@samanhappy/mcphub 1.0.31 → 1.0.33

package/dist/controllers/serverController.js

@@ -6,10 +6,16 @@ import { createSafeJSON } from '../utils/serialization.js';
 import { cloneDefaultOAuthServerConfig } from '../constants/oauthServerDefaults.js';
 import { getBearerKeyDao, getGroupDao, getOAuthClientDao, getOAuthTokenDao, getServerDao, getSystemConfigDao, getUserConfigDao, getUserDao, } from '../dao/DaoFactory.js';
 import { UserContextService } from '../services/userContextService.js';
+import { authorizationService } from '../services/authorizationService.js';
+import { presentServerForPrincipal, presentServerInfoForPrincipal, } from '../services/serverConfigPresenter.js';
 import { disconnectUpstreamOAuth } from '../services/upstreamOAuthDisconnectService.js';
 import { normalizeServerConfigForPersistence } from '../utils/serverConfigPersistence.js';
+import { isPrivilegedServerConfig } from '../utils/serverConfigValidation.js';
+import { validateServerName } from '../utils/serverNameValidation.js';
 import { setCachedSystemConfig } from '../utils/systemConfigCache.js';
 import { DEFAULT_INSTALL_BASE_URL, withResolvedInstallBaseUrl } from '../utils/installBaseUrl.js';
+import { previewOpenApiToolStats } from '../services/openApiToolStatsService.js';
+import { logger } from '../utils/logger.js';
 const getRequestUser = (req) => {
     return req.user || null;
 };
@@ -22,12 +28,6 @@ const canAccessServer = (user, server) => {
     }
     return server.owner === user.username;
 };
-const isPrivilegedServerConfig = (config) => {
-    return Boolean(config.type === 'stdio' ||
-        config.command ||
-        (Array.isArray(config.args) && config.args.length > 0) ||
-        (!config.url && !config.openapi?.url && !config.openapi?.schema));
-};
 const loadAuthorizedServer = async (req, res, serverName) => {
     const serverDao = getServerDao();
     const server = await serverDao.findById(serverName);
@@ -194,16 +194,21 @@ export const getAllServers = async (req, res) => {
             // No pagination, get all servers (will be filtered by mcpService)
             serversInfo = await getServersInfo();
         }
+        // #1036 Phase 1: withhold OAuth session-recovery fields from principals
+        // who may not read the full server configuration (defense in depth; the
+        // config block on list entries is already narrowed to safe metadata).
+        const presentedServersInfo = serversInfo.map((info) => presentServerInfoForPrincipal(info, currentUser));
+        const presentedAllServers = allServers?.map((info) => presentServerInfoForPrincipal(info, currentUser));
         const response = {
             success: true,
-            data: createSafeJSON(serversInfo),
-            ...(allServers && { allServers: createSafeJSON(allServers) }),
+            data: createSafeJSON(presentedServersInfo),
+            ...(presentedAllServers && { allServers: createSafeJSON(presentedAllServers) }),
             ...(pagination && { pagination }),
         };
         res.json(response);
     }
     catch (error) {
-        console.error('Failed to get servers information:', error);
+        logger.error('Failed to get servers information:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to get servers information',
@@ -228,7 +233,7 @@ export const getServerShareCandidates = async (req, res) => {
         res.json({ success: true, data: usernames });
     }
     catch (error) {
-        console.error('Failed to get server share candidates:', error);
+        logger.error('Failed to get server share candidates:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to get server share candidates',
@@ -308,23 +313,64 @@ export const getAllSettings = async (req, res) => {
         res.json(response);
     }
     catch (error) {
-        console.error('Failed to get server settings:', error);
+        logger.error('Failed to get server settings:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to get server settings',
         });
     }
 };
+/**
+ * Preview the tool list an OpenAPI import would generate, without persisting
+ * anything (#1082). Large specs can silently produce a tools/list that does
+ * not fit in a model's context window; this endpoint lets the form surface
+ * the numbers at the point of confirming the import.
+ */
+export const previewOpenApiToolStatsHandler = async (req, res) => {
+    try {
+        const { config } = req.body;
+        if (!config || typeof config !== 'object') {
+            res.status(400).json({
+                success: false,
+                message: 'Server configuration is required',
+            });
+            return;
+        }
+        const normalizedConfig = normalizeServerConfigForPersistence(config);
+        if (!normalizedConfig.openapi?.url && !normalizedConfig.openapi?.schema) {
+            res.status(400).json({
+                success: false,
+                message: 'OpenAPI specification URL or schema is required',
+            });
+            return;
+        }
+        // Assign the requesting user as owner so initialize()'s admin check (and
+        // therefore the internal-network SSRF allowance) matches what a real
+        // add-server request would produce for the same caller.
+        assignServerOwner(req, normalizedConfig);
+        const stats = await previewOpenApiToolStats(normalizedConfig);
+        res.json({ success: true, data: stats });
+    }
+    catch (error) {
+        logger.warn('Failed to preview OpenAPI tool stats:', error);
+        res.status(400).json({
+            success: false,
+            message: error instanceof Error ? error.message : 'Failed to analyze OpenAPI specification',
+        });
+    }
+};
 export const createServer = async (req, res) => {
     try {
         const { name, config } = req.body;
-        if (!name || typeof name !== 'string') {
+        const nameValidation = validateServerName(name);
+        if (!nameValidation.valid) {
             res.status(400).json({
                 success: false,
-                message: 'Server name is required',
+                message: nameValidation.message,
             });
             return;
         }
+        const serverName = nameValidation.normalized;
         if (!config || typeof config !== 'object') {
             res.status(400).json({
                 success: false,
@@ -391,20 +437,19 @@ export const createServer = async (req, res) => {
             return;
         }
         // Set default keep-alive interval for SSE servers if not specified
-        if ((normalizedConfig.type === 'sse' ||
-            (!normalizedConfig.type && normalizedConfig.url)) &&
+        if ((normalizedConfig.type === 'sse' || (!normalizedConfig.type && normalizedConfig.url)) &&
             !normalizedConfig.keepAliveInterval) {
             normalizedConfig.keepAliveInterval = 60000; // Default 60 seconds for SSE servers
         }
         assignServerOwner(req, normalizedConfig);
-        const result = await addServer(name, normalizedConfig);
+        const result = await addServer(serverName, normalizedConfig);
         if (result.success) {
             res.json({
                 success: true,
                 message: 'Server added successfully',
             });
-            notifyToolChanged(name, { reportEmbeddingProgress: true }).catch((error) => {
-                console.error('Failed to trigger embedding sync for created server:', error);
+            notifyToolChanged(serverName, { reportEmbeddingProgress: true }).catch((error) => {
+                logger.error('Failed to trigger embedding sync for created server:', error);
             });
         }
         else {
@@ -442,8 +487,9 @@ export const batchCreateServers = async (req, res) => {
         }
         // Helper function to validate a single server configuration
         const validateServerConfig = (name, config) => {
-            if (!name || typeof name !== 'string') {
-                return { valid: false, message: 'Server name is required and must be a string' };
+            const nameValidation = validateServerName(name);
+            if (!nameValidation.valid) {
+                return { valid: false, message: nameValidation.message };
             }
             if (!config || typeof config !== 'object') {
                 return { valid: false, message: 'Server configuration is required and must be an object' };
@@ -491,7 +537,7 @@ export const batchCreateServers = async (req, res) => {
             if (normalizedConfig.headers && normalizedConfig.type === 'stdio') {
                 return { valid: false, message: 'Headers are not supported for stdio server type' };
             }
-            return { valid: true };
+            return { valid: true, normalizedName: nameValidation.normalized };
         };
         // Process each server
         const results = [];
@@ -513,17 +559,17 @@ export const batchCreateServers = async (req, res) => {
                 failureCount++;
                 continue;
             }
+            const serverName = validation.normalizedName ?? name;
             try {
                 // Set default keep-alive interval for SSE servers if not specified
                 const normalizedConfig = normalizeServerConfigForPersistence(config);
-                if ((normalizedConfig.type === 'sse' ||
-                    (!normalizedConfig.type && normalizedConfig.url)) &&
+                if ((normalizedConfig.type === 'sse' || (!normalizedConfig.type && normalizedConfig.url)) &&
                     !normalizedConfig.keepAliveInterval) {
                     normalizedConfig.keepAliveInterval = 60000; // Default 60 seconds for SSE servers
                 }
                 if (isPrivilegedServerConfig(normalizedConfig) && currentUser?.isAdmin !== true) {
                     results.push({
-                        name,
+                        name: serverName,
                         success: false,
                         message: 'Only admins can create or modify stdio-based servers',
                     });
@@ -531,19 +577,21 @@ export const batchCreateServers = async (req, res) => {
                     continue;
                 }
                 // Set owner property if not provided
-                normalizedConfig.owner = currentUser?.isAdmin ? normalizedConfig.owner || defaultOwner : defaultOwner;
+                normalizedConfig.owner = currentUser?.isAdmin
+                    ? normalizedConfig.owner || defaultOwner
+                    : defaultOwner;
                 // Attempt to add server
-                const result = await addServer(name, normalizedConfig);
+                const result = await addServer(serverName, normalizedConfig);
                 if (result.success) {
                     results.push({
-                        name,
+                        name: serverName,
                         success: true,
                     });
                     successCount++;
                 }
                 else {
                     results.push({
-                        name,
+                        name: serverName,
                         success: false,
                         message: result.message || 'Failed to add server',
                     });
@@ -552,7 +600,7 @@ export const batchCreateServers = async (req, res) => {
             }
             catch (error) {
                 results.push({
-                    name,
+                    name: serverName,
                     success: false,
                     message: error instanceof Error ? error.message : 'Internal server error',
                 });
@@ -577,12 +625,12 @@ export const batchCreateServers = async (req, res) => {
                 .filter((result) => result.success)
                 .map((result) => result.name);
             Promise.all(successfulServerNames.map((serverName) => notifyToolChanged(serverName, { reportEmbeddingProgress: true }))).catch((error) => {
-                console.error('Failed to trigger embedding sync for batch-created servers:', error);
+                logger.error('Failed to trigger embedding sync for batch-created servers:', error);
             });
         }
     }
     catch (error) {
-        console.error('Batch create servers error:', error);
+        logger.error('Batch create servers error:', error);
         res.status(500).json({
             success: false,
             message: 'Internal server error',
@@ -706,8 +754,7 @@ export const updateServer = async (req, res) => {
             return;
         }
         // Set default keep-alive interval for SSE servers if not specified
-        if ((normalizedConfig.type === 'sse' ||
-            (!normalizedConfig.type && normalizedConfig.url)) &&
+        if ((normalizedConfig.type === 'sse' || (!normalizedConfig.type && normalizedConfig.url)) &&
             !normalizedConfig.keepAliveInterval) {
             normalizedConfig.keepAliveInterval = 60000; // Default 60 seconds for SSE servers
         }
@@ -715,19 +762,32 @@ export const updateServer = async (req, res) => {
         assignServerOwner(req, normalizedConfig, existingServer.owner);
         // Check if server name is being changed
         const isRenaming = newName && newName !== name;
+        // Final server name used for the rest of the update flow (the new name when
+        // renaming, otherwise the original name).
+        let finalName = name;
         // If renaming, validate the new name and update references
         if (isRenaming) {
             const serverDao = getServerDao();
+            const nameValidation = validateServerName(newName);
+            if (!nameValidation.valid) {
+                res.status(400).json({
+                    success: false,
+                    message: nameValidation.message,
+                });
+                return;
+            }
+            const targetName = nameValidation.normalized;
+            finalName = targetName;
             // Check if new name already exists
-            if (await serverDao.exists(newName)) {
+            if (await serverDao.exists(targetName)) {
                 res.status(400).json({
                     success: false,
-                    message: `Server name '${newName}' already exists`,
+                    message: `Server name '${targetName}' already exists`,
                 });
                 return;
             }
             // Rename the server
-            const renamed = await serverDao.rename(name, newName);
+            const renamed = await serverDao.rename(name, targetName);
             if (!renamed) {
                 res.status(404).json({
                     success: false,
@@ -743,10 +803,10 @@ export const updateServer = async (req, res) => {
             closeServer(name);
             // Update references in groups
             const groupDao = getGroupDao();
-            await groupDao.updateServerName(name, newName);
+            await groupDao.updateServerName(name, targetName);
             // Update references in bearer keys
             const bearerKeyDao = getBearerKeyDao();
-            await bearerKeyDao.updateServerName(name, newName);
+            await bearerKeyDao.updateServerName(name, targetName);
             // Drop embeddings stored under the old name so search_tools does not
             // advertise phantom tools; addOrUpdateServer below regenerates them
             // under the new name. A failure here must not abort the rename.
@@ -754,14 +814,12 @@ export const updateServer = async (req, res) => {
                 await removeServerToolEmbeddings(name);
             }
             catch (error) {
-                console.warn('Failed to remove embeddings for renamed server', {
+                logger.warn('Failed to remove embeddings for renamed server', {
                     serverName: name,
                     error,
                 });
             }
         }
-        // Use the final server name (new name if renaming, otherwise original name)
-        const finalName = isRenaming ? newName : name;
         // Fast path: if no connection-relevant field changed, persist and update
         // in-memory access metadata without tearing down the runtime. This covers
         // visibility/sharedWithUsers edits, description-only edits, owner changes,
@@ -823,15 +881,34 @@ export const updateServer = async (req, res) => {
 export const getServerConfig = async (req, res) => {
     try {
         const { name } = req.params;
-        const serverConfig = await loadAuthorizedServer(req, res, name);
-        if (!serverConfig) {
+        const serverDao = getServerDao();
+        const serverRecord = await serverDao.findById(name);
+        if (!serverRecord) {
+            res.status(404).json({
+                success: false,
+                message: 'Server not found',
+            });
+            return;
+        }
+        // #1036 Phase 1: config read and server use are separate decisions.
+        // Owner/admin get the full configuration; visibility-admitted shared users
+        // (public / group members) get a safe view without secret-bearing fields;
+        // everyone else is rejected exactly as before.
+        const principal = getRequestUser(req);
+        const canReadFullConfig = authorizationService.can('server.config.read', serverRecord, principal);
+        if (!canReadFullConfig && !authorizationService.can('server.invoke', serverRecord, principal)) {
+            res.status(403).json({
+                success: false,
+                message: 'Forbidden',
+            });
             return;
         }
         // Get runtime info (status, tools) from getServersInfo
         const allServers = await getServersInfo();
         const serverInfo = allServers.find((s) => s.name === name);
         // Extract config without the name field
-        const { name: serverName, ...config } = serverConfig;
+        const { name: serverName, ...config } = serverRecord;
+        const presented = presentServerForPrincipal(config, principal);
         // OpenAPI tools can carry circular $ref cycles left by SwaggerParser.dereference
         // (recursive schemas), which would make res.json throw. Mirror the list endpoint
         // and sanitize via createSafeJSON. See #959.
@@ -841,13 +918,13 @@ export const getServerConfig = async (req, res) => {
                 name: serverName,
                 status: serverInfo?.status || 'disconnected',
                 tools: serverInfo?.tools || [],
-                config,
+                config: presented.data,
             }),
         };
         res.json(response);
     }
     catch (error) {
-        console.error('Failed to get server configuration:', error);
+        logger.error('Failed to get server configuration:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to get server configuration',
@@ -929,7 +1006,7 @@ export const reloadServer = async (req, res) => {
         });
     }
     catch (error) {
-        console.error('Failed to reload server:', error);
+        logger.error('Failed to reload server:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to reload server',
@@ -976,7 +1053,7 @@ export const disconnectServerOAuth = async (req, res) => {
         });
     }
     catch (error) {
-        console.error('Failed to disconnect server OAuth:', error);
+        logger.error('Failed to disconnect server OAuth:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to disconnect server OAuth',
@@ -1005,11 +1082,10 @@ export const reinstallServerHandler = async (req, res) => {
         });
     }
     catch (error) {
-        console.error('Failed to reinstall server:', error);
+        logger.error('Failed to reinstall server:', error);
         const message = error instanceof Error ? error.message : 'Failed to reinstall server';
         // Validation errors (unsupported command, disabled server) → 400
-        if (message.includes('does not support cache refresh') ||
-            message.includes('disabled server')) {
+        if (message.includes('does not support cache refresh') || message.includes('disabled server')) {
             res.status(400).json({ success: false, message });
         }
         else {
@@ -1036,7 +1112,7 @@ export const clearCache = async (req, res) => {
         });
     }
     catch (error) {
-        console.error('Failed to clear cache:', error);
+        logger.error('Failed to clear cache:', error);
         res.status(500).json({
             success: false,
             message: 'Failed to clear cache',
@@ -1050,7 +1126,7 @@ export const toggleTool = async (req, res) => {
         const serverName = decodeURIComponent(req.params.serverName);
         const toolName = decodeURIComponent(req.params.toolName);
         const { enabled } = req.body;
-        if (!serverName || !toolName) {
+        if (!serverName || !toolName || ['__proto__', 'constructor', 'prototype'].includes(toolName)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and tool name are required',
@@ -1103,7 +1179,7 @@ export const updateToolDescription = async (req, res) => {
         const serverName = decodeURIComponent(req.params.serverName);
         const toolName = decodeURIComponent(req.params.toolName);
         const { description } = req.body;
-        if (!serverName || !toolName) {
+        if (!serverName || !toolName || ['__proto__', 'constructor', 'prototype'].includes(toolName)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and tool name are required',
@@ -1158,7 +1234,7 @@ export const resetToolDescription = async (req, res) => {
     try {
         const serverName = decodeURIComponent(req.params.serverName);
         const toolName = decodeURIComponent(req.params.toolName);
-        if (!serverName || !toolName) {
+        if (!serverName || !toolName || ['__proto__', 'constructor', 'prototype'].includes(toolName)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and tool name are required',
@@ -1546,7 +1622,8 @@ export const updateSystemConfig = async (req, res) => {
                 systemConfig.smartRouting.azureOpenaiApiKey = smartRouting.azureOpenaiApiKey?.trim();
             }
             if (typeof smartRouting.azureOpenaiApiVersion === 'string') {
-                systemConfig.smartRouting.azureOpenaiApiVersion = smartRouting.azureOpenaiApiVersion?.trim();
+                systemConfig.smartRouting.azureOpenaiApiVersion =
+                    smartRouting.azureOpenaiApiVersion?.trim();
             }
             if (typeof smartRouting.azureOpenaiEmbeddingDeployment === 'string') {
                 systemConfig.smartRouting.azureOpenaiEmbeddingDeployment =
@@ -1760,15 +1837,15 @@ export const updateSystemConfig = async (req, res) => {
             });
             // If smart routing configuration changed, sync all existing server tools
             if (needsSync) {
-                console.log('SmartRouting configuration changed - syncing all existing server tools...');
+                logger.log('SmartRouting configuration changed - syncing all existing server tools...');
                 // Run sync asynchronously to avoid blocking the response
                 syncAllServerToolsEmbeddings().catch((error) => {
-                    console.error('Failed to sync server tools embeddings:', error);
+                    logger.error('Failed to sync server tools embeddings:', error);
                 });
             }
         }
         catch (saveError) {
-            console.error('Failed to save system configuration:', saveError);
+            logger.error('Failed to save system configuration:', saveError);
             res.status(500).json({
                 success: false,
                 message: 'Failed to save system configuration',
@@ -1789,7 +1866,9 @@ export const togglePrompt = async (req, res) => {
         const serverName = decodeURIComponent(req.params.serverName);
         const promptName = decodeURIComponent(req.params.promptName);
         const { enabled } = req.body;
-        if (!serverName || !promptName) {
+        if (!serverName ||
+            !promptName ||
+            ['__proto__', 'constructor', 'prototype'].includes(promptName)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and prompt name are required',
@@ -1842,7 +1921,9 @@ export const updatePromptDescription = async (req, res) => {
         const serverName = decodeURIComponent(req.params.serverName);
         const promptName = decodeURIComponent(req.params.promptName);
         const { description } = req.body;
-        if (!serverName || !promptName) {
+        if (!serverName ||
+            !promptName ||
+            ['__proto__', 'constructor', 'prototype'].includes(promptName)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and prompt name are required',
@@ -1895,7 +1976,9 @@ export const resetPromptDescription = async (req, res) => {
     try {
         const serverName = decodeURIComponent(req.params.serverName);
         const promptName = decodeURIComponent(req.params.promptName);
-        if (!serverName || !promptName) {
+        if (!serverName ||
+            !promptName ||
+            ['__proto__', 'constructor', 'prototype'].includes(promptName)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and prompt name are required',
@@ -1941,7 +2024,9 @@ export const toggleResource = async (req, res) => {
         const serverName = decodeURIComponent(req.params.serverName);
         const resourceUri = decodeURIComponent(req.params.resourceUri);
         const { enabled } = req.body;
-        if (!serverName || !resourceUri) {
+        if (!serverName ||
+            !resourceUri ||
+            ['__proto__', 'constructor', 'prototype'].includes(resourceUri)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and resource URI are required',
@@ -1994,7 +2079,9 @@ export const updateResourceDescription = async (req, res) => {
         const serverName = decodeURIComponent(req.params.serverName);
         const resourceUri = decodeURIComponent(req.params.resourceUri);
         const { description } = req.body;
-        if (!serverName || !resourceUri) {
+        if (!serverName ||
+            !resourceUri ||
+            ['__proto__', 'constructor', 'prototype'].includes(resourceUri)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and resource URI are required',
@@ -2047,7 +2134,9 @@ export const resetResourceDescription = async (req, res) => {
     try {
         const serverName = decodeURIComponent(req.params.serverName);
         const resourceUri = decodeURIComponent(req.params.resourceUri);
-        if (!serverName || !resourceUri) {
+        if (!serverName ||
+            !resourceUri ||
+            ['__proto__', 'constructor', 'prototype'].includes(resourceUri)) {
             res.status(400).json({
                 success: false,
                 message: 'Server name and resource URI are required',