@sanctuary-framework/mcp-server 0.10.5 → 0.10.6

package/dist/index.js

@@ -6602,6 +6602,11 @@ function generateDashboardHTML(options) {
     // SEC-038: Do NOT embed the long-lived auth token in page source.
     // Use only the session token stored in sessionStorage by the login flow.
     const AUTH_TOKEN = sessionStorage.getItem('authToken') || '';
+    // v0.10.6: server-baked flag mirroring _autoAuthLocalhost. When true,
+    // the init-time auth gate does NOT redirect to '/' on empty AUTH_TOKEN,
+    // because the server already admitted this loopback caller without a
+    // bearer token. See dashboard-html.ts generateDashboardHTML() doc.
+    const LOOPBACK_AUTH = ${JSON.stringify(options.loopbackAutoAuth === true)};
     const TIMEOUT_SECONDS = ${options.timeoutSeconds};
     const API_BASE = '';
 
@@ -7709,7 +7714,13 @@ function generateDashboardHTML(options) {
 
     // Initialize
     async function initialize() {
-      if (!AUTH_TOKEN) {
+      // v0.10.6: gate on BOTH sessionStorage and the server-baked loopback
+      // auto-auth mirror. Pre-fix, a fresh loopback tab had empty
+      // sessionStorage.authToken AND was admitted by the server via
+      // _autoAuthLocalhost \u2014 this single-operand gate redirected to '/'
+      // which reloaded the same page, which redirected again, infinitely.
+      // See generateDashboardHTML() header comment for full threat model.
+      if (!AUTH_TOKEN && !LOOPBACK_AUTH) {
         redirectToLogin();
         return;
       }
@@ -8735,7 +8746,11 @@ var DashboardApprovalChannel = class {
     this.sessionTTLMs = isLocalhost ? SESSION_TTL_LOCAL_MS : SESSION_TTL_REMOTE_MS;
     this.dashboardHTML = generateDashboardHTML({
       timeoutSeconds: config.timeout_seconds,
-      serverVersion: SANCTUARY_VERSION
+      serverVersion: SANCTUARY_VERSION,
+      // Construction-time default; real value is set by setAutoAuthLocalhost()
+      // below (which regenerates this HTML). Default false preserves the
+      // pre-v0.10.6 remote-deployment behavior when auto-auth is not enabled.
+      loopbackAutoAuth: this._autoAuthLocalhost
     });
     this.loginHTML = generateLoginHTML({ serverVersion: SANCTUARY_VERSION });
     this.sessionCleanupTimer = setInterval(() => this.cleanupSessions(), 6e4);
@@ -8771,6 +8786,11 @@ var DashboardApprovalChannel = class {
    */
   setAutoAuthLocalhost(enabled) {
     this._autoAuthLocalhost = enabled;
+    this.dashboardHTML = generateDashboardHTML({
+      timeoutSeconds: this.config.timeout_seconds,
+      serverVersion: SANCTUARY_VERSION,
+      loopbackAutoAuth: this._autoAuthLocalhost
+    });
   }
   /**
    * v0.10.2: is this request from a loopback interface? We treat the