@lifeaitools/clauth 1.5.25 → 1.5.26

package/cli/commands/serve.js

@@ -3103,44 +3103,11 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     }
 
     // ── MCP endpoint auth ──
-    // Tunnel requests (Host = tunnel hostname) MUST have Bearer token → 401 triggers OAuth.
-    // Local requests (Host = 127.0.0.1) pass through without auth.
+    // No 401 gate — tunnel URL is the shared secret. Accept all connections.
+    // If Bearer token present, mark as remote for vault scoping.
     if (method === "POST" && (reqPath === "/sse" || isMcpPath)) {
       const authHeader = req.headers.authorization;
-      const host = (req.headers.host || "").split(":")[0];
-      const isTunnelReq = tunnelUrl && host !== "127.0.0.1" && host !== "localhost" && host !== "::1";
-      const authLogMsg = [
-        `[${new Date().toISOString()}] MCP POST ${reqPath}`,
-        `  Host: ${req.headers.host || "(none)"} (tunnel=${isTunnelReq})`,
-        `  Authorization: ${authHeader ? (authHeader.startsWith("Bearer ") ? `Bearer ${authHeader.slice(7, 15)}… (known=${oauthTokens.has(authHeader.slice(7))})` : authHeader.slice(0, 30) + "…") : "(none)"}`,
-        `  mcp-protocol-version: ${req.headers["mcp-protocol-version"] || "(not set)"}`,
-        `  accept: ${req.headers["accept"] || "(not set)"}`,
-      ].join("\n") + "\n";
-      try { fs.appendFileSync(LOG_FILE, authLogMsg); } catch {}
-
-      if (isTunnelReq) {
-        if (!authHeader || !authHeader.startsWith("Bearer ")) {
-          const base = oauthBase();
-          const logMsg = `[${new Date().toISOString()}] OAuth: 401 → requiring auth for tunnel POST ${reqPath}\n`;
-          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
-          res.writeHead(401, {
-            "Content-Type": "application/json",
-            "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`,
-            ...CORS,
-          });
-          return res.end(JSON.stringify({ error: "unauthorized" }));
-        }
-        const token = authHeader.slice(7);
-        // Accept: OAuth-issued tokens OR the stable client_secret directly
-        const isValidToken = oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET;
-        if (!isValidToken) {
-          const logMsg = `[${new Date().toISOString()}] OAuth: REJECTED token ${token.slice(0,8)}… (pool=${oauthTokens.size}, secret=${token === OAUTH_CLIENT_SECRET})\n`;
-          try { fs.appendFileSync(LOG_FILE, logMsg); } catch {}
-          res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ error: "invalid_token" }));
-        }
-        req._clauthRemote = true;
-      } else if (authHeader?.startsWith("Bearer ")) {
+      if (authHeader?.startsWith("Bearer ")) {
         const token = authHeader.slice(7);
         if (oauthTokens.has(token) || token === OAUTH_CLIENT_SECRET) {
           req._clauthRemote = true;
@@ -3207,28 +3174,7 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
 
     // ── MCP SSE transport — /sse and namespaced paths ────
     // GET /sse|/gws|/clauth — open SSE stream, receive endpoint event
-    // Tunnel requests require Bearer token (same as POST above)
     if (method === "GET" && (reqPath === "/sse" || isMcpPath)) {
-      const authHeader = req.headers.authorization;
-      const host = (req.headers.host || "").split(":")[0];
-      const isTunnelReq = tunnelUrl && host !== "127.0.0.1" && host !== "localhost" && host !== "::1";
-      if (isTunnelReq) {
-        if (!authHeader || !authHeader.startsWith("Bearer ")) {
-          const base = oauthBase();
-          res.writeHead(401, {
-            "Content-Type": "application/json",
-            "WWW-Authenticate": `Bearer resource_metadata="${base}/.well-known/oauth-protected-resource"`,
-            ...CORS,
-          });
-          return res.end(JSON.stringify({ error: "unauthorized" }));
-        }
-        const sseToken = authHeader.slice(7);
-        if (!oauthTokens.has(sseToken) && sseToken !== OAUTH_CLIENT_SECRET) {
-          res.writeHead(401, { "Content-Type": "application/json", ...CORS });
-          return res.end(JSON.stringify({ error: "invalid_token" }));
-        }
-        // Token valid — mark as remote
-      }
       const sessionId = `ses_${++sseCounter}_${Date.now()}`;
 
       res.writeHead(200, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.5.25",
+  "version": "1.5.26",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {