@samanhappy/mcphub 1.0.28 → 1.0.30

package/dist/services/mcpService.js

@@ -200,7 +200,7 @@ export const initUpstreamServers = async () => {
     // Register all tools from upstream servers
     await registerAllTools(true);
     // Initialize smart routing service with references to mcpService functions
-    initSmartRoutingService(() => serverInfos, filterToolsByConfig, filterToolsByGroup);
+    initSmartRoutingService(getVisibleServerInfos, filterToolsByConfig, filterToolsByGroup);
 };
 const getMcpServerDescriptor = async (group) => {
     if (!group || isSmartRoutingGroup(group)) {
@@ -288,6 +288,11 @@ const cleanupIsolatedSession = (sessionId) => {
         }
         console.log(`Cleaned up isolated clients for session: ${sessionId}`);
     }
+    // Drop per-session OpenAPI cookie jars so authenticated state does not
+    // outlive the downstream session.
+    for (const serverInfo of serverInfos) {
+        serverInfo.openApiClient?.clearSessionCookies?.(sessionId);
+    }
 };
 /** Helper to write an isolated session upstream client into the tracking map. */
 const setSessionIsolatedClient = (sessionId, serverName, client, transport) => {
@@ -392,16 +397,18 @@ export const broadcastResourceListChanged = () => {
 export const broadcastPromptListChanged = () => {
     broadcastListChanged('prompt', (server) => server.sendPromptListChanged());
 };
-export const updateServerInfoVisibility = (serverName, visibility) => {
+export const updateServerInfoVisibility = (serverName, visibility, sharedWithUsers) => {
     const serverInfo = getServerByName(serverName);
     if (!serverInfo) {
         return;
     }
     serverInfo.visibility = visibility;
+    serverInfo.sharedWithUsers = sharedWithUsers;
     if (serverInfo.config) {
         serverInfo.config = {
             ...serverInfo.config,
             visibility,
+            sharedWithUsers,
         };
     }
 };
@@ -497,6 +504,12 @@ const normalizeResourceForCache = (resource) => {
 };
 // Store all server information
 let serverInfos = [];
+const getVisibleServerInfos = () => {
+    return getDataService().filterData(serverInfos);
+};
+const getVisibleServerByName = (name) => {
+    return getVisibleServerInfos().find((serverInfo) => serverInfo.name === name);
+};
 // Per-session upstream clients for isolated servers (perSessionClient: true).
 // Map<sessionId, Map<serverName, { client, transport }>>
 const sessionIsolatedClients = new Map();
@@ -1161,6 +1174,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     name,
                     owner: expandedConf.owner,
                     visibility: expandedConf.visibility,
+                    sharedWithUsers: expandedConf.sharedWithUsers,
                     status: 'disconnected',
                     error: null,
                     tools: [],
@@ -1191,6 +1205,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     }),
                     owner: expandedConf.owner,
                     visibility: expandedConf.visibility,
+                    sharedWithUsers: expandedConf.sharedWithUsers,
                     enabled: true,
                     config: expandedConf,
                 });
@@ -1217,6 +1232,9 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     (!serverName && (existingServer.status === 'connected' || hasInflightOAuthAuthorization)))) {
                 nextServerInfos.push({
                     ...existingServer,
+                    owner: expandedConf.owner,
+                    visibility: expandedConf.visibility,
+                    sharedWithUsers: expandedConf.sharedWithUsers,
                     enabled: expandedConf.enabled === undefined ? true : expandedConf.enabled,
                 });
                 console.log(hasInflightOAuthAuthorization
@@ -1234,6 +1252,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                         name,
                         owner: expandedConf.owner,
                         visibility: expandedConf.visibility,
+                        sharedWithUsers: expandedConf.sharedWithUsers,
                         status: 'disconnected',
                         error: 'Missing OpenAPI specification URL or schema',
                         tools: [],
@@ -1248,6 +1267,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                     name,
                     owner: expandedConf.owner,
                     visibility: expandedConf.visibility,
+                    sharedWithUsers: expandedConf.sharedWithUsers,
                     status: 'connecting',
                     error: null,
                     tools: [],
@@ -1345,6 +1365,7 @@ export const initializeClientsFromSettings = async (isInit, serverName, options)
                 name,
                 owner: expandedConf.owner,
                 visibility: expandedConf.visibility,
+                sharedWithUsers: expandedConf.sharedWithUsers,
                 status: 'connecting',
                 error: null,
                 tools: [],
@@ -1525,6 +1546,7 @@ export const getServersInfo = async (page, limit, user) => {
                 name: server.name,
                 owner: server.owner,
                 visibility: server.visibility,
+                sharedWithUsers: server.sharedWithUsers,
                 // Newly created servers that are enabled should appear as "connecting"
                 // until the MCP client initialization completes. Disabled servers remain
                 // in the "disconnected" state.
@@ -1713,7 +1735,7 @@ const filterToolsByConfig = async (serverName, tools) => {
 };
 // Get server by tool name
 const getServerByTool = (toolName) => {
-    return serverInfos.find((serverInfo) => serverInfo.enabled !== false && serverInfo.tools.some((tool) => tool.name === toolName));
+    return getVisibleServerInfos().find((serverInfo) => serverInfo.enabled !== false && serverInfo.tools.some((tool) => tool.name === toolName));
 };
 // Add new server
 export const addServer = async (name, config) => {
@@ -1827,8 +1849,9 @@ const closeServerRuntime = (serverInfo) => {
     }
     console.log('Closed MCP server client and transport');
 };
-// Close server client and transport
-function closeServer(name) {
+// Close server client and transport (keeps the entry in serverInfos; the next
+// initializeClientsFromSettings rebuild drops it if it is no longer configured).
+export function closeServer(name) {
     const serverInfo = serverInfos.find((serverInfo) => serverInfo.name === name);
     if (serverInfo) {
         closeServerRuntime(serverInfo);
@@ -2337,6 +2360,18 @@ export const handleCallToolRequest = async (request, extra) => {
     const requestContextService = RequestContextService.getInstance();
     const bearerKeyContext = requestContextService.getBearerKeyContext();
     const sessionId = extra.sessionId || '';
+    // For OpenAPI cookie-session isolation, use a real per-caller session id.
+    // Direct API controllers fall back to shared synthetic ids ('api-session' /
+    // 'openapi-session') when x-session-id is absent, which would leak cookies
+    // across callers, so only accept an explicitly-provided session header or a
+    // non-synthetic extra.sessionId. Fail-safe (undefined) otherwise.
+    const isSyntheticSessionFallback = (id) => id === 'api-session' || id === 'openapi-session';
+    const explicitXSessionId = extra?.headers?.['x-session-id'];
+    const cookieSessionId = [
+        requestContextService.getSessionId(),
+        typeof explicitXSessionId === 'string' ? explicitXSessionId : undefined,
+        typeof extra?.sessionId === 'string' ? extra.sessionId : undefined,
+    ].find((id) => typeof id === 'string' && id.length > 0 && !isSyntheticSessionFallback(id));
     // Extract group and key info from request context (set by SSE/HTTP handlers)
     // Fallback to extra for backward compatibility (e.g., direct API calls)
     const group = requestContextService.getGroupContext() || extra?.group || getGroup(sessionId) || undefined;
@@ -2395,7 +2430,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 targetServerInfo = appsRouteContext.serverInfo;
             }
             else if (extra && extra.server) {
-                targetServerInfo = getServerByName(extra.server);
+                targetServerInfo = getVisibleServerByName(extra.server);
             }
             else if (getGroupLookupName(group)) {
                 const groupTool = await resolveToolInGroup(group, toolName, false);
@@ -2409,7 +2444,7 @@ export const handleCallToolRequest = async (request, extra) => {
                 // Find the first server that has this tool.
                 // On-demand servers may be sleeping (disconnected) but still advertise
                 // their cached tool list — include them as candidates.
-                targetServerInfo = serverInfos.find((serverInfo) => serverInfo.enabled !== false &&
+                targetServerInfo = getVisibleServerInfos().find((serverInfo) => serverInfo.enabled !== false &&
                     (serverInfo.status === 'connected' || serverInfo.config?.startOnDemand === true) &&
                     serverInfo.tools.some((tool) => tool.name === toolName));
             }
@@ -2472,7 +2507,7 @@ export const handleCallToolRequest = async (request, extra) => {
                     }
                 }
                 await reserveHostedIfNeeded(targetServerInfo.name, cleanToolName);
-                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders);
+                const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, cookieSessionId);
                 await settleHostedIfNeeded({
                     success: true,
                     requestContent: finalArgs,
@@ -2638,7 +2673,7 @@ export const handleCallToolRequest = async (request, extra) => {
             }
             const finalArgs = request.params.arguments || {};
             await reserveHostedIfNeeded(serverInfo.name, cleanToolName);
-            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders);
+            const result = await openApiClient.callTool(cleanToolName, finalArgs, passthroughHeaders, false, cookieSessionId);
             await settleHostedIfNeeded({
                 success: true,
                 requestContent: finalArgs,
@@ -2790,7 +2825,7 @@ export const handleGetPromptRequest = async (request, extra) => {
         let promptNameForServer = name;
         const lookupGroup = getGroupLookupName(group);
         if (extra && extra.server) {
-            server = getServerByName(extra.server);
+            server = getVisibleServerByName(extra.server);
         }
         else if (lookupGroup) {
             const groupPrompt = await resolvePromptInGroup(lookupGroup, name);
@@ -2801,7 +2836,7 @@ export const handleGetPromptRequest = async (request, extra) => {
         }
         else {
             // Find the first server that has this prompt
-            server = serverInfos.find((serverInfo) => serverInfo.status === 'connected' &&
+            server = getVisibleServerInfos().find((serverInfo) => serverInfo.status === 'connected' &&
                 serverInfo.enabled !== false &&
                 serverInfo.prompts.find((prompt) => prompt.name === name));
         }
@@ -3108,7 +3143,7 @@ export const getFilteredServerInfosForGroup = async (group, options) => {
     const serverNamesInGroup = new Set(serverConfigs.map((serverConfig) => serverConfig.name));
     const serverConfigsByName = new Map(serverConfigs.map((serverConfig) => [serverConfig.name, serverConfig]));
     const filteredServerInfos = [];
-    for (const serverInfo of getDataService().filterData(serverInfos)) {
+    for (const serverInfo of getVisibleServerInfos()) {
         if (serverInfo.enabled === false)
             continue;
         if (options?.requireClient && !serverInfo.client)