@ni-c/mcp-hub 0.10.0 → 0.11.1

package/dist/auth/store.js

@@ -19,6 +19,13 @@ const ACTIVITY_GRANULARITY_S = 3600;
  * structure that only ever grows.
  */
 const REVOCATION_MARKER_TTL_MS = 31 * 24 * 3600_000;
+/**
+ * Every artifact expires and every write prunes, so this cap is not the primary
+ * bound — it is the backstop for the one case pruning cannot help with: tokens
+ * minted faster than they age out. Eviction is oldest-first, which for tokens
+ * costs a client one refresh rather than its session.
+ */
+const MAX_OIDC_ARTIFACTS_PER_MODEL = 5_000;
 /**
  * Registration is open (anyone can POST /register), so unconfirmed clients
  * would otherwise accumulate on disk without bound and every registration
@@ -106,7 +113,8 @@ export class AuthStore {
                 apiTokens: {},
                 clientLifecycle: {},
                 upstreamCredentials: {},
-                upstreamLogins: {}
+                upstreamLogins: {},
+                oidcArtifacts: {}
             };
             if (restored)
                 this.signature = this.fileSignature();
@@ -301,6 +309,7 @@ export class AuthStore {
             clientLifecycle: state.clientLifecycle ?? {},
             upstreamCredentials: state.upstreamCredentials ?? {},
             upstreamLogins: state.upstreamLogins ?? {},
+            oidcArtifacts: state.oidcArtifacts ?? {},
             ...(typeof state.externalUrl === 'string' ? { externalUrl: state.externalUrl } : {})
         };
     }
@@ -378,6 +387,21 @@ export class AuthStore {
             if (login.expiresAt < now)
                 delete this.state.upstreamLogins[state];
         }
+        for (const [model, records] of Object.entries(this.state.oidcArtifacts)) {
+            for (const [id, record] of Object.entries(records)) {
+                if (record.expiresAt !== 0 && record.expiresAt < now)
+                    delete records[id];
+            }
+            const ids = Object.keys(records);
+            if (ids.length > MAX_OIDC_ARTIFACTS_PER_MODEL) {
+                const byAge = ids.sort((a, b) => (records[a].expiresAt || Infinity) - (records[b].expiresAt || Infinity));
+                for (const id of byAge.slice(0, ids.length - MAX_OIDC_ARTIFACTS_PER_MODEL))
+                    delete records[id];
+            }
+            // An empty model map is a row that never goes away.
+            if (Object.keys(records).length === 0)
+                delete this.state.oidcArtifacts[model];
+        }
     }
     // --- Upstream OAuth ------------------------------------------------------
     /** The issuer the hub is running under, recorded so the admin CLI can build a
@@ -601,6 +625,20 @@ export class AuthStore {
         }
     }
     /** Timing-safe check of an RFC 7592 registration access token. */
+    /**
+     * Attaches the hash of a registration access token to an existing client.
+     *
+     * The authorization server mints the token and only ever reveals it in the
+     * registration response, so the hash has to be recorded from there rather
+     * than at the moment the client record is written.
+     */
+    rememberRegistrationToken(clientId, token) {
+        this.mutate(() => {
+            const entry = this.state.clientLifecycle[clientId];
+            if (entry)
+                entry.registrationTokenHash = AuthStore.hash(token);
+        });
+    }
     verifyRegistrationToken(clientId, token) {
         this.reloadIfChanged();
         const expected = this.state.clientLifecycle[clientId]?.registrationTokenHash;
@@ -811,5 +849,126 @@ export class AuthStore {
             return true;
         });
     }
+    // --- oidc-provider artifacts ---------------------------------------------
+    //
+    // The backing store for the ten adapter models. Deliberately dumb: the
+    // library owns the payload shapes, so this layer only adds the two things it
+    // cannot do itself — the cross-process lock every other writer here obeys,
+    // and the revokedBefore cutoff below.
+    /**
+     * Artifacts are keyed by the HASH of their id, never by the id itself.
+     *
+     * With opaque access tokens the id IS the bearer token, and a refresh token
+     * or a registration access token is no different — storing them verbatim
+     * would turn read access to state.json into working credentials. The file was
+     * already sensitive (it holds the cookie secret), but it never used to hold
+     * anything an attacker could present as-is, and it should not start now.
+     *
+     * Lookups all go through here, and the two scans (`findByUid`,
+     * `revokeByGrantId`) match on payload fields rather than on the key, so
+     * nothing needs the plaintext back.
+     */
+    static artifactKey(id) {
+        return AuthStore.hash(id);
+    }
+    /**
+     * Models whose id is a bearer credential someone presents back.
+     *
+     * Hashing the key alone would not be enough: the payload carries `jti`, and
+     * for an opaque token the jti IS the token. These are stored without it and
+     * get it back from the lookup id on the way out, which `find` always has.
+     * The others (Session, Interaction, Grant) are referenced by ids that are not
+     * credentials, and their jti has to survive a `findByUid` that never sees one.
+     */
+    static CREDENTIAL_MODELS = new Set([
+        'AccessToken',
+        'RefreshToken',
+        'AuthorizationCode',
+        'RegistrationAccessToken',
+        'ClientCredentials',
+        'InitialAccessToken',
+        'DeviceCode',
+        'BackchannelAuthenticationRequest'
+    ]);
+    oidcUpsert(model, id, payload, expiresInSeconds) {
+        this.mutate(() => {
+            const records = (this.state.oidcArtifacts[model] ??= {});
+            const key = AuthStore.artifactKey(id);
+            const stored = AuthStore.CREDENTIAL_MODELS.has(model) ? { ...payload, jti: undefined } : payload;
+            if (AuthStore.CREDENTIAL_MODELS.has(model))
+                delete stored.jti;
+            records[key] = {
+                payload: stored,
+                expiresAt: expiresInSeconds ? Math.floor(Date.now() / 1000) + expiresInSeconds : 0,
+                ...(records[key]?.consumedAt !== undefined ? { consumedAt: records[key].consumedAt } : {})
+            };
+        });
+    }
+    /**
+     * Undefined for unknown, expired *and revoked* artifacts — the library treats
+     * every falsy return as "not found", so this one comparison is the whole of
+     * `mcp-hub-admin clients revoke`. It is why access tokens are opaque: a JWT
+     * is never stored, so it could not be reached here at all.
+     */
+    oidcFind(model, id) {
+        this.reloadIfChanged();
+        const record = this.state.oidcArtifacts[model]?.[AuthStore.artifactKey(id)];
+        if (!record)
+            return undefined;
+        if (record.expiresAt !== 0 && record.expiresAt < Math.floor(Date.now() / 1000))
+            return undefined;
+        const clientId = record.payload.clientId;
+        const issuedAt = record.payload.iat;
+        if (typeof clientId === 'string' && typeof issuedAt === 'number') {
+            const cutoff = this.state.revokedBefore[clientId];
+            if (cutoff !== undefined && issuedAt * 1000 < cutoff)
+                return undefined;
+        }
+        const payload = AuthStore.CREDENTIAL_MODELS.has(model) ? { ...record.payload, jti: id } : record.payload;
+        return record.consumedAt === undefined ? payload : { ...payload, consumed: record.consumedAt };
+    }
+    /** Sessions are looked up by `uid` as well as by id. */
+    oidcFindBy(model, field, value) {
+        this.reloadIfChanged();
+        for (const record of Object.values(this.state.oidcArtifacts[model] ?? {})) {
+            if (record.payload[field] !== value)
+                continue;
+            if (record.expiresAt !== 0 && record.expiresAt < Math.floor(Date.now() / 1000))
+                return undefined;
+            return record.payload;
+        }
+        return undefined;
+    }
+    oidcConsume(model, id) {
+        this.mutate(() => {
+            const record = this.state.oidcArtifacts[model]?.[AuthStore.artifactKey(id)];
+            if (record)
+                record.consumedAt = Math.floor(Date.now() / 1000);
+        });
+    }
+    oidcDestroy(model, id) {
+        this.mutate(() => {
+            delete this.state.oidcArtifacts[model]?.[AuthStore.artifactKey(id)];
+        });
+    }
+    /**
+     * Scanned rather than indexed. A second index would be a third thing to keep
+     * consistent across a crash between two writes, and these maps hold hundreds
+     * of rows, not millions.
+     */
+    oidcRevokeByGrantId(grantId) {
+        return this.mutate(() => {
+            let revoked = 0;
+            for (const records of Object.values(this.state.oidcArtifacts)) {
+                for (const [id, record] of Object.entries(records)) {
+                    if (record.payload.grantId === grantId) {
+                        delete records[id];
+                        revoked++;
+                    }
+                }
+            }
+            return revoked;
+        });
+    }
 }
 //# sourceMappingURL=store.js.map

package/dist/config.js

@@ -1,6 +1,7 @@
 import { EventEmitter } from 'node:events';
 import fs from 'node:fs';
 import path from 'node:path';
+import { CONFIG_POLL_INTERVAL_MS } from './timings.js';
 export const OAUTH_MODES = new Set(['static', 'dcr', 'cimd']);
 export const OAUTH_GRANTS = new Set(['authorization_code', 'client_credentials']);
 export const OAUTH_CLIENT_AUTH = new Set(['client_secret_basic', 'client_secret_post', 'private_key_jwt']);
@@ -17,6 +18,15 @@ const RESERVED_NAMES = new Set([
     'livez',
     'revoke',
     '.well-known',
+    // Served by the authorization server. `interaction` is where an
+    // unauthenticated authorization request is sent to log in, and `jwks` and
+    // `session` are endpoints oidc-provider registers whether or not the hub
+    // advertises them. A server of one of these names would shadow the auth flow
+    // rather than merely be unreachable.
+    'jwks',
+    'interaction',
+    'session',
+    'userinfo',
     // The upstream OAuth callback lives under /upstream/…; a server of that name
     // would be reachable at /upstream and is too close for comfort.
     'upstream'
@@ -204,6 +214,49 @@ function parseToolFilter(name, entry) {
     }
     return result;
 }
+/**
+ * Parses `passthrough`, which today governs one thing: whether this server may
+ * ask the person at the far end a question.
+ *
+ * A *partial* for the same reason `parseToolFilter` is one — an entry without
+ * the field has to produce exactly the object it produced before.
+ *
+ * `"off"` exists separately from the global `MCP_ELICITATION` switch because
+ * the two answer different questions. The global one is "is this hub doing
+ * elicitation at all"; this one is "do I trust *this* upstream to put words in
+ * front of my user". A server can be perfectly reliable and still be one whose
+ * prompts an operator does not want shown — that is a phishing judgement, not
+ * an availability one, and it should not require turning the server off.
+ */
+function parsePassthrough(name, entry) {
+    if (entry.passthrough === undefined)
+        return {};
+    if (entry.passthrough !== 'auto' && entry.passthrough !== 'off') {
+        throw new ConfigError(`Server "${name}": "passthrough" must be "auto" or "off"`);
+    }
+    return { passthrough: entry.passthrough };
+}
+/**
+ * Parses `subscriptions`, the sibling of `passthrough`: whether this server may
+ * push change notifications to the clients that ask for them.
+ *
+ * A *partial* for the same reason the two above are — an entry without the
+ * field has to produce exactly the object it produced before.
+ *
+ * Separate from `passthrough` because the two are different judgements about
+ * different traffic. `passthrough` is about words shown to a person, and the
+ * risk is phishing. This one is about volume and timing on a stream nobody is
+ * reading synchronously, and the risk is noise. A server can easily warrant one
+ * answer and not the other.
+ */
+function parseSubscriptions(name, entry) {
+    if (entry.subscriptions === undefined)
+        return {};
+    if (entry.subscriptions !== 'auto' && entry.subscriptions !== 'off') {
+        throw new ConfigError(`Server "${name}": "subscriptions" must be "auto" or "off"`);
+    }
+    return { subscriptions: entry.subscriptions };
+}
 function rejectLifecycle(name, entry, kind) {
     for (const field of ['keepAlive', 'idleMinutes']) {
         if (entry[field] !== undefined) {
@@ -331,7 +384,7 @@ function parseSocketServer(name, entry, type, expand, hub) {
 function parseServer(name, entry, env, options) {
     const expand = expanderFor(env, options);
     const hub = entry.hub !== false;
-    const toolFilter = parseToolFilter(name, entry);
+    const toolFilter = { ...parseToolFilter(name, entry), ...parsePassthrough(name, entry), ...parseSubscriptions(name, entry) };
     if (entry.hub !== undefined && typeof entry.hub !== 'boolean') {
         throw new ConfigError(`Server "${name}": "hub" must be a boolean`);
     }
@@ -458,7 +511,7 @@ export class ConfigWatcher extends EventEmitter {
     validate;
     watcher;
     debounce;
-    constructor(filePath, current, env = process.env, pollIntervalMs = 3_000, parseOptions, validate) {
+    constructor(filePath, current, env = process.env, pollIntervalMs = CONFIG_POLL_INTERVAL_MS, parseOptions, validate) {
         super();
         this.filePath = filePath;
         this.current = current;

package/dist/docker-proxy/policy.js

@@ -2,6 +2,7 @@ import { buildCreateRequest, containerName, serverNameFromContainer, OWNER_LABEL
 import { splitImageRef } from '../sandbox/docker-client.js';
 const API_PREFIX = /^\/v\d+\.\d+(?=\/)/;
 /** Control characters would let a caller forge lines in a log fail2ban reads. */
+// eslint-disable-next-line no-control-regex -- matching them is the point
 const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
 const SANDBOX_ID = /^mcp-sandbox-[a-zA-Z0-9_-]+$/;
 const MAX_ENV_ENTRIES = 200;

package/dist/docker-proxy/server.js

@@ -152,6 +152,7 @@ export function createDockerProxy(options) {
         // The URL is caller-controlled and this log is read by fail2ban: a
         // percent-encoded newline in a container name would otherwise let the
         // caller write its own log lines.
+        // eslint-disable-next-line no-control-regex -- matching them is the point
         const safeUrl = url.replace(/[\u0000-\u001f\u007f]/g, '?').slice(0, 500);
         if (!decision.allow)
             console.warn(`docker-proxy: DENY ${method} ${safeUrl}: ${decision.reason}`);