@ni-c/mcp-hub 0.11.1 → 0.11.2

package/dist/upstream/auth.js

@@ -1,6 +1,8 @@
 import { discoverOAuthServerInfo, exchangeAuthorization, refreshAuthorization, startAuthorization } from '@modelcontextprotocol/client';
+import dns from 'node:dns/promises';
+import net from 'node:net';
 import { isPrivateAddress, resolvePublicAddress } from '../auth/address.js';
-import { guardedRequest } from '../auth/pinned-fetch.js';
+import { boundedResponse, guardedRequest } from '../auth/pinned-fetch.js';
 import { logSafe } from '../auth/text.js';
 import { UpstreamAuthProvider, callbackUrl, credentialFingerprint, hubClientMetadata } from './provider.js';
 /**
@@ -81,12 +83,13 @@ export class UpstreamAuth {
     async privateAllowed() {
         if (this.allowPrivate === undefined) {
             const hostname = new URL(this.identity.serverUrl).hostname.replace(/^\[|\]$/g, '');
-            try {
-                this.allowPrivate = isPrivateAddress(hostname) || (await resolvePublicAddress(hostname).then(() => false, () => true));
-            }
-            catch {
-                this.allowPrivate = true;
-            }
+            // isPrivateAddress accepts numeric addresses only and rejects everything
+            // else. Passing a DNS name to it used to enable private access for every
+            // named upstream. Failed or mixed DNS answers must not relax the policy.
+            const addresses = net.isIP(hostname) ? [{ address: hostname }] : await dns.lookup(hostname, { all: true });
+            if (addresses.length === 0)
+                throw new Error('upstream hostname resolved to no addresses');
+            this.allowPrivate = addresses.every(entry => isPrivateAddress(entry.address));
         }
         return this.allowPrivate;
     }
@@ -95,9 +98,13 @@ export class UpstreamAuth {
     async asFetch(input, init) {
         const url = new URL(input instanceof Request ? input.url : String(input));
         const allowPrivate = await this.privateAllowed();
+        if (url.username || url.password || (url.protocol !== 'https:' && !(allowPrivate && url.protocol === 'http:'))) {
+            throw new Error('upstream OAuth endpoints must use HTTPS (HTTP is allowed only for private upstreams) without URL credentials');
+        }
         const pinned = await resolvePublicAddress(url.hostname, allowPrivate);
         if (!pinned) {
-            return fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(AS_TIMEOUT_MS) });
+            const response = await fetch(url, { ...init, redirect: 'error', signal: AbortSignal.timeout(AS_TIMEOUT_MS) });
+            return boundedResponse(response, AS_MAX_BYTES);
         }
         return guardedRequest(url, {
             pinnedAddress: pinned,

package/dist/upstream/provider.js

@@ -33,7 +33,7 @@ export function credentialFingerprint(identity) {
     const { oauth } = identity;
     return crypto
         .createHash('sha256')
-        .update(JSON.stringify([identity.serverUrl, oauth.mode, oauth.grant, oauth.clientId ?? null, [...oauth.scopes].sort()]))
+        .update(JSON.stringify([identity.serverUrl, oauth.mode, oauth.grant, oauth.clientId ?? null, oauth.scopes.toSorted()]))
         .digest('hex');
 }
 export function callbackUrl(externalUrl) {

package/dist/upstream/routes.js

@@ -2,6 +2,7 @@ import { Router } from 'express';
 import { readSignedPayload } from '../auth/signed-token.js';
 import { renderPage, escapeHtml } from '../auth/page.js';
 import { logSafe } from '../auth/text.js';
+import { earlyRateLimit } from '../auth/rate-limit.js';
 import { readSessionCookie } from '../auth/session.js';
 import { UPSTREAM_CALLBACK_PATH, UPSTREAM_CLIENT_METADATA_PREFIX, UpstreamAuthProvider, clientDocumentId, clientMetadataUrl, hubClientMetadata } from './provider.js';
 const page = (res, status, title, body) => {
@@ -10,6 +11,7 @@ const page = (res, status, title, body) => {
 export function createUpstreamRoutes(options) {
     const { store, registry, supervisor, watcher, externalUrl } = options;
     const router = Router();
+    const secure = new URL(externalUrl).protocol === 'https:';
     /**
      * One document per upstream, addressed by a derived identifier.
      *
@@ -17,28 +19,29 @@ export function createUpstreamRoutes(options) {
      * hot-reloadable, so a server can become `cimd` long after boot, and an
      * Express route cannot be added later.
      */
-    router.get(`/${UPSTREAM_CLIENT_METADATA_PREFIX}/:id.json`, (req, res) => {
-        void (async () => {
-            const wanted = String(req.params.id);
-            for (const [name, server] of watcher.current) {
-                if (server.kind !== 'remote' || server.oauth?.mode !== 'cimd')
-                    continue;
-                if (clientDocumentId(name, store.cookieSecret) !== wanted)
-                    continue;
-                const identity = { serverName: name, serverUrl: server.url, oauth: server.oauth, externalUrl };
-                const provider = new UpstreamAuthProvider(identity, store);
-                // The document must name itself byte-for-byte or the upstream refuses it.
-                res.json({
-                    client_id: clientMetadataUrl(externalUrl, name, store.cookieSecret),
-                    ...hubClientMetadata(identity, server.oauth.clientAuth === 'private_key_jwt' ? await provider.publicJwk() : undefined)
-                });
-                return;
-            }
-            res.status(404).json({ error: 'not_found', error_description: 'No upstream publishes a document here' });
-        })();
+    // Unauthenticated, and each hit derives one HMAC per configured upstream and
+    // may export a public key: cheap, but not free, and nothing legitimate asks
+    // for it more than once per login.
+    router.get(`/${UPSTREAM_CLIENT_METADATA_PREFIX}/:id.json`, earlyRateLimit(15 * 60_000, 60, 600), async (req, res) => {
+        const wanted = String(req.params.id);
+        for (const [name, server] of watcher.current) {
+            if (server.kind !== 'remote' || server.oauth?.mode !== 'cimd')
+                continue;
+            if (clientDocumentId(name, store.cookieSecret) !== wanted)
+                continue;
+            const identity = { serverName: name, serverUrl: server.url, oauth: server.oauth, externalUrl };
+            const provider = new UpstreamAuthProvider(identity, store);
+            // The document must name itself byte-for-byte or the upstream refuses it.
+            res.json({
+                client_id: clientMetadataUrl(externalUrl, name, store.cookieSecret),
+                ...hubClientMetadata(identity, server.oauth.clientAuth === 'private_key_jwt' ? await provider.publicJwk() : undefined)
+            });
+            return;
+        }
+        res.status(404).json({ error: 'not_found', error_description: 'No upstream publishes a document here' });
     });
     router.get(`/${UPSTREAM_CALLBACK_PATH}`, (req, res) => {
-        void handleCallback(req.query, req.headers.cookie, res);
+        return handleCallback(req.query, req.headers.cookie, res);
     });
     async function handleCallback(query, cookie, res) {
         const state = typeof query.state === 'string' ? query.state : '';
@@ -51,7 +54,7 @@ export function createUpstreamRoutes(options) {
         // Proving the browser belongs to the operator, not just to whoever ended up
         // holding the redirect. The session cookie rides along because the upstream
         // sends a top-level navigation and the cookie is SameSite=Lax.
-        if (readSessionCookie(cookie, store.cookieSecret) === undefined) {
+        if (readSessionCookie(cookie, store.cookieSecret, secure) === undefined) {
             page(res, 401, 'Not signed in', 'Sign in to this hub in the same browser, then run the login again.');
             return;
         }
@@ -64,7 +67,9 @@ export function createUpstreamRoutes(options) {
         }
         if (typeof query.error === 'string') {
             console.warn(`mcp-hub: upstream login for ${logSafe(login.serverName)} was declined: ${logSafe(query.error)}`);
-            page(res, 400, 'Authorization declined', `The upstream reported "${query.error}". Nothing was changed.`);
+            // An OAuth error code is a short token; anything else is a page written
+            // by whoever answered as the upstream, and it does not get to write ours.
+            page(res, 400, 'Authorization declined', `The upstream reported "${logSafe(query.error, 80)}". Nothing was changed.`);
             return;
         }
         const code = typeof query.code === 'string' ? query.code : '';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ni-c/mcp-hub",
-  "version": "0.11.1",
+  "version": "0.11.2",
   "description": "Serve multiple stdio MCP servers from one container: Claude-Code-style mcpServers config, path-based routing, hub meta-tools, and CIMD-first OAuth 2.1 + API tokens for ChatGPT, Claude and any Streamable-HTTP MCP client.",
   "keywords": [
     "mcp",
@@ -52,6 +52,7 @@
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:e2e:watch": "vitest --config vitest.e2e.config.ts",
     "typecheck:e2e": "tsc -p tsconfig.e2e.json",
+    "typecheck:test": "tsc -p tsconfig.test.json",
     "e2e:record": "tsx e2e/tools/record.ts",
     "e2e:curate": "tsx e2e/tools/curate.ts",
     "prepublishOnly": "npm test && npm run build",
@@ -77,13 +78,14 @@
     "@types/node": "^26.2.0",
     "@types/oidc-provider": "^9.11.1",
     "@types/supertest": "^7.2.1",
-    "@vitest/coverage-v8": "4.1.11",
+    "@vitest/coverage-v8": "5.0.0",
+    "fast-check": "^4.9.0",
     "oxlint": "^1.80.0",
     "supertest": "^7.0.0",
     "svg-asset-set": "https://github.com/ni-c/svg-asset-set/releases/download/v0.1.0/svg-asset-set-0.1.0.tgz",
     "tsx": "^4.19.0",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.10"
+    "vitest": "^5.0.0"
   },
   "mcpName": "io.github.ni-c/mcp-hub"
 }