@productbrain/mcp 0.0.1-beta.9756 → 0.0.1-beta.9775

package/dist/http.js

@@ -2,7 +2,7 @@ import {
   SERVER_VERSION,
   createProductBrainServer,
   initFeatureFlags
-} from "./chunk-ETBTCCMU.js";
+} from "./chunk-ER5AXQN2.js";
 import {
   DEFAULT_CLOUD_URL,
   apiKeysUrl,
@@ -170,25 +170,24 @@ var AUTH_FAILURE_MAX = 10;
 var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
 var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
 var MAX_AUTH_FAILURE_ENTRIES = 1e4;
+function rejected(presented) {
+  return { status: "rejected", credentialId: hashKey(presented) };
+}
 function resolveBearerAuth(authorizationHeader) {
   if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
     return { status: "absent" };
   }
   if (!authorizationHeader.startsWith("Bearer ")) {
-    return { status: "rejected" };
+    return rejected(authorizationHeader.trim());
   }
   const token = authorizationHeader.slice(7).trim();
-  if (token === "") {
-    return { status: "rejected" };
-  }
-  if (token.startsWith("pb_sk_")) {
-    return { status: "ok", apiKey: token };
-  }
-  return { status: "rejected" };
+  if (!token.startsWith("pb_sk_")) return rejected(token);
+  return { status: "ok", apiKey: token, credentialId: hashKey(token) };
 }
 function resolvePastedKey(apiKey) {
   if (apiKey === "") return { status: "absent" };
-  return apiKey.startsWith("pb_sk_") ? { status: "ok", apiKey } : { status: "rejected" };
+  if (!apiKey.startsWith("pb_sk_")) return rejected(apiKey);
+  return { status: "ok", apiKey, credentialId: hashKey(apiKey) };
 }
 function isCrossSiteFormPost(origin, secFetchSite, ownOrigin) {
   if (secFetchSite === "cross-site") return true;
@@ -199,21 +198,26 @@ function isCrossSiteFormPost(origin, secFetchSite, ownOrigin) {
     return true;
   }
 }
-function checkAuthBlock(failures, ip, now) {
-  const rec = failures.get(ip);
+function checkAuthBlock(failures, credentialId, now) {
+  const rec = failures.get(credentialId);
   if (!rec) return false;
   return rec.blockedUntil > now;
 }
-function authLockoutError(failures, ip, now, id = null) {
-  const rec = failures.get(ip);
-  if (!rec || !checkAuthBlock(failures, ip, now)) return null;
+function authLockoutError(failures, auth, now, id = null) {
+  if (auth.status === "absent") return null;
+  const rec = failures.get(auth.credentialId);
+  if (!rec || !checkAuthBlock(failures, auth.credentialId, now)) return null;
   const retryAfterSeconds = Math.max(0, Math.ceil((rec.blockedUntil - now) / 1e3));
   return buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec.count, id });
 }
-function recordAuthFailure(failures, ip, now) {
-  const rec = failures.get(ip);
+function recordAuthFailure(failures, credentialId, now) {
+  const rec = failures.get(credentialId);
   if (!rec) {
-    failures.set(ip, { count: 1, firstFailure: now, blockedUntil: 0 });
+    if (failures.size >= MAX_AUTH_FAILURE_ENTRIES) {
+      const oldest = failures.keys().next().value;
+      if (oldest !== void 0) failures.delete(oldest);
+    }
+    failures.set(credentialId, { count: 1, firstFailure: now, blockedUntil: 0 });
     return;
   }
   if (now - rec.firstFailure > AUTH_FAILURE_WINDOW_MS) {
@@ -227,10 +231,10 @@ function recordAuthFailure(failures, ip, now) {
     }
   }
 }
-function keyVerdictGate(verdict, failures, ip, now) {
+function keyVerdictGate(verdict, failures, credentialId, now) {
   if (verdict === "ok" || verdict === "rate_limited") return "admit";
   if (verdict === "rejected") {
-    recordAuthFailure(failures, ip, now);
+    recordAuthFailure(failures, credentialId, now);
     return "unauthorized";
   }
   return "unavailable";
@@ -456,15 +460,9 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [ip, rec] of authFailures) {
+  for (const [credentialId, rec] of authFailures) {
     if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
-      authFailures.delete(ip);
-    }
-  }
-  if (authFailures.size > MAX_AUTH_FAILURE_ENTRIES) {
-    const sorted = [...authFailures.entries()].sort((a, b) => a[1].firstFailure - b[1].firstFailure);
-    for (let i = 0; i < sorted.length - MAX_AUTH_FAILURE_ENTRIES; i++) {
-      authFailures.delete(sorted[i][0]);
+      authFailures.delete(credentialId);
     }
   }
 }, 6e4);
@@ -1067,18 +1065,17 @@ app.post(
       sendError("Request refused", "This form only accepts keys sent from its own sign-in page. Open the connect link again.", 403);
       return;
     }
-    const reqIp = req.ip ?? "unknown";
     const nowTs = Date.now();
-    const lockout = authLockoutError(authFailures, reqIp, nowTs);
+    const pasted = resolvePastedKey(api_key);
+    const lockout = authLockoutError(authFailures, pasted, nowTs);
     if (lockout) {
       const retryAfter = lockout.headers["Retry-After"];
       res.setHeader("Retry-After", retryAfter);
-      sendError("Too many attempts", `Too many keys from this network were not recognized. Try again in ${retryAfter}s.`, 429);
+      sendError("Too many attempts", `This key was not recognized too many times. Try again in ${retryAfter}s.`, 429);
       return;
     }
-    const pasted = resolvePastedKey(api_key);
     if (pasted.status !== "ok") {
-      if (pasted.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
+      if (pasted.status === "rejected") recordAuthFailure(authFailures, pasted.credentialId, nowTs);
       sendError("Invalid key format", "API keys start with <code>pb_sk_</code>. Check your key and try again.");
       return;
     }
@@ -1110,7 +1107,7 @@ app.post(
     }
     let workspaceName = "Your Workspace";
     const check = await checkKeyAgainstCandidates(keyCheckCandidates(), api_key, 5e3);
-    const gate = keyVerdictGate(check.verdict, authFailures, reqIp, nowTs);
+    const gate = keyVerdictGate(check.verdict, authFailures, pasted.credentialId, nowTs);
     if (check.verdict === "ok") {
       if (check.workspaceName) workspaceName = check.workspaceName;
       getKeyState(api_key).deploymentUrl = check.deploymentUrl;
@@ -1264,17 +1261,16 @@ function logSessionLifecycle(event, sessionId, reason) {
 `);
 }
 app.post("/mcp", mcpLimiter, async (req, res) => {
-  const reqIp = req.ip ?? "unknown";
   const nowTs = Date.now();
-  const lockout = authLockoutError(authFailures, reqIp, nowTs, req.body?.id ?? null);
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
   if (lockout) {
     send429(res, lockout);
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
-    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
@@ -1304,7 +1300,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
         }
       } else if (!sessionId && isInitializeRequest(req.body)) {
         const check = await checkKeyAgainstCandidates(keyCheckCandidates(), apiKey, 5e3);
-        const gate = keyVerdictGate(check.verdict, authFailures, reqIp, Date.now());
+        const gate = keyVerdictGate(check.verdict, authFailures, auth.credentialId, Date.now());
         if (gate === "unauthorized") {
           logRequest("POST", "auth_fail");
           send401(req, res);
@@ -1419,17 +1415,16 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
   }
 });
 app.get("/mcp", mcpLimiter, async (req, res) => {
-  const reqIp = req.ip ?? "unknown";
   const nowTs = Date.now();
-  const lockout = authLockoutError(authFailures, reqIp, nowTs, req.body?.id ?? null);
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
   if (lockout) {
     send429(res, lockout);
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
-    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }
@@ -1467,17 +1462,16 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
   }
 });
 app.delete("/mcp", mcpLimiter, async (req, res) => {
-  const reqIp = req.ip ?? "unknown";
   const nowTs = Date.now();
-  const lockout = authLockoutError(authFailures, reqIp, nowTs, req.body?.id ?? null);
+  const auth = resolveBearerAuth(req.headers?.authorization);
+  const lockout = authLockoutError(authFailures, auth, nowTs, req.body?.id ?? null);
   if (lockout) {
     send429(res, lockout);
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
-    if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
+    if (auth.status === "rejected") recordAuthFailure(authFailures, auth.credentialId, nowTs);
     send401(req, res);
     return;
   }