@productbrain/mcp 0.0.1-beta.9450 → 0.0.1-beta.9464

package/dist/http.js

@@ -2,22 +2,24 @@ import {
   SERVER_VERSION,
   createProductBrainServer,
   initFeatureFlags
-} from "./chunk-BCYOMOD2.js";
+} from "./chunk-BCQ7KBLE.js";
 import {
   DEFAULT_CLOUD_URL,
   apiKeysUrl,
   bootstrapHttp,
+  checkKeyAgainstCandidates,
   forgetStreamLifecycle,
   getKeyState,
   getPostHogClient,
   hashKey,
   initAnalytics,
+  parseFallbackUrls,
   runWithAuth,
   shutdownAnalytics
-} from "./chunk-DKJ4X2D7.js";
+} from "./chunk-FVH3B7MF.js";
 
 // src/http.ts
-import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -56,63 +58,6 @@ function appLogoMarkup(opts = {}) {
   return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
 }
 
-// src/lib/refresh-token.ts
-import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var PREFIX = "pb_rt_";
-var secret = (() => {
-  const fromEnv = process.env.MCP_REFRESH_SECRET;
-  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
-  if (process.env.NODE_ENV === "production") {
-    console.warn(
-      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
-    );
-  }
-  return randomBytes(32);
-})();
-function sign(payloadB64) {
-  return createHmac("sha256", secret).update(payloadB64).digest();
-}
-function signRefreshToken(apiKey) {
-  const payload = {
-    k: apiKey,
-    i: Date.now(),
-    j: randomUUID()
-  };
-  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-  const sigB64 = sign(payloadB64).toString("base64url");
-  return `${PREFIX}${payloadB64}.${sigB64}`;
-}
-function verifyRefreshToken(token) {
-  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
-  const body = token.slice(PREFIX.length);
-  const dot = body.indexOf(".");
-  if (dot <= 0 || dot === body.length - 1) return null;
-  const payloadB64 = body.slice(0, dot);
-  const sigB64 = body.slice(dot + 1);
-  let providedSig;
-  try {
-    providedSig = Buffer.from(sigB64, "base64url");
-  } catch {
-    return null;
-  }
-  const expectedSig = sign(payloadB64);
-  if (providedSig.length !== expectedSig.length) return null;
-  if (!timingSafeEqual(providedSig, expectedSig)) return null;
-  let payload;
-  try {
-    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
-    payload = JSON.parse(json);
-  } catch {
-    return null;
-  }
-  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
-    return null;
-  }
-  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
-  return { apiKey: payload.k };
-}
-
 // src/sessionCap.ts
 function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
   if (cap < 1) {
@@ -225,7 +170,7 @@ var AUTH_FAILURE_MAX = 10;
 var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
 var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
 var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenTtlMs) {
+function resolveBearerAuth(authorizationHeader) {
   if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
     return { status: "absent" };
   }
@@ -239,15 +184,6 @@ function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenT
   if (token.startsWith("pb_sk_")) {
     return { status: "ok", apiKey: token };
   }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens2.get(token);
-    if (!entry) return { status: "rejected" };
-    if (now - entry.createdAt > accessTokenTtlMs) {
-      accessTokens2.delete(token);
-      return { status: "rejected" };
-    }
-    return { status: "ok", apiKey: entry.apiKey };
-  }
   return { status: "rejected" };
 }
 function checkAuthBlock(failures, ip, now) {
@@ -272,6 +208,14 @@ function recordAuthFailure(failures, ip, now) {
     }
   }
 }
+function initializeKeyGate(verdict, failures, ip, now) {
+  if (verdict === "ok" || verdict === "rate_limited") return "admit";
+  if (verdict === "rejected") {
+    recordAuthFailure(failures, ip, now);
+    return "unauthorized";
+  }
+  return "unavailable";
+}
 
 // src/lib/oauthRedirectAllowlist.ts
 var DEFAULT_OAUTH_REDIRECT_URIS = [
@@ -361,12 +305,24 @@ function pendingCodeRefusal(pending, redirectUri, now) {
   if (now > pending.expiresAt) return "expired";
   return null;
 }
+function tokenResponse(apiKey) {
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    // 1 year: validity is enforced by Convex on every call, not by this clock.
+    expires_in: 365 * 24 * 3600
+  };
+}
 
 // src/http.ts
 bootstrapHttp();
 initAnalytics();
 initFeatureFlags(getPostHogClient());
 var PORT = parseInt(process.env.PORT ?? process.env.MCP_PORT ?? "3002", 10);
+function keyCheckCandidates() {
+  const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
+  return [primaryUrl, ...parseFallbackUrls(process.env.CONVEX_FALLBACK_URLS).map((u) => u.replace(/\/$/, ""))];
+}
 function baseUrl(req) {
   const proto = req.headers["x-forwarded-proto"] ?? req.protocol ?? "http";
   const host = req.headers.host ?? `localhost:${PORT}`;
@@ -411,7 +367,8 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
+    grant_types_supported: ["authorization_code"],
+    // TEN-4548: no refresh grant (lib/oauthAuthCode.ts tokenResponse)
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
@@ -444,7 +401,7 @@ app.post(
       res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
-    const clientId = `pb_client_${randomUUID2()}`;
+    const clientId = `pb_client_${randomUUID()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -463,9 +420,6 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
-var ACCESS_TOKEN_TTL = 3600;
-var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
@@ -474,9 +428,6 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of accessTokens) {
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
-  }
   for (const [ip, rec] of authFailures) {
     if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
       authFailures.delete(ip);
@@ -1118,61 +1069,28 @@ app.post(
       return;
     }
     let workspaceName = "Your Workspace";
-    try {
-      const primaryUrl = (process.env.CONVEX_SITE_URL ?? DEFAULT_CLOUD_URL).replace(/\/$/, "");
-      const fallbackUrls = (process.env.CONVEX_FALLBACK_URLS ?? "").split(",").map((u) => u.trim().replace(/\/$/, "")).filter(Boolean);
-      const candidates = [primaryUrl, ...fallbackUrls];
-      let foundUrl;
-      let anyDefinitiveReject = false;
-      let rateLimitedRetryAfter;
-      for (const url2 of candidates) {
-        let checkData = null;
-        try {
-          const checkRes = await fetch(`${url2}/api/key-check`, {
-            method: "POST",
-            headers: { "Authorization": `Bearer ${api_key}`, "Content-Type": "application/json" },
-            signal: AbortSignal.timeout(5e3)
-          });
-          checkData = await checkRes.json();
-        } catch {
-          continue;
-        }
-        if (checkData.ok) {
-          if (checkData.workspaceName) workspaceName = checkData.workspaceName;
-          foundUrl = checkData.deploymentUrl ?? url2;
-          break;
-        }
-        if (checkData.error === "rate_limited") {
-          rateLimitedRetryAfter = checkData.retryAfterSeconds;
-          continue;
-        }
-        anyDefinitiveReject = true;
-      }
-      if (!foundUrl) {
-        if (rateLimitedRetryAfter != null && !anyDefinitiveReject) {
-          sendError(
-            "Rate limited",
-            `This API key is valid but temporarily rate limited. Try again in ${rateLimitedRetryAfter}s.`,
-            429
-          );
-          return;
-        }
-        if (anyDefinitiveReject) {
-          sendError(
-            "Key not recognized",
-            "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
-            401
-          );
-          return;
-        }
-        process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
-      } else {
-        getKeyState(api_key).deploymentUrl = foundUrl;
-      }
-    } catch {
+    const check = await checkKeyAgainstCandidates(keyCheckCandidates(), api_key, 5e3);
+    if (check.verdict === "ok") {
+      if (check.workspaceName) workspaceName = check.workspaceName;
+      getKeyState(api_key).deploymentUrl = check.deploymentUrl;
+    } else if (check.verdict === "rate_limited") {
+      sendError(
+        "Rate limited",
+        `This API key is valid but temporarily rate limited. Try again in ${check.retryAfterSeconds ?? 60}s.`,
+        429
+      );
+      return;
+    } else if (check.verdict === "rejected") {
+      sendError(
+        "Key not recognized",
+        "This API key wasn't found in Product Brain. Check your API Keys in Cortex and try again.",
+        401
+      );
+      return;
+    } else {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID2();
+    const code = randomUUID();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -1191,35 +1109,13 @@ app.post(
     }
   }
 );
-function issueTokens(apiKey) {
-  return {
-    access_token: apiKey,
-    token_type: "Bearer",
-    // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
-    // Long TTL prevents unnecessary refresh cycles after restarts.
-    expires_in: 365 * 24 * 3600,
-    refresh_token: signRefreshToken(apiKey)
-  };
-}
 app.post(
   "/oauth/token",
   authLimiter,
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
-    if (grant_type === "refresh_token") {
-      const verified = verifyRefreshToken(refresh_token);
-      if (!verified) {
-        res.status(400).json({
-          error: "invalid_grant",
-          error_description: "Invalid or expired refresh token"
-        });
-        return;
-      }
-      res.json(issueTokens(verified.apiKey));
-      return;
-    }
+    const { grant_type, code, code_verifier, redirect_uri } = req.body;
     if (grant_type !== "authorization_code") {
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
@@ -1245,7 +1141,7 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json(issueTokens(pending.apiKey));
+    res.json(tokenResponse(pending.apiKey));
   }
 );
 var mcpLimiter = rateLimit({
@@ -1339,7 +1235,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
     send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
     if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
@@ -1371,6 +1267,22 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           entry.lastAccess = Date.now();
         }
       } else if (!sessionId && isInitializeRequest(req.body)) {
+        const check = await checkKeyAgainstCandidates(keyCheckCandidates(), apiKey, 5e3);
+        const gate = initializeKeyGate(check.verdict, authFailures, reqIp, Date.now());
+        if (gate === "unauthorized") {
+          logRequest("POST", "auth_fail");
+          send401(req, res);
+          return;
+        }
+        if (gate === "unavailable") {
+          res.status(503).json({
+            jsonrpc: "2.0",
+            error: { code: -32e3, message: "Product Brain could not verify this API key right now. Retry shortly." },
+            id: req.body?.id ?? null
+          });
+          return;
+        }
+        if (check.verdict === "ok" || check.verdict === "rate_limited") getKeyState(apiKey).deploymentUrl = check.deploymentUrl;
         const keyH = hashKey(apiKey);
         const plan = planKeyAdmission(
           sessions,
@@ -1396,7 +1308,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           }));
           return;
         }
-        const sid = randomUUID2();
+        const sid = randomUUID();
         let initialized = false;
         const transport = new StreamableHTTPServerTransport({
           sessionIdGenerator: () => sid,
@@ -1479,7 +1391,7 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
     if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
@@ -1528,7 +1440,7 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
     if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);