@samanhappy/mcphub 1.0.36 → 1.0.37

package/dist/services/mcpService.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
+import { canAccessGroupRoute } from '../utils/groupAccess.js';
 import { PrincipalRuntimeService } from './principalRuntimeService.js';
 import { UserContextService } from './userContextService.js';
 import { deleteCredentialBindings, missingCredentialError } from './credentialBindingService.js';
@@ -1734,9 +1735,14 @@ export const getServersInfo = async (page, limit, user) => {
         const enabled = serverConfig ? serverConfig.enabled !== false : true;
         const resolvedType = inferServerType(serverConfig);
         const oauthConnected = Boolean(serverConfig?.oauth?.accessToken || serverConfig?.oauth?.refreshToken);
-        // Add enabled status and custom description to each tool
+        // Add enabled status and custom description to each tool.
+        // toggleTool stores under whatever key the caller passed (prefixed,
+        // as the dashboard sends, or bare, as a direct API call may) with no
+        // normalization — check both so the dashboard reflects a disable set
+        // either way instead of always showing enabled:true for one of them.
         const toolsWithEnabled = tools.map((tool) => {
-            const toolConfig = serverConfig?.tools?.[tool.name];
+            const bareToolName = normalizeToolNameForServer(name, tool.name);
+            const toolConfig = serverConfig?.tools?.[tool.name] ?? serverConfig?.tools?.[bareToolName];
             return buildToolWithDescriptionMetadata(tool, toolConfig);
         });
         const promptsWithEnabled = prompts.map((prompt) => {
@@ -1890,7 +1896,11 @@ const filterToolsByConfig = async (serverName, tools) => {
         return tools;
     }
     return tools.filter((tool) => {
-        const toolConfig = serverConfig.tools?.[tool.name];
+        // toggleTool stores the disable under whatever key string the caller used
+        // (bare upstream name or server-prefixed name, never normalized) — check
+        // both, same as findToolOnServer's execution-time gate.
+        const bareToolName = normalizeToolNameForServer(serverName, tool.name);
+        const toolConfig = serverConfig.tools?.[tool.name] ?? serverConfig.tools?.[bareToolName];
         // If tool is not in config, it's enabled by default
         return toolConfig?.enabled !== false;
     });
@@ -2482,8 +2492,36 @@ const resolveNameFromGroup = (name, serverName, serverConfig) => {
     return replacePrefixedServerName(name, getExposedServerName(serverName, serverConfig), serverName);
 };
 const findToolOnServer = (serverInfo, toolName, allowRawName) => {
-    return serverInfo.tools.find((tool) => tool.name === toolName ||
+    const tool = serverInfo.tools.find((tool) => tool.name === toolName ||
         (allowRawName && normalizeToolNameForServer(serverInfo.name, tool.name) === toolName));
+    if (!tool) {
+        return undefined;
+    }
+    // A tool disabled via POST /api/servers/:server/tools/:tool/toggle must be
+    // unresolvable for execution, not just hidden from tools/list — otherwise a
+    // caller who already knows the tool name can invoke it regardless of the
+    // disabled flag.
+    //
+    // The runtime tool cache (serverInfo.tools, built by normalizeToolForCache)
+    // never carries an `enabled` field — that field only exists on the
+    // *projection* built for the dashboard/API (buildToolWithDescriptionMetadata),
+    // which is a different object. So the persisted per-tool config must be
+    // consulted directly here.
+    //
+    // toggleTool (serverController.ts) stores `tools[toolName] = ...` using
+    // whatever string the caller passed as :toolName, with no normalization.
+    // The dashboard sends the already-prefixed `tool.name`, matching what
+    // getServersInfo's toolsWithEnabled already reads — but any other caller
+    // (REST API used directly, scripts, docs examples) can just as validly
+    // pass the bare upstream name, which then never matches a prefixed-only
+    // lookup. Check both so a disable takes effect regardless of which form
+    // was used to set it.
+    const bareToolName = normalizeToolNameForServer(serverInfo.name, tool.name);
+    const toolConfig = serverInfo.config?.tools?.[tool.name] ?? serverInfo.config?.tools?.[bareToolName];
+    if (toolConfig && toolConfig.enabled === false) {
+        return undefined;
+    }
+    return tool;
 };
 const assertToolAvailableForRoute = (tool, appsRouteContext) => {
     if (isAppOnlyTool(tool) && !appsRouteContext.enabled) {
@@ -3593,13 +3631,8 @@ export const createMcpServer = (name, version, options) => {
     return server;
 };
 export const getFilteredServerInfosForGroup = async (group, options) => {
-    // Resolve group server configs. We look up the group directly from the DAO
-    // rather than going through getServerConfigsInGroup (which calls getAllGroups
-    // and applies filterData on groups). Groups don't carry a visibility field,
-    // so admin-owned groups would be filtered out for non-admin users even though
-    // bearer-key auth already authorized access and individual servers inside the
-    // group may be public. Server-level filterData below still enforces per-server
-    // visibility. Fix for #914.
+    // Resolve raw groups so legacy routing remains compatible, then enforce explicit visibility.
+    let matchedGroup = false;
     let serverConfigs = [];
     if (group) {
         const groupDao = getGroupDao();
@@ -3611,6 +3644,10 @@ export const getFilteredServerInfosForGroup = async (group, options) => {
             }
         }
         if (foundGroup) {
+            matchedGroup = true;
+            if (!canAccessGroupRoute(foundGroup)) {
+                return { filteredServerInfos: [], serverConfigsByName: new Map() };
+            }
             serverConfigs = normalizeGroupServers(foundGroup.servers || []);
         }
     }
@@ -3626,7 +3663,7 @@ export const getFilteredServerInfosForGroup = async (group, options) => {
             filteredServerInfos.push(serverInfo);
             continue;
         }
-        if (serverNamesInGroup.size === 0) {
+        if (!matchedGroup) {
             if (serverInfo.name === group) {
                 filteredServerInfos.push(serverInfo);
             }