@mgsoftwarebv/mg-dashboard-mcp 3.3.0 → 3.4.1

package/dist/index.js

@@ -9,7 +9,7 @@ import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
 import { createServer } from 'http';
-import { randomUUID, randomBytes, createHash, createCipheriv, createDecipheriv } from 'crypto';
+import { randomUUID, createHash, randomBytes, createCipheriv, createDecipheriv } from 'crypto';
 import { createClient } from '@supabase/supabase-js';
 import { readFile, mkdtemp, writeFile, rm } from 'fs/promises';
 import { tmpdir } from 'os';
@@ -83,7 +83,7 @@ function deriveAuthBaseUrl(proxyUrl2) {
   const u = new URL(proxyUrl2);
   return `${u.protocol}//${u.host}`;
 }
-async function performHandshake(proxyUrl2, pubPath, pubText) {
+async function performHandshake(proxyUrl2, apiKey2, pubPath, pubText) {
   const base = deriveAuthBaseUrl(proxyUrl2);
   const challengeRes = await fetch(`${base}/v1/auth/ssh/challenge`, {
     method: "POST",
@@ -110,6 +110,7 @@ async function performHandshake(proxyUrl2, pubPath, pubText) {
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
       challenge_id: challenge.challenge_id,
+      api_key: apiKey2,
       pubkey: pubText,
       signature: sign.stdout
     })
@@ -127,10 +128,11 @@ async function performHandshake(proxyUrl2, pubPath, pubText) {
 }
 async function runBridge(handshake, proxyUrl2, refresh) {
   let currentToken = handshake.token;
+  const requestHeaders = {
+    Authorization: `Bearer ${currentToken}`
+  };
   const upstreamTransport = new StreamableHTTPClientTransport(new URL(proxyUrl2), {
-    requestInit: () => ({
-      headers: { Authorization: `Bearer ${currentToken}` }
-    })
+    requestInit: { headers: requestHeaders }
   });
   const upstream = new Client$1({ name: "mg-dashboard-mcp-proxy-bridge", version: "1.0.0" });
   const scheduleRefresh = (result) => {
@@ -139,6 +141,7 @@ async function runBridge(handshake, proxyUrl2, refresh) {
       try {
         const fresh = await refresh();
         currentToken = fresh.token;
+        requestHeaders.Authorization = `Bearer ${currentToken}`;
         console.error(`[Proxy] Token refreshed (key: ${fresh.proxyKeyName})`);
         scheduleRefresh(fresh);
       } catch (err) {
@@ -172,11 +175,16 @@ async function runBridge(handshake, proxyUrl2, refresh) {
 }
 async function runProxyMode(args2) {
   const proxyUrl2 = getArg(args2, "proxy-url") || process.env.MG_DASHBOARD_PROXY_URL;
+  const apiKey2 = getArg(args2, "api-key") || process.env.MG_DASHBOARD_API_KEY;
   const sshKey = getArg(args2, "ssh-key") || process.env.MG_DASHBOARD_SSH_KEY;
   if (!proxyUrl2) {
     console.error("--proxy-url is required (or set MG_DASHBOARD_PROXY_URL)");
     process.exit(1);
   }
+  if (!apiKey2) {
+    console.error("--api-key is required in proxy mode (or set MG_DASHBOARD_API_KEY)");
+    process.exit(1);
+  }
   if (!sshKey) {
     console.error("--ssh-key is required in proxy mode (or set MG_DASHBOARD_SSH_KEY)");
     process.exit(1);
@@ -189,7 +197,7 @@ async function runProxyMode(args2) {
     console.error(`[Proxy] ${err instanceof Error ? err.message : String(err)}`);
     process.exit(1);
   }
-  const refresh = () => performHandshake(proxyUrl2, resolved.pubPath, resolved.pubText);
+  const refresh = () => performHandshake(proxyUrl2, apiKey2, resolved.pubPath, resolved.pubText);
   let handshake;
   try {
     handshake = await refresh();
@@ -1173,8 +1181,8 @@ var encryptionKey = getArg2("encryption-key") || process.env.ENCRYPTION_KEY;
 var mijnhostApiKey = getArg2("mijnhost-api-key") || process.env.MIJNHOST_API_KEY;
 var httpMode = args.includes("--http");
 var httpPort = Number(getArg2("port")) || 3100;
-if (!apiKey && !sshKeyPath) {
-  console.error("Authentication required. Use --api-key=dk_xxx, --ssh-key=PATH (path to your SSH private or public key), or set MG_DASHBOARD_API_KEY / MG_DASHBOARD_SSH_KEY.");
+if (!apiKey || !sshKeyPath) {
+  console.error("Authentication required. Use both --api-key=dk_xxx and --ssh-key=PATH (path to your SSH private or public key), or set MG_DASHBOARD_API_KEY and MG_DASHBOARD_SSH_KEY.");
   process.exit(1);
 }
 if (!supabaseUrl || !supabaseKey) {
@@ -1466,7 +1474,7 @@ async function sshKeygenVerify(pubkeyLine, signature, challenge, namespace) {
     await rm(dir, { recursive: true, force: true }).catch(() => void 0);
   }
 }
-async function validateSshKey(pubkeyPathInput) {
+async function validateSshKey(pubkeyPathInput, expectedApiKeyId) {
   let pubPath;
   let pubText;
   try {
@@ -1513,6 +1521,12 @@ async function validateSshKey(pubkeyPathInput) {
     );
     return null;
   }
+  if (keyRow.api_key_id !== expectedApiKeyId) {
+    console.error(
+      `SSH key "${keyRow.name}" is registered, but it is not linked to the provided MCP API key. Add this SSH key under the same MCP API Key entry used by --api-key.`
+    );
+    return null;
+  }
   const { data: apiRow, error: apiErr } = await supabase.from("dashboard_mcp_api_key").select("id, name, created_by, allowed_server_ids, is_active, expires_at").eq("id", keyRow.api_key_id).eq("is_active", true).maybeSingle();
   if (apiErr || !apiRow) {
     console.error("SSH key is linked to an inactive or missing MCP API key entry.");
@@ -3177,18 +3191,15 @@ function createMcpServer() {
 var server = createMcpServer();
 async function main() {
   console.error("Starting MG Dashboard MCP Server...");
-  if (sshKeyPath) {
-    authContext = await validateSshKey(sshKeyPath);
-    if (!authContext) {
-      console.error("SSH-key authentication failed");
-      process.exit(1);
-    }
-  } else {
-    authContext = await validateApiKey(apiKey);
-    if (!authContext) {
-      console.error("API key validation failed");
-      process.exit(1);
-    }
+  const apiAuthContext = await validateApiKey(apiKey);
+  if (!apiAuthContext) {
+    console.error("API key validation failed");
+    process.exit(1);
+  }
+  authContext = await validateSshKey(sshKeyPath, apiAuthContext.apiKeyId);
+  if (!authContext) {
+    console.error("SSH-key authentication failed");
+    process.exit(1);
   }
   console.error(`[Security] MCP v${MCP_VERSION} | Key: ${authContext.apiKeyName}`);
   const toolNames = TOOLS.map((t) => t.name).join(", ");