@njinlabs/njin 0.10.3 → 0.11.0

package/src/modules/mcp_token.ts

@@ -0,0 +1,295 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import bearer from "@elysia/bearer";
+import Elysia, { status } from "elysia";
+import moment from "moment";
+import { RecordId, Table } from "surrealdb";
+import z from "zod";
+import { makeModule } from "../core/module";
+import { publicBase } from "../core/public_url";
+import auth from "./auth";
+import elysia from "./elysia";
+import surreal from "./surreal";
+
+const table = new Table("mcp_token");
+
+// Bearer prefixes, not just cosmetic — a session token ("token:<id>:<plain>") fed to an
+// MCP-only route (or the reverse) fails the prefix check before any DB lookup happens, and an
+// access token can't be replayed as a refresh token (or vice versa).
+const ACCESS_PREFIX = "mcp";
+const REFRESH_PREFIX = "mcpr";
+
+const ACCESS_TTL_SECONDS = 60 * 60;
+const REFRESH_TTL_DAYS = 30;
+
+// One record per agent connection. "manual" tokens are minted by an admin through
+// POST /api/mcp-token (no expiry); "oauth" ones are issued by the OAuth flow in oauth.ts to a
+// specific user + client, expire quickly, and renew through a rotating refresh token that
+// lives on the same record — so listing/revoking connections is one table for both kinds.
+type McpToken = {
+  id: RecordId;
+  name: string;
+  hash: string;
+  createdAt: string;
+  createdBy: RecordId;
+  kind?: "manual" | "oauth";
+  expiresAt?: string;
+  refreshHash?: string;
+  refreshExpiresAt?: string;
+  clientId?: string;
+};
+
+const newSecret = () => randomBytes(32).toString("base64url");
+
+const hashSecret = (plain: string) =>
+  new Bun.CryptoHasher("sha256").update(plain).digest("hex");
+
+const safeEqual = (a: string, b: string) => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+
+  return left.length === right.length && timingSafeEqual(left, right);
+};
+
+const parseBearer = (value: string | undefined, prefix: string) => {
+  if (!value) return null;
+
+  const [head, id, secret, ...rest] = value.split(":");
+  if (head !== prefix || !id || !secret || rest.length > 0) return null;
+
+  return { id, secret };
+};
+
+const isPast = (iso: string | undefined) =>
+  iso !== undefined && moment().isAfter(iso);
+
+// Never leaks `hash`/`refreshHash` — they are the only thing standing between a DB read and a
+// usable token.
+const toPublic = ({
+  id,
+  name,
+  createdAt,
+  createdBy,
+  kind,
+  expiresAt,
+  clientId,
+}: McpToken) => ({
+  id: id.id.toString(),
+  name,
+  kind: kind ?? "manual",
+  createdAt,
+  createdBy: createdBy?.id?.toString() ?? null,
+  expiresAt: expiresAt ?? null,
+  clientId: clientId ?? null,
+});
+
+const verifyToken = async (bearerValue: string | undefined) => {
+  const parsed = parseBearer(bearerValue, ACCESS_PREFIX);
+  if (!parsed) return null;
+
+  const token = await surreal().select<McpToken>(
+    new RecordId(table, parsed.id),
+  );
+  if (!token) return null;
+
+  if (!safeEqual(token.hash, hashSecret(parsed.secret))) return null;
+  if (isPast(token.expiresAt)) return null;
+
+  return token;
+};
+
+const tokenResponse = (id: string, access: string, refresh: string) => ({
+  access_token: `${ACCESS_PREFIX}:${id}:${access}`,
+  token_type: "Bearer" as const,
+  expires_in: ACCESS_TTL_SECONDS,
+  refresh_token: `${REFRESH_PREFIX}:${id}:${refresh}`,
+});
+
+const accessExpiry = () =>
+  moment().add(ACCESS_TTL_SECONDS, "seconds").toISOString();
+const refreshExpiry = () =>
+  moment().add(REFRESH_TTL_DAYS, "days").toISOString();
+
+// Called by oauth.ts once an authorization code has been redeemed.
+export const issueOAuthTokens = async (input: {
+  name: string;
+  clientId: string;
+  userId: RecordId;
+}) => {
+  const access = newSecret();
+  const refresh = newSecret();
+
+  const [created] = await surreal()
+    .create<McpToken>(table)
+    .content({
+      name: input.name,
+      kind: "oauth",
+      clientId: input.clientId,
+      createdBy: input.userId as unknown as McpToken["createdBy"],
+      createdAt: moment().toISOString(),
+      hash: hashSecret(access),
+      expiresAt: accessExpiry(),
+      refreshHash: hashSecret(refresh),
+      refreshExpiresAt: refreshExpiry(),
+    });
+
+  return tokenResponse(created!.id.id.toString(), access, refresh);
+};
+
+// Refresh-token rotation: the presented token is replaced in place, so it can never be used
+// twice. Returns null for any reason the grant is unusable (unknown, wrong client, expired,
+// already rotated) — the caller reports all of them as OAuth `invalid_grant`.
+export const rotateOAuthTokens = async (
+  refreshBearer: string,
+  clientId: string,
+) => {
+  const parsed = parseBearer(refreshBearer, REFRESH_PREFIX);
+  if (!parsed) return null;
+
+  const id = new RecordId(table, parsed.id);
+  const token = await surreal().select<McpToken>(id);
+
+  if (
+    token?.kind !== "oauth" ||
+    token.clientId !== clientId ||
+    !token.refreshHash ||
+    !safeEqual(token.refreshHash, hashSecret(parsed.secret)) ||
+    isPast(token.refreshExpiresAt)
+  ) {
+    return null;
+  }
+
+  const access = newSecret();
+  const refresh = newSecret();
+
+  await surreal()
+    .update<McpToken>(id)
+    .merge({
+      hash: hashSecret(access),
+      expiresAt: accessExpiry(),
+      refreshHash: hashSecret(refresh),
+      refreshExpiresAt: refreshExpiry(),
+    });
+
+  return tokenResponse(parsed.id, access, refresh);
+};
+
+// RFC 7009 — accepts either token type; deleting the record kills both halves at once.
+export const revokeOAuthToken = async (bearerValue: string) => {
+  for (const prefix of [ACCESS_PREFIX, REFRESH_PREFIX]) {
+    const parsed = parseBearer(bearerValue, prefix);
+    if (!parsed) continue;
+
+    const id = new RecordId(table, parsed.id);
+    const token = await surreal().select<McpToken>(id);
+    if (!token) return;
+
+    const expected = prefix === ACCESS_PREFIX ? token.hash : token.refreshHash;
+    if (expected && safeEqual(expected, hashSecret(parsed.secret))) {
+      await surreal().delete(id);
+    }
+    return;
+  }
+};
+
+// Dedicated credential for AI agents (MCP) — deliberately a separate table and bearer
+// format from the admin session token in auth.ts, so an MCP token can never satisfy the
+// `auth: true` macro (and with it the whole /api/* admin surface), and a leaked MCP token
+// is revoked by deleting one record without touching anybody's login session.
+const mcpToken = makeModule(() => {
+  const fn = async () => {
+    const plugin = new Elysia({ name: "mcp-auth" }).use(bearer()).macro({
+      mcpAuth: {
+        resolve: async ({ bearer, request, set }) => {
+          const token = await verifyToken(bearer);
+
+          if (!token) {
+            // RFC 9728 — this header is how an MCP client discovers the OAuth flow; without
+            // it (and a real 401 status) Claude never starts sign-in.
+            set.headers["www-authenticate"] =
+              `Bearer resource_metadata="${publicBase(request)}/.well-known/oauth-protected-resource"`;
+
+            return status(401, { message: "Unauthorized" });
+          }
+
+          return { mcpToken: toPublic(token) };
+        },
+      },
+    });
+
+    return { plugin };
+  };
+
+  fn.init = async () => {
+    const authPlugin = (await auth()).plugin;
+
+    // Managed with a regular admin session (`auth: true`), never with an MCP token itself —
+    // otherwise a leaked agent token could mint itself a replacement after being revoked.
+    const controller = new Elysia({ prefix: "/api/mcp-token" })
+      .use(authPlugin)
+      .get(
+        "/",
+        async () => {
+          const tokens = await surreal().select<McpToken>(table);
+
+          return {
+            data: tokens
+              .sort((a, b) => b.createdAt.localeCompare(a.createdAt))
+              .map(toPublic),
+          };
+        },
+        { auth: true },
+      )
+      .post(
+        "/",
+        async ({ body, user }) => {
+          const plain = newSecret();
+
+          const [created] = await surreal()
+            .create<McpToken>(table)
+            .content({
+              name: body.name,
+              kind: "manual",
+              hash: hashSecret(plain),
+              createdAt: moment().toISOString(),
+              createdBy: user.id as unknown as McpToken["createdBy"],
+            });
+
+          return {
+            data: {
+              ...toPublic(created!),
+              // Returned exactly once — only the hash is stored, so it can't be shown again.
+              token: `${ACCESS_PREFIX}:${created!.id.id}:${plain}`,
+            },
+          };
+        },
+        {
+          auth: true,
+          body: z.object({ name: z.string().trim().min(1).max(100) }),
+        },
+      )
+      .delete(
+        "/:id",
+        async ({ params }) => {
+          const id = new RecordId(table, params.id);
+          const existing = await surreal().select<McpToken>(id);
+
+          if (!existing) {
+            return status(404, { message: "Token not found" });
+          }
+
+          await surreal().delete(id);
+
+          return { data: toPublic(existing) };
+        },
+        { auth: true, params: z.object({ id: z.coerce.string() }) },
+      );
+
+    elysia().use(controller);
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default mcpToken;

package/src/modules/mcp_upload.ts

@@ -0,0 +1,313 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import Elysia from "elysia";
+import moment from "moment";
+import { RecordId, Table } from "surrealdb";
+import { escapeHtml, noStore, page } from "../core/html_page";
+import { makeModule } from "../core/module";
+import elysia from "./elysia";
+import fileModule from "./file";
+import surreal from "./surreal";
+
+// How an agent gets a file *into* the site. MCP is JSON-RPC, and a file the user dropped into
+// the chat can't be passed through a tool argument (base64 floods the context and models mangle
+// it), so the tool only hands out a short-lived upload URL: the agent `curl`s the file to it from
+// its sandbox, or — when it has no shell/network — gives the URL to the user to open and drop
+// the file on. The bytes never pass through the model either way.
+
+const table = new Table("mcp_upload");
+
+export const UPLOAD_TTL_MINUTES = 10;
+export const MAX_FILES_PER_TICKET = 10;
+export const MAX_FILE_BYTES = 10 * 1024 * 1024;
+
+// Allowlist, not a denylist: /uploads/* is served from the site's own origin by file extension,
+// so an uploaded .html/.svg/.js would run with the same origin as the admin panel. The declared
+// MIME type is ignored (the client picks it) and replaced with the one mapped here — object
+// stores that serve by stored Content-Type would otherwise be told whatever the uploader said.
+export const ALLOWED_TYPES: Record<string, string> = {
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  png: "image/png",
+  gif: "image/gif",
+  webp: "image/webp",
+  avif: "image/avif",
+  bmp: "image/bmp",
+  ico: "image/x-icon",
+  pdf: "application/pdf",
+  txt: "text/plain",
+  csv: "text/csv",
+  md: "text/markdown",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  zip: "application/zip",
+  mp3: "audio/mpeg",
+  wav: "audio/wav",
+  ogg: "audio/ogg",
+  mp4: "video/mp4",
+  webm: "video/webm",
+  mov: "video/quicktime",
+  woff: "font/woff",
+  woff2: "font/woff2",
+};
+
+type McpUpload = {
+  id: RecordId;
+  hash: string;
+  createdBy: string | null;
+  tokenId: string;
+  expiresAt: string;
+  remaining: number;
+  files: string[];
+};
+
+type FileRecord = {
+  id: RecordId;
+  name: string;
+  url: string;
+  type: string;
+  size: number;
+};
+
+const hashSecret = (plain: string) =>
+  new Bun.CryptoHasher("sha256").update(plain).digest("hex");
+
+const safeEqual = (a: string, b: string) => {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+
+  return left.length === right.length && timingSafeEqual(left, right);
+};
+
+const isPast = (iso: string) => moment().isAfter(iso);
+
+const publicFile = ({ id, name, url, type, size }: FileRecord) => ({
+  id: id.id.toString(),
+  name,
+  url,
+  type,
+  size,
+});
+
+// Called by the create_upload_url tool.
+export const createUploadTicket = async (input: {
+  tokenId: string;
+  userId: string | null;
+  base: string;
+}) => {
+  // Tickets are short-lived; anything an hour past expiry is only clutter (the grace period
+  // lets check_upload still answer shortly after a ticket lapses).
+  await surreal().query("DELETE mcp_upload WHERE expiresAt < $cutoff;", {
+    cutoff: moment().subtract(1, "hour").toISOString(),
+  });
+
+  const secret = randomBytes(24).toString("base64url");
+  const expiresAt = moment().add(UPLOAD_TTL_MINUTES, "minutes").toISOString();
+
+  const [created] = await surreal()
+    .create<McpUpload>(table)
+    .content({
+      hash: hashSecret(secret),
+      createdBy: input.userId,
+      tokenId: input.tokenId,
+      expiresAt,
+      remaining: MAX_FILES_PER_TICKET,
+      files: [],
+    });
+
+  const id = created!.id.id.toString();
+
+  return {
+    upload_id: id,
+    url: `${input.base}/mcp/upload/${id}.${secret}`,
+    expires_at: expiresAt,
+    max_files: MAX_FILES_PER_TICKET,
+    max_file_bytes: MAX_FILE_BYTES,
+    allowed_extensions: Object.keys(ALLOWED_TYPES),
+  };
+};
+
+// Called by the check_upload tool: what has landed on a ticket so far.
+export const getUploadStatus = async (uploadId: string) => {
+  const ticket = await surreal().select<McpUpload>(
+    new RecordId(table, uploadId),
+  );
+  if (!ticket) return null;
+
+  const files = (
+    await Promise.all(
+      ticket.files.map((id) => fileModule().model.show(id) as Promise<unknown>),
+    )
+  )
+    .filter(Boolean)
+    .map((record) => publicFile(record as FileRecord));
+
+  return {
+    files,
+    remaining: ticket.remaining,
+    expired: isPast(ticket.expiresAt),
+  };
+};
+
+const mcpUpload = makeModule(() => {
+  const fn = () => {};
+
+  fn.init = async () => {
+    const wantsHtml = (request: Request) =>
+      request.headers.get("accept")?.includes("text/html") ?? false;
+
+    const fail = (request: Request, status: number, message: string) =>
+      wantsHtml(request)
+        ? page(
+            "Upload failed",
+            `<h1>Upload failed</h1><p>${escapeHtml(message)}</p>`,
+            status,
+          )
+        : new Response(JSON.stringify({ error: message }), {
+            status,
+            headers: { "Content-Type": "application/json", ...noStore },
+          });
+
+    // The URL is the credential: "<ticket id>.<secret>", the secret stored only as a hash.
+    // Every failure reads the same to the caller, so a guessed id reveals nothing.
+    const loadTicket = async (param: string) => {
+      const dot = param.lastIndexOf(".");
+      const id = param.slice(0, dot);
+      const secret = param.slice(dot + 1);
+
+      const ticket =
+        dot > 0 && secret
+          ? await surreal().select<McpUpload>(new RecordId(table, id))
+          : null;
+
+      if (!ticket || !safeEqual(ticket.hash, hashSecret(secret))) return null;
+      if (isPast(ticket.expiresAt) || ticket.remaining <= 0) return null;
+
+      return ticket;
+    };
+
+    const invalid = (request: Request) =>
+      fail(request, 404, "This upload link is invalid, expired or used up.");
+
+    const controller = new Elysia()
+      .get("/mcp/upload/:ticket", async ({ request, params }) => {
+        const ticket = await loadTicket(params.ticket);
+        if (!ticket) return invalid(request);
+
+        const maxMb = MAX_FILE_BYTES / 1024 / 1024;
+
+        return page(
+          "Upload files",
+          `<h1>Upload files</h1>
+<p>Choose or drop up to ${ticket.remaining} files (${maxMb} MB each). The assistant will pick them up from here.</p>
+<form method="post" enctype="multipart/form-data">
+<input type="file" name="file" multiple required>
+<div class="row"><button type="submit" class="primary">Upload</button></div>
+</form>`,
+        );
+      })
+      .post(
+        "/mcp/upload/:ticket",
+        async ({ request, params }) => {
+          const ticket = await loadTicket(params.ticket);
+          if (!ticket) return invalid(request);
+
+          // Checked before the body is buffered — formData() reads it all into memory.
+          const declared = Number(request.headers.get("content-length") ?? 0);
+          if (declared > ticket.remaining * MAX_FILE_BYTES + 64 * 1024) {
+            return fail(request, 413, "That upload is too large.");
+          }
+
+          let incoming: FormDataEntryValue[];
+          try {
+            incoming = (await request.formData()).getAll("file");
+          } catch {
+            return fail(request, 400, "Send the file as multipart form data.");
+          }
+
+          const files = incoming.filter(
+            (entry): entry is File => entry instanceof File,
+          );
+          if (files.length === 0) {
+            return fail(request, 400, 'No file found in the "file" field.');
+          }
+          if (files.length > ticket.remaining) {
+            return fail(
+              request,
+              400,
+              `This link accepts ${ticket.remaining} more file(s).`,
+            );
+          }
+
+          // Everything is validated before anything is written, so a bad file in the batch
+          // doesn't leave the others half-uploaded.
+          const normalized: File[] = [];
+          for (const file of files) {
+            const extension = file.name.split(".").pop()?.toLowerCase() ?? "";
+            const type = ALLOWED_TYPES[extension];
+
+            if (!file.name.includes(".") || !type) {
+              return fail(
+                request,
+                415,
+                `"${file.name}": this file type is not allowed.`,
+              );
+            }
+            if (file.size === 0 || file.size > MAX_FILE_BYTES) {
+              return fail(
+                request,
+                413,
+                `"${file.name}" must be between 1 byte and ${MAX_FILE_BYTES / 1024 / 1024} MB.`,
+              );
+            }
+
+            normalized.push(new File([file], file.name, { type }));
+          }
+
+          const created: FileRecord[] = [];
+          for (const file of normalized) {
+            const [record] = (await fileModule().upload(file)) as FileRecord[];
+            created.push(record!);
+          }
+
+          await surreal()
+            .update(new RecordId(table, ticket.id.id))
+            .merge({
+              remaining: ticket.remaining - created.length,
+              files: [
+                ...ticket.files,
+                ...created.map((f) => f.id.id.toString()),
+              ],
+            });
+
+          if (wantsHtml(request)) {
+            return page(
+              "Uploaded",
+              `<h1>Uploaded</h1><p>You can close this tab and go back to the chat.</p><ul>${created
+                .map((f) => `<li>${escapeHtml(f.name)}</li>`)
+                .join("")}</ul>`,
+            );
+          }
+
+          return new Response(
+            JSON.stringify({ data: created.map(publicFile) }),
+            {
+              headers: { "Content-Type": "application/json", ...noStore },
+            },
+          );
+        },
+        { parse: "none" },
+      );
+
+    elysia().use(controller);
+
+    return {};
+  };
+
+  return fn;
+});
+
+export default mcpUpload;