@iobroker/mcp-server 1.5.1 → 1.6.1

package/build/index.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createInProcessMcp = exports.McpServer = void 0;
+const node_async_hooks_1 = require("node:async_hooks");
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = __importDefault(require("node:os"));
 const node_net_1 = __importDefault(require("node:net"));
@@ -173,8 +174,10 @@ class McpServer {
     config;
     extension;
     routerPrefix;
-    /** The ioBroker user whose permissions every MCP request runs with. */
+    /** The ioBroker user whose permissions MCP requests run with when no user is logged in. */
     defaultUser;
+    /** The user of the MCP request being processed, set by {@link runAs} for each HTTP request. */
+    requestUser = new node_async_hooks_1.AsyncLocalStorage();
     /** Default language used to localize device/room/function names. */
     language;
     /**
@@ -227,11 +230,13 @@ class McpServer {
         // (e.g. `/mcp/`) within the shared web server, and strip the trailing slash so the route
         // matches both `/mcp` and `/mcp/` (Express, non-strict).
         this.mcpPath = this.extension ? this.routerPrefix.replace(/\/$/, '') : '/mcp';
-        // Determine the ioBroker user whose permissions all MCP requests run with.
-        // Prefer this adapter's own setting; when embedded, fall back to the host web server's
-        // default user; finally to "admin". Always normalize to the "system.user." prefix.
-        const rawUser = this.config.defaultUser || webSettings.defaultUser || 'admin';
-        this.defaultUser = (rawUser.startsWith('system.user.') ? rawUser : `system.user.${rawUser}`);
+        // Determine the ioBroker user whose permissions unauthenticated MCP requests run with.
+        // As a web extension the host `web` instance decides about authentication, so its default
+        // user wins there; otherwise prefer this adapter's own setting. Finally fall back to "admin".
+        const rawUser = (this.extension
+            ? webSettings.defaultUser || this.config.defaultUser
+            : this.config.defaultUser || webSettings.defaultUser) || 'admin';
+        this.defaultUser = McpServer.toUserId(rawUser);
         this.config.defaultUser = this.defaultUser;
         this.language = webSettings.language || 'en';
         // Embedded callers may set the permission toggles explicitly (they don't read the mcp config).
@@ -607,15 +612,57 @@ class McpServer {
             pro: false,
         };
     }
+    /** Normalize a plain user name or a `system.user.*` id to the full id. */
+    static toUserId(user) {
+        return (user.startsWith('system.user.') ? user : `system.user.${user}`);
+    }
+    /**
+     * The ioBroker user a request runs as: the logged-in user when the request was authenticated (by
+     * us or, as a web extension, by the host `web` instance), otherwise the default user.
+     */
+    getRequestUser(req) {
+        const user = req.user;
+        return user ? McpServer.toUserId(user) : this.defaultUser;
+    }
+    /** The user the current tool call runs as. Outside a request (embedded mode) the default user. */
+    get user() {
+        return this.requestUser.getStore() || this.defaultUser;
+    }
+    /**
+     * Process a request of a session with the permissions of the session's user. The SDK dispatches the
+     * contained messages within this call, so every tool reached from here sees that user in {@link user}.
+     */
+    runAs(user, handle) {
+        return this.requestUser.run(user, handle);
+    }
+    /**
+     * Get the session of a request. A session is bound to the user that opened it: requests of another
+     * user are answered like an unknown session, so that a leaked session id gives no access.
+     */
+    getSession(req, res, sessionId) {
+        const session = this.sessions[sessionId];
+        if (session && session.user !== this.getRequestUser(req)) {
+            this.adapter.log.warn(`Rejected MCP request from ${req.ip}: session ${sessionId} belongs to another user than ${this.getRequestUser(req)}`);
+            this.sendSessionNotFound(res, sessionId);
+            return undefined;
+        }
+        if (!session) {
+            this.sendSessionNotFound(res, sessionId);
+        }
+        return session;
+    }
     /** Handle client -> server messages (initialize, tools/call, ...). */
     async handleMcpPost(req, res) {
         const sessionId = req.headers['mcp-session-id'];
-        let transport = sessionId ? this.sessions[sessionId]?.transport : undefined;
-        if (!transport) {
-            if (sessionId) {
-                this.sendSessionNotFound(res, sessionId);
+        const user = this.getRequestUser(req);
+        let transport;
+        if (sessionId) {
+            transport = this.getSession(req, res, sessionId)?.transport;
+            if (!transport) {
                 return;
             }
+        }
+        else {
             // No session yet: only an "initialize" request may create one.
             if (!(0, types_js_1.isInitializeRequest)(req.body)) {
                 res.status(400).json({
@@ -630,8 +677,8 @@ class McpServer {
             transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
                 sessionIdGenerator: () => (0, node_crypto_1.randomUUID)(),
                 onsessioninitialized: (sid) => {
-                    this.sessions[sid] = { transport: transport, server, subscriptions };
-                    this.adapter.log.debug(`MCP session initialized: ${sid}`);
+                    this.sessions[sid] = { transport: transport, server, subscriptions, user };
+                    this.adapter.log.debug(`MCP session initialized: ${sid} (user ${user})`);
                 },
             });
             transport.onclose = () => {
@@ -644,21 +691,20 @@ class McpServer {
             };
             await server.connect(transport);
         }
-        await transport.handleRequest(req, res, req.body);
+        const sessionTransport = transport;
+        await this.runAs(user, () => sessionTransport.handleRequest(req, res, req.body));
     }
     /** Handle server -> client SSE stream (GET) and session termination (DELETE). */
     async handleMcpSessionRequest(req, res) {
         const sessionId = req.headers['mcp-session-id'];
-        const transport = sessionId ? this.sessions[sessionId]?.transport : undefined;
-        if (!transport) {
-            if (sessionId) {
-                this.sendSessionNotFound(res, sessionId);
-                return;
-            }
+        if (!sessionId) {
             res.status(400).send('Invalid or missing session ID');
             return;
         }
-        await transport.handleRequest(req, res);
+        const session = this.getSession(req, res, sessionId);
+        if (session) {
+            await this.runAs(session.user, () => session.transport.handleRequest(req, res));
+        }
     }
     /**
      * Answer a request of an unknown session, e.g. after a restart of the adapter or when the session was closed.
@@ -1259,7 +1305,7 @@ class McpServer {
             inputSchema: { id: zod_1.z.string().describe('Object ID, e.g. system.adapter.admin.0 or hm-rpc.0.ABC') },
         }, async ({ id }) => {
             try {
-                const object = await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser });
+                const object = await this.adapter.getForeignObjectAsync(id, { user: this.user });
                 return ok({ ok: true, data: { object: object ?? null } });
             }
             catch (e) {
@@ -1303,7 +1349,7 @@ class McpServer {
                     }
                     const { adapterName, fileName } = McpServer.parseFilePath(path);
                     const file = await this.adapter.readFileAsync(adapterName, fileName, {
-                        user: this.defaultUser,
+                        user: this.user,
                     });
                     const data = Buffer.isBuffer(file.file) ? file.file : Buffer.from(file.file || '');
                     const mimeType = file.mimeType || 'application/octet-stream';
@@ -1348,7 +1394,7 @@ class McpServer {
             try {
                 const { adapterName, fileName } = McpServer.parseFilePath(path);
                 const exists = await this.adapter.fileExistsAsync(adapterName, fileName, {
-                    user: this.defaultUser,
+                    user: this.user,
                 });
                 return ok({ ok: true, data: { path, exists: !!exists } });
             }
@@ -1560,7 +1606,7 @@ class McpServer {
                         const upload = this.getUpload(upload_id);
                         const { adapterName, fileName } = McpServer.parseFilePath(path);
                         await this.adapter.writeFileAsync(adapterName, fileName, node_fs_1.default.readFileSync(upload.file), {
-                            user: this.defaultUser,
+                            user: this.user,
                         });
                         this.removeTransfer(upload_id);
                         return ok({ ok: true, data: { path, size: upload.size } });
@@ -1585,7 +1631,7 @@ class McpServer {
             }, async ({ path }) => {
                 try {
                     const { adapterName, fileName } = McpServer.parseFilePath(path);
-                    await this.adapter.delFileAsync(adapterName, fileName, { user: this.defaultUser });
+                    await this.adapter.delFileAsync(adapterName, fileName, { user: this.user });
                     return ok({ ok: true, data: { path, deleted: true } });
                 }
                 catch (e) {
@@ -1631,7 +1677,7 @@ class McpServer {
                     if (!dirName) {
                         throw new Error('Path must contain a directory after the adapter, e.g. "0_userdata.0/my-folder"');
                     }
-                    await this.adapter.mkdirAsync(adapterName, dirName, { user: this.defaultUser });
+                    await this.adapter.mkdirAsync(adapterName, dirName, { user: this.user });
                     return ok({ ok: true, data: { path } });
                 }
                 catch (e) {
@@ -2206,7 +2252,7 @@ class McpServer {
             mimeType: 'application/json',
         }, async (uri, variables) => {
             const id = decodeURIComponent(String(variables.id));
-            const state = await this.adapter.getForeignStateAsync(id, { user: this.defaultUser });
+            const state = await this.adapter.getForeignStateAsync(id, { user: this.user });
             const body = state
                 ? { id, val: state.val, ack: state.ack, ts: state.ts, lc: state.lc, q: state.q }
                 : { id, val: null };
@@ -2218,7 +2264,7 @@ class McpServer {
             mimeType: 'application/json',
         }, async (uri, variables) => {
             const id = decodeURIComponent(String(variables.id));
-            const obj = await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser });
+            const obj = await this.adapter.getForeignObjectAsync(id, { user: this.user });
             return {
                 contents: [{ uri: uri.href, mimeType: 'application/json', text: JSON.stringify(obj ?? null) }],
             };
@@ -2278,13 +2324,13 @@ class McpServer {
             try {
                 if (id.includes('*')) {
                     // Wildcard pattern: expand to all matching states.
-                    const matches = await this.adapter.getForeignStatesAsync(id, { user: this.defaultUser });
+                    const matches = await this.adapter.getForeignStatesAsync(id, { user: this.user });
                     for (const matchId of Object.keys(matches || {})) {
                         states.push(McpServer.stateEntry(matchId, matches[matchId]));
                     }
                 }
                 else {
-                    const state = await this.adapter.getForeignStateAsync(id, { user: this.defaultUser });
+                    const state = await this.adapter.getForeignStateAsync(id, { user: this.user });
                     states.push(McpServer.stateEntry(id, state));
                 }
             }
@@ -2302,7 +2348,7 @@ class McpServer {
     }
     /**
      * Write multiple states as one operation: the write permission of every state is verified first, so a
-     * batch containing a single state the default user may not write fails as a whole and nothing is
+     * batch containing a single state the user may not write fails as a whole and nothing is
      * written. Other failures of single states are reported per item and do not abort the rest.
      */
     async setStates(items) {
@@ -2320,7 +2366,7 @@ class McpServer {
         return results;
     }
     /**
-     * Verify that the default user may write every given state, mirroring the checks js-controller runs in
+     * Verify that the user of the request may write every given state, mirroring the checks js-controller runs in
      * `setForeignState`: the user must be able to read the object (needed for the type coercion in
      * {@link setState}) and the state ACL must allow writing — for an alias also on its write target.
      *
@@ -2328,10 +2374,10 @@ class McpServer {
      * @throws {Error} when at least one state may not be written; the message lists all of them
      */
     async assertStatesWritable(ids) {
-        if (this.defaultUser === 'system.user.admin') {
+        if (this.user === 'system.user.admin') {
             return;
         }
-        const permissions = await this.adapter.calculatePermissionsAsync(this.defaultUser, []);
+        const permissions = await this.adapter.calculatePermissionsAsync(this.user, []);
         if (permissions.groups?.includes('system.group.administrator')) {
             return;
         }
@@ -2339,7 +2385,7 @@ class McpServer {
         for (const id of new Set(ids)) {
             let obj;
             try {
-                obj = await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser });
+                obj = await this.adapter.getForeignObjectAsync(id, { user: this.user });
             }
             catch {
                 denied.push(id);
@@ -2358,14 +2404,14 @@ class McpServer {
             }
         }
         if (denied.length) {
-            throw new Error(`permissionError: user "${this.defaultUser}" may not write ${denied.join(', ')} - nothing was written`);
+            throw new Error(`permissionError: user "${this.user}" may not write ${denied.join(', ')} - nothing was written`);
         }
     }
     /**
      * The state ACL check of js-controller for `setState` on a single object.
      *
      * @param obj the state object (objects without ACL are not restricted by js-controller)
-     * @param permissions the merged group permissions of the default user
+     * @param permissions the merged group permissions of the user
      */
     isStateWritable(obj, permissions) {
         const acl = obj?.acl;
@@ -2377,7 +2423,7 @@ class McpServer {
             return false;
         }
         let mask = 0x002; // everyone write
-        if (acl.owner === this.defaultUser) {
+        if (acl.owner === this.user) {
             mask = 0x200; // owner write
         }
         else if (acl.ownerGroup && permissions.groups?.includes(acl.ownerGroup)) {
@@ -2663,13 +2709,13 @@ class McpServer {
     }
     async getSystemInfo() {
         const hostObj = await this.adapter.getForeignObjectAsync(`system.host.${this.adapter.host}`, {
-            user: this.defaultUser,
+            user: this.user,
         });
         const jsControllerVersion = hostObj?.common?.installedVersion || 'unknown';
         const totalMem = Math.round(node_os_1.default.totalmem() / (1024 * 1024));
         const freeMem = Math.round(node_os_1.default.freemem() / (1024 * 1024));
         const instanceObjs = await this.adapter.getForeignObjectsAsync('system.adapter.*', 'instance', {
-            user: this.defaultUser,
+            user: this.user,
         });
         return {
             js_controller: jsControllerVersion,
@@ -2687,7 +2733,7 @@ class McpServer {
         const result = await this.adapter.getObjectListAsync({
             startkey: '',
             endkey: '\u9999',
-        }, { sorted: true, user: this.defaultUser });
+        }, { sorted: true, user: this.user });
         const allObjects = result.rows;
         const roomMembers = room ? await this.getEnumMembers('enum.rooms.', room) : null;
         const needle = query.toLowerCase();
@@ -2723,7 +2769,7 @@ class McpServer {
     }
     async listDevices(params) {
         const lang = params.language || this.language;
-        const rooms = await (0, devices_1.getAiFriendlyStructure)(this.adapter, lang, { user: this.defaultUser });
+        const rooms = await (0, devices_1.getAiFriendlyStructure)(this.adapter, lang, { user: this.user });
         if (params.room) {
             const needle = params.room.toLowerCase();
             return rooms.filter(r => r.roomName.toLowerCase() === needle);
@@ -2753,20 +2799,20 @@ class McpServer {
             options.step = step;
         }
         // GetHistoryOptions has no typed `user` field, but the controller honors it for ACL checks.
-        options.user = this.defaultUser;
+        options.user = this.user;
         const res = await this.adapter.getHistoryAsync(params.id, options);
         return { id: params.id, values: res?.result || [] };
     }
     async listInstances() {
         const objs = await this.adapter.getForeignObjectsAsync('system.adapter.*', 'instance', {
-            user: this.defaultUser,
+            user: this.user,
         });
         const result = [];
         for (const [fullId, obj] of Object.entries(objs || {})) {
             const id = fullId.replace('system.adapter.', '');
-            const aliveState = await this.adapter.getForeignStateAsync(`${fullId}.alive`, { user: this.defaultUser });
+            const aliveState = await this.adapter.getForeignStateAsync(`${fullId}.alive`, { user: this.user });
             const connState = await this.adapter.getForeignStateAsync(`${fullId}.connected`, {
-                user: this.defaultUser,
+                user: this.user,
             });
             result.push({
                 id,
@@ -2782,7 +2828,7 @@ class McpServer {
     /** List installed adapters (system.adapter.<name> objects, no instances). */
     async listAdapters(language) {
         const lang = language || this.language;
-        const view = await this.adapter.getObjectViewAsync('system', 'adapter', { startkey: 'system.adapter.', endkey: 'system.adapter.香' }, { user: this.defaultUser });
+        const view = await this.adapter.getObjectViewAsync('system', 'adapter', { startkey: 'system.adapter.', endkey: 'system.adapter.香' }, { user: this.user });
         return view.rows.map(row => {
             const common = (row.value?.common || {});
             return {
@@ -2809,7 +2855,7 @@ class McpServer {
             return [];
         }
         // Determine which adapters are already installed.
-        const installedView = await this.adapter.getObjectViewAsync('system', 'adapter', { startkey: 'system.adapter.', endkey: 'system.adapter.香' }, { user: this.defaultUser });
+        const installedView = await this.adapter.getObjectViewAsync('system', 'adapter', { startkey: 'system.adapter.', endkey: 'system.adapter.香' }, { user: this.user });
         const installed = new Set(installedView.rows.map(row => row.value?.common?.name || row.id.replace('system.adapter.', '')));
         const results = [];
         for (const [name, entry] of Object.entries(json)) {
@@ -2847,10 +2893,10 @@ class McpServer {
         return results;
     }
     async listHosts() {
-        const objs = await this.adapter.getForeignObjectsAsync('system.host.*', 'host', { user: this.defaultUser });
+        const objs = await this.adapter.getForeignObjectsAsync('system.host.*', 'host', { user: this.user });
         const result = [];
         for (const [fullId, obj] of Object.entries(objs || {})) {
-            const aliveState = await this.adapter.getForeignStateAsync(`${fullId}.alive`, { user: this.defaultUser });
+            const aliveState = await this.adapter.getForeignStateAsync(`${fullId}.alive`, { user: this.user });
             result.push({
                 id: fullId.replace('system.host.', ''),
                 alive: !!aliveState?.val,
@@ -2865,7 +2911,7 @@ class McpServer {
      * (ported from the ioBroker n8n node's `readIobEnums`).
      */
     async readEnums(type, language, withIcons) {
-        const enums = await this.adapter.getObjectViewAsync('system', 'enum', { startkey: `enum.${type}.`, endkey: `enum.${type}.香` }, { user: this.defaultUser });
+        const enums = await this.adapter.getObjectViewAsync('system', 'enum', { startkey: `enum.${type}.`, endkey: `enum.${type}.香` }, { user: this.user });
         const result = [];
         // Cache member objects so a member shared by several enums is read only once.
         const cache = {};
@@ -2885,7 +2931,7 @@ class McpServer {
                 if (obj === undefined) {
                     try {
                         cache[member] =
-                            (await this.adapter.getForeignObjectAsync(member, { user: this.defaultUser })) || false;
+                            (await this.adapter.getForeignObjectAsync(member, { user: this.user })) || false;
                     }
                     catch {
                         cache[member] = false;
@@ -2914,10 +2960,10 @@ class McpServer {
     }
     /** Write a state, coercing the value to the state's declared type (boolean/number/string). */
     async setState(id, value, ack) {
-        const obj = await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser });
+        const obj = await this.adapter.getForeignObjectAsync(id, { user: this.user });
         const stateType = obj?.common?.type;
         const coerced = McpServer.coerceValue(value, stateType);
-        await this.adapter.setForeignStateAsync(id, coerced, ack, { user: this.defaultUser });
+        await this.adapter.setForeignStateAsync(id, coerced, ack, { user: this.user });
         return coerced;
     }
     /** Coerce an arbitrary value to the given ioBroker state type. */
@@ -2971,7 +3017,7 @@ class McpServer {
      */
     async readFile(path, base64, offset = 0, length = DEFAULT_MAX_READ_BYTES) {
         const { adapterName, fileName } = McpServer.parseFilePath(path);
-        const data = await this.adapter.readFileAsync(adapterName, fileName, { user: this.defaultUser });
+        const data = await this.adapter.readFileAsync(adapterName, fileName, { user: this.user });
         const file = data?.file;
         const mimeType = data?.mimeType;
         if (file === undefined || file === null) {
@@ -3017,12 +3063,12 @@ class McpServer {
     async writeFile(path, content, base64) {
         const { adapterName, fileName } = McpServer.parseFilePath(path);
         const data = base64 ? Buffer.from(content, 'base64') : content;
-        await this.adapter.writeFileAsync(adapterName, fileName, data, { user: this.defaultUser });
+        await this.adapter.writeFileAsync(adapterName, fileName, data, { user: this.user });
     }
     /** List a directory in an adapter file storage. */
     async listFiles(path) {
         const { adapterName, dirName } = McpServer.parseDirPath(path);
-        const entries = await this.adapter.readDirAsync(adapterName, dirName, { user: this.defaultUser });
+        const entries = await this.adapter.readDirAsync(adapterName, dirName, { user: this.user });
         return (entries || []).map(entry => ({
             file: entry.file,
             isDir: !!entry.isDir,
@@ -3037,11 +3083,11 @@ class McpServer {
         if (from.adapterName !== to.adapterName) {
             throw new Error('Renaming across adapter storages is not supported; both paths must share the adapter');
         }
-        await this.adapter.renameAsync(from.adapterName, from.fileName, to.fileName, { user: this.defaultUser });
+        await this.adapter.renameAsync(from.adapterName, from.fileName, to.fileName, { user: this.user });
     }
     /** Create or update an object, merging common/native into an existing object (n8n `setIobObject`). */
     async setObject(id, obj) {
-        let existing = await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser });
+        let existing = await this.adapter.getForeignObjectAsync(id, { user: this.user });
         if (existing) {
             if (obj.common) {
                 existing.common = { ...existing.common, ...obj.common };
@@ -3053,7 +3099,7 @@ class McpServer {
         else {
             existing = obj;
         }
-        return this.adapter.setForeignObjectAsync(id, existing, { user: this.defaultUser });
+        return this.adapter.setForeignObjectAsync(id, existing, { user: this.user });
     }
     /** Split a file path "<adapter>/<dir>/<file>" into adapter name and file name. */
     static parseFilePath(path) {
@@ -3077,15 +3123,15 @@ class McpServer {
     }
     /** Delete an object, optionally with all its children. */
     async deleteObject(id, recursive) {
-        const existing = await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser });
+        const existing = await this.adapter.getForeignObjectAsync(id, { user: this.user });
         if (!existing) {
             throw new Error(`Object "${id}" does not exist`);
         }
-        await this.adapter.delForeignObjectAsync(id, { user: this.defaultUser, recursive: !!recursive });
+        await this.adapter.delForeignObjectAsync(id, { user: this.user, recursive: !!recursive });
     }
     /** Create a new state object; refuses to overwrite an existing object. */
     async createState(params) {
-        const existing = await this.adapter.getForeignObjectAsync(params.id, { user: this.defaultUser });
+        const existing = await this.adapter.getForeignObjectAsync(params.id, { user: this.user });
         if (existing) {
             throw new Error(`Object "${params.id}" already exists - use set_object to modify it`);
         }
@@ -3111,10 +3157,10 @@ class McpServer {
         if (params.desc !== undefined) {
             common.desc = params.desc;
         }
-        await this.adapter.setForeignObjectAsync(params.id, { type: 'state', common, native: {} }, { user: this.defaultUser });
+        await this.adapter.setForeignObjectAsync(params.id, { type: 'state', common, native: {} }, { user: this.user });
         if (params.def !== undefined) {
             const coerced = McpServer.coerceValue(params.def, common.type);
-            await this.adapter.setForeignStateAsync(params.id, coerced, true, { user: this.defaultUser });
+            await this.adapter.setForeignStateAsync(params.id, coerced, true, { user: this.user });
         }
         return { id: params.id };
     }
@@ -3122,7 +3168,7 @@ class McpServer {
     async createScene(params) {
         const instance = params.instance || 'scene.0';
         const instanceObj = await this.adapter.getForeignObjectAsync(`system.adapter.${instance}`, {
-            user: this.defaultUser,
+            user: this.user,
         });
         if (!instanceObj) {
             throw new Error(`Scene adapter instance "${instance}" is not installed. Install the ioBroker "scenes" adapter first.`);
@@ -3157,7 +3203,7 @@ class McpServer {
                 burstInterval: 0,
             },
         };
-        await this.adapter.setForeignObjectAsync(id, sceneObj, { user: this.defaultUser });
+        await this.adapter.setForeignObjectAsync(id, sceneObj, { user: this.user });
         return { id, members: params.members.length };
     }
     /**
@@ -3195,7 +3241,7 @@ class McpServer {
             let data;
             if (params.file_path !== undefined) {
                 const { adapterName, fileName: storageName } = McpServer.parseFilePath(params.file_path);
-                const result = await this.adapter.readFileAsync(adapterName, storageName, { user: this.defaultUser });
+                const result = await this.adapter.readFileAsync(adapterName, storageName, { user: this.user });
                 data = Buffer.isBuffer(result.file) ? result.file : Buffer.from(result.file || '');
                 fileName = storageName.split('/').pop() || '';
             }
@@ -3239,7 +3285,7 @@ class McpServer {
         if (!name || /\s/.test(name)) {
             throw new Error(`Invalid host "${name}"`);
         }
-        const hostObj = await this.adapter.getForeignObjectAsync(`system.host.${name}`, { user: this.defaultUser });
+        const hostObj = await this.adapter.getForeignObjectAsync(`system.host.${name}`, { user: this.user });
         if (hostObj?.type !== 'host') {
             throw new Error(`Host "${name}" not found`);
         }
@@ -3303,12 +3349,12 @@ class McpServer {
     /** Like admin after an installation: touching the instance objects makes the controller restart them. */
     async restartAdapterInstances(adapterName) {
         const instances = await this.adapter.getForeignObjectsAsync(`system.adapter.${adapterName}.*`, 'instance', {
-            user: this.defaultUser,
+            user: this.user,
         });
         const restarted = [];
         for (const [instanceId, instance] of Object.entries(instances || {})) {
             if (instance?.common?.enabled) {
-                await this.adapter.extendForeignObjectAsync(instanceId, {}, { user: this.defaultUser });
+                await this.adapter.extendForeignObjectAsync(instanceId, {}, { user: this.user });
                 restarted.push(instanceId.replace('system.adapter.', ''));
             }
         }
@@ -3321,7 +3367,7 @@ class McpServer {
             throw new Error(`Invalid instance "${id}", expected e.g. "hue.0"`);
         }
         const fullId = `system.adapter.${shortId}`;
-        const obj = await this.adapter.getForeignObjectAsync(fullId, { user: this.defaultUser });
+        const obj = await this.adapter.getForeignObjectAsync(fullId, { user: this.user });
         if (obj?.type !== 'instance') {
             throw new Error(`Instance "${shortId}" not found`);
         }
@@ -3332,7 +3378,7 @@ class McpServer {
         const instance = await this.getInstance(id);
         const changed = !!instance.obj.common.enabled !== enabled;
         if (changed) {
-            await this.adapter.extendForeignObjectAsync(instance.fullId, { common: { enabled } }, { user: this.defaultUser });
+            await this.adapter.extendForeignObjectAsync(instance.fullId, { common: { enabled } }, { user: this.user });
         }
         return { id: instance.id, enabled, changed };
     }
@@ -3342,7 +3388,7 @@ class McpServer {
         if (!instance.obj.common.enabled) {
             throw new Error(`Instance "${instance.id}" is not enabled - start it instead`);
         }
-        await this.adapter.extendForeignObjectAsync(instance.fullId, {}, { user: this.defaultUser });
+        await this.adapter.extendForeignObjectAsync(instance.fullId, {}, { user: this.user });
         return { id: instance.id, restarted: true };
     }
     /**
@@ -3352,11 +3398,11 @@ class McpServer {
     async setLogLevel(id, level, persistent) {
         const instance = await this.getInstance(id);
         if (persistent) {
-            await this.adapter.extendForeignObjectAsync(instance.fullId, { common: { loglevel: level } }, { user: this.defaultUser });
+            await this.adapter.extendForeignObjectAsync(instance.fullId, { common: { loglevel: level } }, { user: this.user });
         }
         else {
             await this.adapter.setForeignStateAsync(`${instance.fullId}.logLevel`, level, false, {
-                user: this.defaultUser,
+                user: this.user,
             });
         }
         return { id: instance.id, level, persistent: !!persistent };
@@ -3377,7 +3423,7 @@ class McpServer {
         const adapterName = McpServer.checkAdapterName(params.adapter);
         const host = await this.resolveHost(params.host);
         if (params.instance !== undefined) {
-            const existing = await this.adapter.getForeignObjectAsync(`system.adapter.${adapterName}.${params.instance}`, { user: this.defaultUser });
+            const existing = await this.adapter.getForeignObjectAsync(`system.adapter.${adapterName}.${params.instance}`, { user: this.user });
             if (existing) {
                 throw new Error(`Instance "${adapterName}.${params.instance}" already exists`);
             }
@@ -3397,7 +3443,7 @@ class McpServer {
             throw new Error(`Invalid version "${params.version}"`);
         }
         const adapterObj = await this.adapter.getForeignObjectAsync(`system.adapter.${adapterName}`, {
-            user: this.defaultUser,
+            user: this.user,
         });
         if (adapterObj?.type !== 'adapter') {
             throw new Error(`Adapter "${adapterName}" is not installed - use add_instance to install it`);
@@ -3428,9 +3474,9 @@ class McpServer {
      * matters when the user has custom repos active next to the default one.
      */
     async getRepositoryJson() {
-        const reposObj = await this.adapter.getForeignObjectAsync('system.repositories', { user: this.defaultUser });
+        const reposObj = await this.adapter.getForeignObjectAsync('system.repositories', { user: this.user });
         const repositories = (reposObj?.native?.repositories || {});
-        const sysCfg = await this.adapter.getForeignObjectAsync('system.config', { user: this.defaultUser });
+        const sysCfg = await this.adapter.getForeignObjectAsync('system.config', { user: this.user });
         const active = sysCfg?.common?.activeRepo;
         const activeNames = Array.isArray(active) ? active : active ? [active] : [];
         const activeWithJson = activeNames.filter(name => repositories[name]?.json);
@@ -3523,7 +3569,7 @@ class McpServer {
     /** Read a script object, failing if it is missing or not a script. */
     async getScriptObject(id) {
         const scriptId = McpServer.scriptId(id);
-        const obj = await this.adapter.getForeignObjectAsync(scriptId, { user: this.defaultUser });
+        const obj = await this.adapter.getForeignObjectAsync(scriptId, { user: this.user });
         if (obj?.type !== 'script') {
             throw new Error(`Script "${scriptId}" not found`);
         }
@@ -3532,7 +3578,7 @@ class McpServer {
     /** List the scripts of the javascript adapter (without their source). */
     async listScripts(folder) {
         const prefix = folder ? `script.js.${folder.replace(/^script\.js\./, '').replace(/\.$/, '')}.` : 'script.js.';
-        const objs = await this.adapter.getForeignObjectsAsync(`${prefix}*`, 'script', { user: this.defaultUser });
+        const objs = await this.adapter.getForeignObjectsAsync(`${prefix}*`, 'script', { user: this.user });
         return Object.entries(objs || {}).map(([id, obj]) => this.scriptInfo(id, obj));
     }
     /**
@@ -3541,7 +3587,7 @@ class McpServer {
      */
     async setScript(params) {
         const scriptId = McpServer.scriptId(params.id);
-        const existing = await this.adapter.getForeignObjectAsync(scriptId, { user: this.defaultUser });
+        const existing = await this.adapter.getForeignObjectAsync(scriptId, { user: this.user });
         if (existing && existing.type !== 'script') {
             throw new Error(`"${scriptId}" exists and is not a script`);
         }
@@ -3557,7 +3603,7 @@ class McpServer {
             if (params.enabled !== undefined) {
                 common.enabled = params.enabled;
             }
-            await this.adapter.extendForeignObjectAsync(scriptId, { common }, { user: this.defaultUser });
+            await this.adapter.extendForeignObjectAsync(scriptId, { common }, { user: this.user });
             return { id: scriptId, created: false };
         }
         const engine = (await this.getInstance(params.instance || 'javascript.0')).id;
@@ -3565,8 +3611,8 @@ class McpServer {
         const segments = scriptId.split('.');
         for (let i = 3; i < segments.length; i++) {
             const folderId = segments.slice(0, i).join('.');
-            if (!(await this.adapter.getForeignObjectAsync(folderId, { user: this.defaultUser }))) {
-                await this.adapter.setForeignObjectAsync(folderId, { type: 'channel', common: { name: segments[i - 1] }, native: {} }, { user: this.defaultUser });
+            if (!(await this.adapter.getForeignObjectAsync(folderId, { user: this.user }))) {
+                await this.adapter.setForeignObjectAsync(folderId, { type: 'channel', common: { name: segments[i - 1] }, native: {} }, { user: this.user });
             }
         }
         await this.adapter.setForeignObjectAsync(scriptId, {
@@ -3582,19 +3628,19 @@ class McpServer {
                 verbose: false,
             },
             native: {},
-        }, { user: this.defaultUser });
+        }, { user: this.user });
         return { id: scriptId, created: true };
     }
     /** Enable (start) or disable (stop) a script. */
     async enableScript(id, enabled) {
         const script = await this.getScriptObject(id);
-        await this.adapter.extendForeignObjectAsync(script.id, { common: { enabled } }, { user: this.defaultUser });
+        await this.adapter.extendForeignObjectAsync(script.id, { common: { enabled } }, { user: this.user });
         return { id: script.id, enabled };
     }
     /** Delete a script. */
     async deleteScript(id) {
         const script = await this.getScriptObject(id);
-        await this.adapter.delForeignObjectAsync(script.id, { user: this.defaultUser });
+        await this.adapter.delForeignObjectAsync(script.id, { user: this.user });
         return { id: script.id, deleted: true };
     }
     /**
@@ -3604,7 +3650,7 @@ class McpServer {
     async runScript(params) {
         const instance = await this.getInstance(params.instance || 'javascript.0');
         const timeout = params.timeout ?? 5000;
-        const result = await this.adapter.sendToAsync(instance.id, 'execute', { source: params.source, engineType: params.engineType, timeout, verbose: false, logLevel: 'info' }, { timeout: timeout + 15_000, user: this.defaultUser });
+        const result = await this.adapter.sendToAsync(instance.id, 'execute', { source: params.source, engineType: params.engineType, timeout, verbose: false, logLevel: 'info' }, { timeout: timeout + 15_000, user: this.user });
         if (!result || typeof result !== 'object') {
             throw new Error(`"${instance.id}" did not answer - javascript adapter 10.1.0 or newer is required`);
         }
@@ -3624,7 +3670,7 @@ class McpServer {
         if (!this.isSendToAllowed(instance.id)) {
             throw new Error(`"${instance.id}" is not in the allowlist of send_to`);
         }
-        const response = await this.adapter.sendToAsync(instance.id, params.command, (params.message ?? {}), { timeout: params.timeout ?? 10_000, user: this.defaultUser });
+        const response = await this.adapter.sendToAsync(instance.id, params.command, (params.message ?? {}), { timeout: params.timeout ?? 10_000, user: this.user });
         return { instance: instance.id, command: params.command, response: response ?? null };
     }
     /**
@@ -3636,16 +3682,16 @@ class McpServer {
         if (!/^alias\.\d+\.[^*\s]+$/.test(id)) {
             throw new Error(`Invalid alias id "${params.id}"`);
         }
-        if (await this.adapter.getForeignObjectAsync(id, { user: this.defaultUser })) {
+        if (await this.adapter.getForeignObjectAsync(id, { user: this.user })) {
             throw new Error(`Object "${id}" already exists`);
         }
-        const target = await this.adapter.getForeignObjectAsync(params.target, { user: this.defaultUser });
+        const target = await this.adapter.getForeignObjectAsync(params.target, { user: this.user });
         if (target?.type !== 'state') {
             throw new Error(`Target "${params.target}" is not a state`);
         }
         if (params.write_target) {
             const writeTarget = await this.adapter.getForeignObjectAsync(params.write_target, {
-                user: this.defaultUser,
+                user: this.user,
             });
             if (writeTarget?.type !== 'state') {
                 throw new Error(`Write target "${params.write_target}" is not a state`);
@@ -3670,7 +3716,7 @@ class McpServer {
         if (params.unit !== undefined || source.unit !== undefined) {
             common.unit = params.unit ?? source.unit;
         }
-        await this.adapter.setForeignObjectAsync(id, { type: 'state', common, native: {} }, { user: this.defaultUser });
+        await this.adapter.setForeignObjectAsync(id, { type: 'state', common, native: {} }, { user: this.user });
         return { id, target: params.target, ...(params.write_target ? { write_target: params.write_target } : {}) };
     }
     /**
@@ -3700,6 +3746,7 @@ class McpServer {
             contentType,
             expires: Date.now() + TRANSFER_TTL,
             size: data !== undefined ? Buffer.byteLength(data) : undefined,
+            user: this.user,
         });
         return token;
     }
@@ -3824,10 +3871,13 @@ class McpServer {
             req.pipe(out);
         });
     }
-    /** Get a received upload by its id, failing if it is unknown, expired or still empty. */
+    /**
+     * Get a received upload by its id, failing if it is unknown, expired or still empty. An upload of
+     * another user is reported as unknown, so a leaked id gives neither access nor a hint that it exists.
+     */
     getUpload(uploadId) {
         const transfer = this.transfers.get(uploadId);
-        if (!transfer || transfer.kind !== 'upload' || transfer.expires < Date.now()) {
+        if (!transfer || transfer.kind !== 'upload' || transfer.expires < Date.now() || transfer.user !== this.user) {
             throw new Error(`Unknown or expired upload "${uploadId}" - create a new one with prepare_upload`);
         }
         if (transfer.size === undefined) {
@@ -3838,7 +3888,7 @@ class McpServer {
     // --- helpers ---
     /** Resolve the member ids of a room/function enum matched by id or (localized) name. */
     async getEnumMembers(prefix, nameOrId) {
-        const enums = await this.adapter.getForeignObjectsAsync(`${prefix}*`, 'enum', { user: this.defaultUser });
+        const enums = await this.adapter.getForeignObjectsAsync(`${prefix}*`, 'enum', { user: this.user });
         const needle = nameOrId.toLowerCase();
         for (const [id, obj] of Object.entries(enums || {})) {
             if (id.toLowerCase() === needle || this.getName(obj?.common?.name).toLowerCase() === needle) {