@remcp/remcp 0.1.3 → 0.2.4

package/src/server.mjs

@@ -1,159 +0,0 @@
-import http from 'node:http';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import express from 'express';
-import helmet from 'helmet';
-import { rateLimit } from 'express-rate-limit';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';
-import { config } from './config.mjs';
-import { createDevice, createPairCode, consumePairCode, revokeDevice } from './db.mjs';
-import { requireFirebase, requireMcpAuth } from './auth.mjs';
-import { oauthRouter } from './oauth.mjs';
-import { createRelay } from './relay.mjs';
-import { createMcpServer } from './mcp.mjs';
-import { now, randomId, randomToken, sha256 } from './util.mjs';
-import { VERSION } from './version.mjs';
-
-const app = express();
-app.set('trust proxy', 1);
-app.disable('x-powered-by');
-const firebaseFrame = `https://${config.firebase.authDomain}`;
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", 'https://www.gstatic.com', 'https://apis.google.com', 'https://www.google.com'],
-      connectSrc: ["'self'", 'https://identitytoolkit.googleapis.com', 'https://securetoken.googleapis.com', 'https://www.googleapis.com', 'https://apis.google.com', 'https://accounts.google.com'],
-      imgSrc: ["'self'", 'data:'],
-      styleSrc: ["'self'"],
-      fontSrc: ["'none'"],
-      frameSrc: [firebaseFrame, 'https://accounts.google.com', 'https://apis.google.com'],
-      objectSrc: ["'none'"],
-      baseUri: ["'none'"],
-      formAction: ["'self'", 'https://accounts.google.com'],
-      frameAncestors: ["'none'"],
-    },
-  },
-  crossOriginOpenerPolicy: { policy: 'same-origin-allow-popups' },
-  strictTransportSecurity: config.publicUrl.startsWith('https://') ? { maxAge: 31536000, includeSubDomains: false } : false,
-  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
-}));
-app.use((req, res, next) => {
-  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
-  const dynamicPath = req.path === '/health' || req.path === '/mcp' || req.path.startsWith('/api/') || req.path.startsWith('/oauth/') || req.path.startsWith('/.well-known/');
-  if (dynamicPath) {
-    res.setHeader('Cache-Control', 'no-store, max-age=0');
-    res.setHeader('CDN-Cache-Control', 'no-store');
-    res.setHeader('Cloudflare-CDN-Cache-Control', 'no-store');
-  }
-  next();
-});
-app.use(express.json({ limit: '256kb' }));
-app.use(express.urlencoded({ extended: false, limit: '256kb', parameterLimit: 50 }));
-const pairClaimLimiter = rateLimit({ windowMs: 60_000, limit: 20, standardHeaders: 'draft-8', legacyHeaders: false });
-
-const httpServer = http.createServer(app);
-const relay = createRelay(httpServer);
-const sessions = new Map();
-const publicDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../public');
-
-app.get('/health', (_req, res) => res.json({ ok: true, service: 'remcp', version: VERSION, connectedDevices: relay.onlineCount() }));
-app.get(config.domainVerificationPath, (_req, res) => {
-  if (!config.domainVerificationToken) return res.status(404).type('text/plain').send('Not configured');
-  res.type('text/plain').send(config.domainVerificationToken);
-});
-app.get('/api/config', (_req, res) => res.json({ publicUrl: config.publicUrl, mcpUrl: `${config.publicUrl}/mcp`, firebase: config.firebase }));
-app.get('/.well-known/security.txt', (_req, res) => res.type('text/plain').send(`Contact: ${config.publicUrl}/support\nPolicy: ${config.publicUrl}/security\nExpires: 2027-09-16T00:00:00Z\nCanonical: ${config.publicUrl}/.well-known/security.txt\n`));
-
-app.post('/api/pair/create', requireFirebase, (req, res) => {
-  const alphabet = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
-  let code = '';
-  const bytes = Buffer.from(randomToken(12));
-  for (let i = 0; i < 8; i++) code += alphabet[bytes[i] % alphabet.length];
-  const expiresAt = now() + config.pairTtlSeconds * 1000;
-  createPairCode(req.user.uid, sha256(code), expiresAt);
-  res.json({ code, expiresAt, command: `npx --yes ${config.installSpec} connect --server ${config.publicUrl} --code ${code} --install` });
-});
-
-app.post('/api/pair/claim', pairClaimLimiter, (req, res) => {
-  const code = String(req.body?.code || '').replace(/\s+/g, '').toUpperCase();
-  const pair = consumePairCode(sha256(code));
-  if (!pair) return res.status(400).json({ error: 'invalid_or_expired_pairing_code' });
-  const deviceToken = randomToken(32);
-  const device = createDevice({
-    id: randomId(), uid: pair.uid,
-    name: String(req.body?.name || req.body?.hostname || 'My computer').slice(0, 100),
-    tokenHash: sha256(deviceToken), hostname: String(req.body?.hostname || '').slice(0, 180),
-    platform: String(req.body?.platform || '').slice(0, 32), arch: String(req.body?.arch || '').slice(0, 32),
-  });
-  res.json({ deviceId: device.id, deviceToken, agentUrl: config.publicUrl.replace(/^http/, 'ws') + '/agent' });
-});
-
-app.get('/api/me', requireFirebase, (req, res) => res.json({ user: req.user, devices: relay.devicesFor(req.user.uid) }));
-app.delete('/api/devices/:id', requireFirebase, (req, res) => {
-  const result = revokeDevice(req.user.uid, String(req.params.id));
-  if (!result.changes) return res.status(404).json({ error: 'device_not_found' });
-  res.status(204).end();
-});
-
-app.use(oauthRouter);
-app.all('/mcp', requireMcpAuth, async (req, res) => {
-  try {
-    const sessionId = req.headers['mcp-session-id'];
-    let entry = typeof sessionId === 'string' ? sessions.get(sessionId) : undefined;
-    if (entry && entry.uid !== req.mcpAuth.uid) return res.status(403).json({ error: 'session_owner_mismatch' });
-    if (!entry) {
-      if (sessionId || !isInitializeRequest(req.body)) return res.status(400).json({ error: 'invalid_or_missing_mcp_session' });
-      const mcpServer = createMcpServer(req.mcpAuth.uid, relay);
-      let transport;
-      transport = new StreamableHTTPServerTransport({
-        sessionIdGenerator: randomId,
-        onsessioninitialized: id => sessions.set(id, { transport, mcpServer, uid: req.mcpAuth.uid }),
-        onsessionclosed: id => sessions.delete(id),
-      });
-      transport.onclose = () => {
-        const id = transport.sessionId;
-        if (id) sessions.delete(id);
-        void mcpServer.close();
-      };
-      await mcpServer.connect(transport);
-      entry = { transport, mcpServer, uid: req.mcpAuth.uid };
-    }
-    await entry.transport.handleRequest(req, res, req.body);
-  } catch (error) {
-    console.error('MCP request failed', error);
-    if (!res.headersSent) res.status(500).json({ error: 'mcp_request_failed' });
-  }
-});
-
-const noStoreExtensions = new Set(['.html', '.css', '.js', '.webmanifest']);
-app.use(express.static(publicDir, {
-  extensions: ['html'],
-  maxAge: 0,
-  dotfiles: 'deny',
-  setHeaders: (res, filePath) => {
-    const extension = path.extname(filePath).toLowerCase();
-    if (noStoreExtensions.has(extension)) {
-      // The public site changes independently from the API. Never let a CDN
-      // combine HTML from one deploy with CSS/JS from another deploy.
-      res.setHeader('Cache-Control', 'no-store, max-age=0');
-      res.setHeader('CDN-Cache-Control', 'no-store');
-      res.setHeader('Cloudflare-CDN-Cache-Control', 'no-store');
-      return;
-    }
-    res.setHeader('Cache-Control', 'public, max-age=86400');
-  },
-}));
-app.get('*path', (req, res) => {
-  if (!req.accepts('html')) return res.status(404).json({ error: 'not_found' });
-  res.status(404).sendFile(path.join(publicDir, 'index.html'));
-});
-app.use((error, _req, res, _next) => {
-  console.error('Unhandled request error', error instanceof Error ? error.message : String(error));
-  if (!res.headersSent) res.status(500).json({ error: 'internal_server_error' });
-});
-
-httpServer.listen(config.port, '0.0.0.0', () => {
-  console.log(`ReMCP ${config.publicUrl} listening on 0.0.0.0:${config.port}`);
-});