") continue;
+    foundRawHeader = true;
+    append(request.raw.rawHeaders[index + 1]?.split(","));
+  }
+  if (!foundRawHeader) {
+    for (const [key, value] of Object.entries(request.headers)) {
+      if (key.toLowerCase() === "x-boring-workspace-id") append(value);
+    }
+  }
+  for (const value of [request.query, request.body]) {
+    if (value && typeof value === "object" && !Array.isArray(value) && Object.prototype.hasOwnProperty.call(value, "workspaceId")) {
+      append(value.workspaceId);
+    }
+  }
+  return presented;
+}
 function sourceIdFromBody(body, requestId) {
   const sourceId = parseString(asRecord(body).sourceId);
   if (!sourceId) throw routeError(400, ERROR_CODES.VALIDATION_FAILED, "sourceId is required", requestId);
@@ -1850,6 +1877,29 @@ function registerBoringMcpRoutes(app, options) {
   };
   const routeTransport = options.transport ?? createComposioMcpTransportFor(options.config, options.env);
   const routeGate = new InMemoryMcpRateBudgetGate({ maxCalls: 100, maxToolCalls: 10, windowMs: 6e4 });
+  const admittedWorkspaceIds = /* @__PURE__ */ new WeakMap();
+  const trustedWorkspaceId = (request) => options.resolveTrustedWorkspaceId?.(request);
+  const sourceRouteRateLimitKey = (request) => {
+    const trusted = trustedWorkspaceId(request);
+    if (trusted === void 0) return sourceActionRateLimitKey(request);
+    const userId = request.user?.id;
+    if (!userId) throw routeError(401, ERROR_CODES.UNAUTHORIZED, "Authentication required", request.id);
+    return `${userId}:${trusted}`;
+  };
+  const admitTrustedWorkspace = async (request) => {
+    const trusted = trustedWorkspaceId(request);
+    if (trusted === void 0) return;
+    for (const presented of presentedWorkspaceIds(request)) {
+      let normalized;
+      try {
+        normalized = validateWorkspaceId(presented, request.id);
+      } catch {
+        d1HostScopeViolation(request);
+      }
+      if (normalized !== trusted) d1HostScopeViolation(request);
+    }
+    admittedWorkspaceIds.set(request, trusted);
+  };
   function adapterFor(actor) {
     const registry = createUserSettingsMcpSourceRegistry(app, actor);
     return {
@@ -1865,18 +1915,22 @@ function registerBoringMcpRoutes(app, options) {
       hardening: { gate: routeGate, timeoutMs: 3e4 }
     });
   }
-  app.get("/api/v1/boring-mcp/sources", async (request) => {
+  app.get("/api/v1/boring-mcp/sources", {
+    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceRouteRateLimitKey, allowList: (request) => trustedWorkspaceId(request) === void 0 } },
+    preHandler: admitTrustedWorkspace
+  }, async (request) => {
     assertEnabled(request.id);
-    const actor = await requireBoringMcpActor(app, request);
+    const actor = await requireBoringMcpActor(app, request, admittedWorkspaceIds.get(request));
     const { registry } = adapterFor(actor);
     const sources = await registry.listSources(actor);
     return { sourceStatuses: sources.map(createMcpSourceStatusPayload) };
   });
   app.post("/api/v1/boring-mcp/connect", {
-    config: { rateLimit: { ...SOURCE_CONNECT_RATE_LIMIT, keyGenerator: sourceActionRateLimitKey } }
+    config: { rateLimit: { ...SOURCE_CONNECT_RATE_LIMIT, keyGenerator: sourceRouteRateLimitKey } },
+    preHandler: admitTrustedWorkspace
   }, async (request, reply) => {
     assertEnabled(request.id);
-    const actor = await requireBoringMcpActor(app, request);
+    const actor = await requireBoringMcpActor(app, request, admittedWorkspaceIds.get(request));
     const { adapter } = adapterFor(actor);
     const provider = providerFromBody(request.body, request.id);
     const result = await withMcpHttpErrors(request.id, () => adapter.startConnect(actor, { provider }));
@@ -1885,27 +1939,30 @@ function registerBoringMcpRoutes(app, options) {
     return { status, connectUrl };
   });
   app.post("/api/v1/boring-mcp/refresh", {
-    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceActionRateLimitKey } }
+    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceRouteRateLimitKey } },
+    preHandler: admitTrustedWorkspace
   }, async (request) => {
     assertEnabled(request.id);
-    const actor = await requireBoringMcpActor(app, request);
+    const actor = await requireBoringMcpActor(app, request, admittedWorkspaceIds.get(request));
     const { adapter } = adapterFor(actor);
     const result = await withMcpHttpErrors(request.id, () => adapter.refreshStatus(actor, sourceIdFromBody(request.body, request.id)));
     return { status: result };
   });
   app.post("/api/v1/boring-mcp/disconnect", {
-    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceActionRateLimitKey } }
+    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceRouteRateLimitKey } },
+    preHandler: admitTrustedWorkspace
   }, async (request) => {
     assertEnabled(request.id);
-    const actor = await requireBoringMcpActor(app, request);
+    const actor = await requireBoringMcpActor(app, request, admittedWorkspaceIds.get(request));
     const status = await withMcpHttpErrors(request.id, () => adapterFor(actor).adapter.disconnectSource(actor, sourceIdFromBody(request.body, request.id)));
     return { status };
   });
   app.post("/api/v1/boring-mcp/tools", {
-    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceActionRateLimitKey } }
+    config: { rateLimit: { ...SOURCE_ACTION_RATE_LIMIT, keyGenerator: sourceRouteRateLimitKey } },
+    preHandler: admitTrustedWorkspace
   }, async (request) => {
     assertEnabled(request.id);
-    const actor = await requireBoringMcpActor(app, request);
+    const actor = await requireBoringMcpActor(app, request, admittedWorkspaceIds.get(request));
     const body = asRecord(request.body);
     const result = await withMcpHttpErrors(request.id, () => handlersFor(actor).searchTools(actor, {
       sourceId: sourceIdFromBody(request.body, request.id),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-mcp",
-  "version": "0.1.82",
+  "version": "0.1.83",
   "type": "module",
   "private": false,
   "license": "MIT",
@@ -49,8 +49,8 @@
     "fastify": "^5.9.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "@hachej/boring-core": "0.1.82",
-    "@hachej/boring-workspace": "0.1.82"
+    "@hachej/boring-core": "0.1.83",
+    "@hachej/boring-workspace": "0.1.83"
   },
   "devDependencies": {
     "fastify": "^5.9.0",
@@ -66,8 +66,8 @@
     "tsup": "^8.4.0",
     "typescript": "~6.0.3",
     "vitest": "^4.1.9",
-    "@hachej/boring-core": "0.1.82",
-    "@hachej/boring-workspace": "0.1.82"
+    "@hachej/boring-core": "0.1.83",
+    "@hachej/boring-workspace": "0.1.83"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0"