@samanhappy/mcphub 1.1.7 → 1.1.9

package/dist/controllers/serverController.js

@@ -1,9 +1,11 @@
+import { hasPersonalAuthentication } from '../utils/credentialTemplate.js';
+import { matchesNamePattern } from '../utils/namePattern.js';
 import { validateAllowedCidrs } from '../utils/ssrf.js';
 import { copyCredentialBindings, deleteCredentialBindings, } from '../services/credentialBindingService.js';
 import { StdioOptionsError } from '../utils/stdioOptions.js';
 import { CredentialBindingError } from '../utils/credentialTemplate.js';
 import { isDeepStrictEqual } from 'node:util';
-import { getServersInfo, addServer, addOrUpdateServer, removeServer, closeServer, getServerByName, notifyToolChanged, broadcastToolListChanged, broadcastPromptListChanged, broadcastResourceListChanged, syncToolEmbedding, toggleServerStatus, reconnectServer, reinstallServer, updateServerInfoVisibility, } from '../services/mcpService.js';
+import { getServersInfo, getServerToolsForPrincipal, addServer, addOrUpdateServer, removeServer, closeServer, getServerByName, notifyToolChanged, broadcastToolListChanged, broadcastPromptListChanged, broadcastResourceListChanged, syncToolEmbedding, toggleServerStatus, reconnectServer, reinstallServer, updateServerInfoVisibility, } from '../services/mcpService.js';
 import { clearAllCaches } from '../utils/cacheUtils.js';
 import { removeServerToolEmbeddings, syncAllServerToolsEmbeddings, } from '../services/vectorSearchService.js';
 import { createSafeJSON } from '../utils/serialization.js';
@@ -24,6 +26,9 @@ import { getSmartRoutingConfig, parseBooleanEnvVar, parseFullSchemaTopN, parseSi
 import { TOOL_DEFINITION_FIELDS } from '../constants/smartRoutingDefaults.js';
 import { previewOpenApiToolStats } from '../services/openApiToolStatsService.js';
 import { logger } from '../utils/logger.js';
+import { findToolConfigKey, resolveRuntimeToolName } from '../utils/toolConfig.js';
+// Runtime names of a connected server's tools, to resolve which tool a request means
+const liveToolNames = (serverName) => (getServerByName(serverName)?.tools ?? []).map((tool) => tool.name);
 const getRequestUser = (req) => {
     return req.user || null;
 };
@@ -65,7 +70,9 @@ const ensureNonAdminCanManageConfig = (req, res, config) => {
             success: false,
             message: config.oauth?.allowInsecureTokenEndpoint === true
                 ? 'Only admins can create or modify servers allowing HTTP OAuth token endpoints'
-                : 'Only admins can create or modify stdio-based servers',
+                : config.passthroughHeaders?.length || config.openapi?.passthroughHeaders?.length
+                    ? 'Only admins can create or modify servers forwarding caller headers'
+                    : 'Only admins can create or modify stdio-based servers',
         });
         return false;
     }
@@ -89,8 +96,10 @@ const clearDescriptionOverride = (items, itemName) => {
         return nextItems;
     }
     const { description: _description, ...remainingConfig } = itemConfig;
-    if (remainingConfig.enabled === false) {
-        nextItems[itemName] = { enabled: false };
+    // Keep the entry while it still says something: a disable or hidden parameters.
+    if (remainingConfig.enabled === false ||
+        Object.keys(remainingConfig).some((key) => key !== 'enabled')) {
+        nextItems[itemName] = remainingConfig;
     }
     else {
         delete nextItems[itemName];
@@ -645,7 +654,10 @@ export const batchCreateServers = async (req, res) => {
                         success: false,
                         message: normalizedConfig.oauth?.allowInsecureTokenEndpoint === true
                             ? 'Only admins can create or modify servers allowing HTTP OAuth token endpoints'
-                            : 'Only admins can create or modify stdio-based servers',
+                            : normalizedConfig.passthroughHeaders?.length ||
+                                normalizedConfig.openapi?.passthroughHeaders?.length
+                                ? 'Only admins can create or modify servers forwarding caller headers'
+                                : 'Only admins can create or modify stdio-based servers',
                     });
                     failureCount++;
                     continue;
@@ -873,7 +885,9 @@ export const updateServer = async (req, res) => {
         if (!existingServer) {
             return;
         }
-        if ((existingServer.oauth?.allowInsecureTokenEndpoint === true &&
+        if (((existingServer.oauth?.allowInsecureTokenEndpoint === true ||
+            Boolean(existingServer.passthroughHeaders?.length ||
+                existingServer.openapi?.passthroughHeaders?.length)) &&
             !ensureNonAdminCanManageConfig(req, res, existingServer)) ||
             !ensureNonAdminCanManageConfig(req, res, normalizedConfig)) {
             return;
@@ -1292,6 +1306,87 @@ export const clearCache = async (req, res) => {
         });
     }
 };
+// Set the status of currently discovered tools in one update.
+export const batchToggleTools = async (req, res) => {
+    try {
+        const serverName = req.params.serverName;
+        const { enabled, tools: patterns } = (req.body ?? {});
+        if (typeof enabled !== 'boolean' ||
+            !Array.isArray(patterns) ||
+            patterns.length === 0 ||
+            patterns.length > 100 ||
+            patterns.some((pattern) => typeof pattern !== 'string' || !pattern.trim() || pattern.length > 256)) {
+            res
+                .status(400)
+                .json({
+                success: false,
+                message: 'Provide enabled (boolean) and 1–100 non-empty tool names or patterns (up to 256 characters each)',
+            });
+            return;
+        }
+        const server = await loadAuthorizedServer(req, res, serverName);
+        if (!server)
+            return;
+        const liveServer = getServerByName(serverName);
+        let inventory = liveServer?.tools;
+        if (hasPersonalAuthentication(server)) {
+            const principal = getRequestUser(req);
+            // Never borrow another user's inventory or fall back to the global placeholder.
+            if (!principal) {
+                res.status(403).json({ success: false, message: 'Forbidden' });
+                return;
+            }
+            try {
+                inventory = await getServerToolsForPrincipal(serverName, principal);
+            }
+            catch {
+                res.status(409).json({
+                    success: false,
+                    message: 'Personal tool inventory is unavailable; connect with your personal authentication first',
+                });
+                return;
+            }
+        }
+        if (!inventory) {
+            res
+                .status(409)
+                .json({
+                success: false,
+                message: 'Server tool inventory is unavailable; connect the server first',
+            });
+            return;
+        }
+        const runtimeNames = inventory.map((tool) => tool.name);
+        const prefix = `${serverName}${getNameSeparator()}`;
+        const matchedTools = runtimeNames.filter((name) => patterns.some((pattern) => {
+            // Exact names follow the same runtime-first resolution as the single-tool API.
+            if (!pattern.includes('*') && !pattern.includes('?')) {
+                return resolveRuntimeToolName(serverName, pattern, runtimeNames) === name;
+            }
+            const bareName = name.startsWith(prefix) ? name.slice(prefix.length) : name;
+            return matchesNamePattern(name, pattern) || matchesNamePattern(bareName, pattern);
+        }));
+        if (matchedTools.length) {
+            const tools = { ...server.tools };
+            for (const name of matchedTools) {
+                const key = findToolConfigKey(tools, serverName, name, runtimeNames);
+                tools[key] = { ...tools[key], enabled };
+            }
+            if (!(await getServerDao().updateTools(serverName, tools))) {
+                res.status(500).json({ success: false, message: 'Failed to save settings' });
+                return;
+            }
+            if (liveServer?.config)
+                liveServer.config = { ...liveServer.config, tools };
+            notifyToolChanged();
+        }
+        const data = { matchedTools, enabled };
+        res.json({ success: true, data });
+    }
+    catch {
+        res.status(500).json({ success: false, message: 'Internal server error' });
+    }
+};
 // Toggle tool status for a specific server
 export const toggleTool = async (req, res) => {
     try {
@@ -1320,8 +1415,9 @@ export const toggleTool = async (req, res) => {
         const serverDao = getServerDao();
         // Initialize tools config if it doesn't exist
         const tools = server.tools || {};
-        // Set the tool's enabled state (preserve existing description if any)
-        tools[toolName] = { ...tools[toolName], enabled };
+        // Set the tool's enabled state in its existing entry (keeps description and hidden parameters)
+        const configKey = findToolConfigKey(tools, serverName, toolName, liveToolNames(serverName));
+        tools[configKey] = { ...tools[configKey], enabled };
         // Update via DAO (supports both file and database modes)
         const result = await serverDao.updateTools(serverName, tools);
         if (!result) {
@@ -1385,10 +1481,11 @@ export const updateToolDescription = async (req, res) => {
         // Initialize tools config if it doesn't exist
         const tools = server.tools || {};
         // Set the tool's description
-        if (!tools[toolName]) {
-            tools[toolName] = { enabled: true };
+        const configKey = findToolConfigKey(tools, serverName, toolName, liveToolNames(serverName));
+        if (!tools[configKey]) {
+            tools[configKey] = { enabled: true };
         }
-        tools[toolName].description = description;
+        tools[configKey].description = description;
         // Update via DAO (supports both file and database modes)
         const result = await serverDao.updateTools(serverName, tools);
         if (!result) {
@@ -1420,6 +1517,94 @@ export const updateToolDescription = async (req, res) => {
         });
     }
 };
+// Set the top-level input parameters of a tool that models do not see. An
+// empty list removes the setting.
+export const updateToolHiddenParams = async (req, res) => {
+    try {
+        const serverName = decodeURIComponent(req.params.serverName);
+        const toolName = decodeURIComponent(req.params.toolName);
+        const { hiddenParams } = req.body;
+        if (!serverName || !toolName || ['__proto__', 'constructor', 'prototype'].includes(toolName)) {
+            res.status(400).json({
+                success: false,
+                message: 'Server name and tool name are required',
+            });
+            return;
+        }
+        if (!Array.isArray(hiddenParams) ||
+            !hiddenParams.every((name) => typeof name === 'string' && name.length > 0)) {
+            res.status(400).json({
+                success: false,
+                message: 'hiddenParams must be an array of parameter names',
+            });
+            return;
+        }
+        const server = await loadAuthorizedServer(req, res, serverName);
+        if (!server) {
+            return;
+        }
+        // Checked against the live schema when the tool is known; a disconnected
+        // server's settings are stored as given, and required ones are never hidden.
+        // The dashboard sends the runtime (prefixed) name, a direct caller may send
+        // the bare one.
+        const runtimeName = resolveRuntimeToolName(serverName, toolName, liveToolNames(serverName));
+        const liveTool = getServerByName(serverName)?.tools?.find((tool) => tool.name === runtimeName);
+        if (liveTool) {
+            const schema = liveTool.inputSchema;
+            const required = Array.isArray(schema.required) ? schema.required : [];
+            const properties = schema.properties ?? {};
+            const invalid = hiddenParams.find((name) => required.includes(name) || !Object.prototype.hasOwnProperty.call(properties, name));
+            if (invalid) {
+                res.status(400).json({
+                    success: false,
+                    message: required.includes(invalid)
+                        ? `Parameter '${invalid}' is required and cannot be hidden`
+                        : `Tool ${toolName} has no parameter '${invalid}'`,
+                });
+                return;
+            }
+        }
+        // Write into the entry that already exists under either name, so a bare-name
+        // description and a prefixed-name hiddenParams never shadow each other.
+        const tools = { ...(server.tools || {}) };
+        const configKey = findToolConfigKey(tools, serverName, toolName, liveToolNames(serverName));
+        const { hiddenParams: _previous, ...toolConfig } = tools[configKey] ?? { enabled: true };
+        const nextConfig = hiddenParams.length
+            ? { ...toolConfig, hiddenParams: [...new Set(hiddenParams)] }
+            : toolConfig;
+        if (nextConfig.enabled !== false && Object.keys(nextConfig).every((key) => key === 'enabled')) {
+            delete tools[configKey];
+        }
+        else {
+            tools[configKey] = nextConfig;
+        }
+        const result = await getServerDao().updateTools(serverName, tools);
+        if (!result) {
+            res.status(500).json({
+                success: false,
+                message: 'Failed to save settings',
+            });
+            return;
+        }
+        const liveServer = getServerByName(serverName);
+        if (liveServer?.config) {
+            liveServer.config = { ...liveServer.config, tools };
+        }
+        notifyToolChanged();
+        syncToolEmbedding(serverName, toolName);
+        res.json({
+            success: true,
+            data: { hiddenParams: tools[configKey]?.hiddenParams ?? [] },
+            message: `Tool ${toolName} hidden parameters updated successfully`,
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            success: false,
+            message: 'Internal server error',
+        });
+    }
+};
 // Reset tool description override for a specific server back to the upstream default
 export const resetToolDescription = async (req, res) => {
     try {
@@ -1437,7 +1622,7 @@ export const resetToolDescription = async (req, res) => {
             return;
         }
         const serverDao = getServerDao();
-        const tools = clearDescriptionOverride(server.tools || {}, toolName);
+        const tools = clearDescriptionOverride(server.tools || {}, findToolConfigKey(server.tools, serverName, toolName, liveToolNames(serverName)));
         const result = await serverDao.updateTools(serverName, tools);
         if (!result) {
             res.status(500).json({
@@ -1577,6 +1762,7 @@ export const updateSystemConfig = async (req, res) => {
             !hasSessionRebuildUpdate &&
             !hasOAuthServerUpdate &&
             !hasBetterAuthUpdate &&
+            typeof auth?.allowRegistration !== 'boolean' &&
             !hasActivityLogUpdate &&
             !hasNetworkUpdate) {
             res.status(400).json({
@@ -2053,6 +2239,9 @@ export const updateSystemConfig = async (req, res) => {
                 target.dynamicRegistration = dynamicTarget;
             }
         }
+        if (typeof auth?.allowRegistration === 'boolean') {
+            systemConfig.auth.allowRegistration = auth.allowRegistration;
+        }
         if (auth?.betterAuth) {
             const target = systemConfig.auth.betterAuth;
             const providersTarget = target.providers || {};