@samanhappy/mcphub 1.2.0 → 1.2.2

package/dist/controllers/serverController.js

@@ -1,7 +1,7 @@
 import { validateToolPolicies } from '../utils/toolPolicy.js';
 import { hasPersonalAuthentication } from '../utils/credentialTemplate.js';
 import { matchesNamePattern } from '../utils/namePattern.js';
-import { validateAllowedCidrs } from '../utils/ssrf.js';
+import { validateAllowedCidrs, validateFakeIpExceptions } from '../utils/ssrf.js';
 import { copyCredentialBindings, deleteCredentialBindings, } from '../services/credentialBindingService.js';
 import { StdioOptionsError } from '../utils/stdioOptions.js';
 import { CredentialBindingError } from '../utils/credentialTemplate.js';
@@ -62,6 +62,18 @@ const loadAuthorizedServer = async (req, res, serverName) => {
     }
     return server;
 };
+// Tool, prompt and resource settings change what is exposed, not how upstream
+// servers connect, so their handlers only broadcast. The unscoped
+// notifyToolChanged() would re-initialize every enabled server that is not
+// connected and re-spawn its stdio process. See #938 and #1426.
+const broadcastPromptSettingsChanged = () => {
+    broadcastToolListChanged();
+    broadcastPromptListChanged();
+};
+const broadcastResourceSettingsChanged = () => {
+    broadcastToolListChanged();
+    broadcastResourceListChanged();
+};
 const ensureNonAdminCanManageConfig = (req, res, config) => {
     const currentUser = getRequestUser(req);
     if (currentUser?.isAdmin) {
@@ -750,7 +762,12 @@ export const deleteServer = async (req, res) => {
         }
         const result = await removeServer(existingServer.name);
         if (result.success) {
-            notifyToolChanged();
+            // removeServer already closed the server and dropped it from serverInfos.
+            // Only broadcast: a full re-init would reconnect every other server that
+            // is not connected (see #938).
+            broadcastToolListChanged();
+            broadcastPromptListChanged();
+            broadcastResourceListChanged();
             res.json({
                 success: true,
                 message: 'Server removed successfully',
@@ -1391,7 +1408,7 @@ export const batchToggleTools = async (req, res) => {
             }
             if (liveServer?.config)
                 liveServer.config = { ...liveServer.config, tools };
-            notifyToolChanged();
+            broadcastToolListChanged();
         }
         const data = { matchedTools, enabled };
         res.json({ success: true, data });
@@ -1440,19 +1457,15 @@ export const toggleTool = async (req, res) => {
             });
             return;
         }
-        // For an already-connected server, notifyToolChanged()'s full re-init pass
-        // takes the "already connected" shortcut and preserves the in-memory
-        // serverInfo verbatim (see registerAllTools) instead of applying the
-        // freshly-persisted tools config — so findToolOnServer's enabled check
-        // would keep seeing the pre-toggle state until the server reconnects for
-        // an unrelated reason. Patch the live config in place so the toggle takes
-        // effect immediately, without waiting for (or forcing) a reconnect.
+        // findToolOnServer's enabled check reads the in-memory serverInfo.config,
+        // which nothing reloads from settings while the server stays connected.
+        // Patch the live config in place so the toggle takes effect immediately,
+        // without waiting for (or forcing) a reconnect.
         const liveServer = getServerByName(serverName);
         if (liveServer?.config) {
             liveServer.config = { ...liveServer.config, tools };
         }
-        // Notify that tools have changed
-        notifyToolChanged();
+        broadcastToolListChanged();
         res.json({
             success: true,
             message: `Tool ${toolName} ${enabled ? 'enabled' : 'disabled'} successfully`,
@@ -1516,7 +1529,7 @@ export const updateToolDescription = async (req, res) => {
             liveServerForDescription.config = { ...liveServerForDescription.config, tools };
         }
         // Notify that tools have changed
-        notifyToolChanged();
+        broadcastToolListChanged();
         syncToolEmbedding(serverName, toolName);
         res.json({
             success: true,
@@ -1603,7 +1616,7 @@ export const updateToolHiddenParams = async (req, res) => {
         if (liveServer?.config) {
             liveServer.config = { ...liveServer.config, tools };
         }
-        notifyToolChanged();
+        broadcastToolListChanged();
         syncToolEmbedding(serverName, toolName);
         res.json({
             success: true,
@@ -1644,7 +1657,7 @@ export const resetToolDescription = async (req, res) => {
             });
             return;
         }
-        notifyToolChanged();
+        broadcastToolListChanged();
         syncToolEmbedding(serverName, toolName);
         const defaultDescription = getServerByName(serverName)?.tools.find((tool) => tool.name === toolName)?.description || '';
         res.json({
@@ -1673,6 +1686,16 @@ export const updateSystemConfig = async (req, res) => {
     }
     try {
         const { routing, install, smartRouting: requestSmartRouting, toolResultCompression, mcpRouter, nameSeparator, dashboardName, enableSessionRebuild, oauthServer, auth, activityLog, network, toolPolicies, } = req.body;
+        if (oauthServer?.approvalLifetime !== undefined &&
+            (!Number.isSafeInteger(oauthServer.approvalLifetime) ||
+                oauthServer.approvalLifetime <= 0 ||
+                oauthServer.approvalLifetime > 31536000)) {
+            res.status(400).json({
+                success: false,
+                message: 'approvalLifetime must be between 1 and 31536000 seconds',
+            });
+            return;
+        }
         if (toolPolicies !== undefined) {
             try {
                 validateToolPolicies(toolPolicies);
@@ -1692,11 +1715,24 @@ export const updateSystemConfig = async (req, res) => {
             });
             return;
         }
+        if (routing?.allowAuthorizationPassthrough !== undefined &&
+            typeof routing.allowAuthorizationPassthrough !== 'boolean') {
+            res.status(400).json({
+                success: false,
+                message: 'routing.allowAuthorizationPassthrough must be a boolean',
+            });
+            return;
+        }
         const hasNetworkUpdate = network !== undefined;
-        if (hasNetworkUpdate && (!network || !validateAllowedCidrs(network.allowedCidrs))) {
+        if (hasNetworkUpdate &&
+            (!network ||
+                (network.allowedCidrs === undefined && network.fakeIpExceptions === undefined) ||
+                (network.allowedCidrs !== undefined && !validateAllowedCidrs(network.allowedCidrs)) ||
+                (network.fakeIpExceptions !== undefined &&
+                    !validateFakeIpExceptions(network.fakeIpExceptions)))) {
             res.status(400).json({
                 success: false,
-                message: 'network.allowedCidrs must be an array of valid IPv4 or IPv6 CIDRs',
+                message: 'Invalid network allowedCidrs or fakeIpExceptions',
             });
             return;
         }
@@ -1707,6 +1743,7 @@ export const updateSystemConfig = async (req, res) => {
                 typeof routing.enableBearerAuth === 'boolean' ||
                 typeof routing.bearerAuthKey === 'string' ||
                 typeof routing.bearerAuthHeaderName === 'string' ||
+                typeof routing.allowAuthorizationPassthrough === 'boolean' ||
                 typeof routing.jsonBodyLimit === 'string' ||
                 typeof routing.skipAuth === 'boolean');
         const hasInstallUpdate = install &&
@@ -1754,7 +1791,9 @@ export const updateSystemConfig = async (req, res) => {
         const hasSessionRebuildUpdate = typeof enableSessionRebuild === 'boolean';
         const hasActivityLogUpdate = activityLog && typeof activityLog.storeToolPayload === 'boolean';
         const hasOAuthServerUpdate = oauthServer &&
-            (typeof oauthServer.enabled === 'boolean' ||
+            (typeof oauthServer.alwaysShowApprovalScreen === 'boolean' ||
+                typeof oauthServer.approvalLifetime === 'number' ||
+                typeof oauthServer.enabled === 'boolean' ||
                 typeof oauthServer.accessTokenLifetime === 'number' ||
                 typeof oauthServer.refreshTokenLifetime === 'number' ||
                 typeof oauthServer.authorizationCodeLifetime === 'number' ||
@@ -1946,6 +1985,9 @@ export const updateSystemConfig = async (req, res) => {
             if (typeof routing.bearerAuthHeaderName === 'string') {
                 systemConfig.routing.bearerAuthHeaderName = routing.bearerAuthHeaderName.trim();
             }
+            if (typeof routing.allowAuthorizationPassthrough === 'boolean') {
+                systemConfig.routing.allowAuthorizationPassthrough = routing.allowAuthorizationPassthrough;
+            }
             if (typeof routing.jsonBodyLimit === 'string') {
                 systemConfig.routing.jsonBodyLimit = routing.jsonBodyLimit.trim();
             }
@@ -2220,6 +2262,12 @@ export const updateSystemConfig = async (req, res) => {
         }
         if (oauthServer) {
             const target = systemConfig.oauthServer;
+            if (typeof oauthServer.alwaysShowApprovalScreen === 'boolean') {
+                target.alwaysShowApprovalScreen = oauthServer.alwaysShowApprovalScreen;
+            }
+            if (typeof oauthServer.approvalLifetime === 'number') {
+                target.approvalLifetime = oauthServer.approvalLifetime;
+            }
             if (typeof oauthServer.enabled === 'boolean') {
                 target.enabled = oauthServer.enabled;
             }
@@ -2358,7 +2406,15 @@ export const updateSystemConfig = async (req, res) => {
             };
         }
         if (hasNetworkUpdate) {
-            systemConfig.network = { allowedCidrs: [...new Set(network.allowedCidrs)] };
+            systemConfig.network = {
+                ...systemConfig.network,
+                ...(network.allowedCidrs !== undefined
+                    ? { allowedCidrs: [...new Set(network.allowedCidrs)] }
+                    : {}),
+                ...(network.fakeIpExceptions !== undefined
+                    ? { fakeIpExceptions: network.fakeIpExceptions }
+                    : {}),
+            };
         }
         if (toolPolicies !== undefined)
             systemConfig.toolPolicies = toolPolicies;
@@ -2436,8 +2492,8 @@ export const togglePrompt = async (req, res) => {
             });
             return;
         }
-        // Notify that tools have changed (as prompts are part of the tool listing)
-        notifyToolChanged();
+        // Notify that prompts have changed
+        broadcastPromptSettingsChanged();
         res.json({
             success: true,
             message: `Prompt ${promptName} ${enabled ? 'enabled' : 'disabled'} successfully`,
@@ -2494,8 +2550,8 @@ export const updatePromptDescription = async (req, res) => {
             });
             return;
         }
-        // Notify that tools have changed (as prompts are part of the tool listing)
-        notifyToolChanged();
+        // Notify that prompts have changed
+        broadcastPromptSettingsChanged();
         res.json({
             success: true,
             message: `Prompt ${promptName} description updated successfully`,
@@ -2535,7 +2591,7 @@ export const resetPromptDescription = async (req, res) => {
             });
             return;
         }
-        notifyToolChanged();
+        broadcastPromptSettingsChanged();
         const defaultDescription = getServerByName(serverName)?.prompts.find((prompt) => prompt.name === promptName)
             ?.description || '';
         res.json({
@@ -2595,7 +2651,7 @@ export const toggleResource = async (req, res) => {
             return;
         }
         // Notify that tools/resources metadata has changed
-        notifyToolChanged();
+        broadcastResourceSettingsChanged();
         res.json({
             success: true,
             message: `Resource ${resourceUri} ${enabled ? 'enabled' : 'disabled'} successfully`,
@@ -2653,7 +2709,7 @@ export const updateResourceDescription = async (req, res) => {
             return;
         }
         // Notify that tools/resources metadata has changed
-        notifyToolChanged();
+        broadcastResourceSettingsChanged();
         res.json({
             success: true,
             message: `Resource ${resourceUri} description updated successfully`,
@@ -2693,7 +2749,7 @@ export const resetResourceDescription = async (req, res) => {
             });
             return;
         }
-        notifyToolChanged();
+        broadcastResourceSettingsChanged();
         const defaultDescription = getServerByName(serverName)?.resources.find((resource) => resource.uri === resourceUri)
             ?.description || '';
         res.json({