@synoikia/core 0.9.0 → 0.10.1

package/dist/settings.js

@@ -1,9 +1,10 @@
 import { eq } from 'drizzle-orm';
 import { z } from 'zod';
 import { writeAudit } from './audit.js';
+import { EXTERNAL_PROVIDER_IDS, externalProvider } from './auth/external.js';
 import { settings } from './db/schema.js';
 import { ValidationError } from './errors.js';
-import { cleanStored, parseLeniently } from './lenient.js';
+import { cleanStored } from './lenient.js';
 /** Global settings (design §8.2 "Settings"), one JSON document per section in the `settings` table. */
 const SETTINGS_SCHEMAS = {
     security: z
@@ -24,7 +25,7 @@ const SETTINGS_SCHEMAS = {
             .min(1)
             .max(24 * 30)
             .default(12),
-        /** Approval-page sign-in on the MCP port (design §5.3): TOTP once per browser for this long. */
+        /** Approval-page sign-in on the MCP port (design §5.3): how long one browser stays signed in. */
         approvalSessionIdleHours: z
             .number()
             .int()
@@ -40,12 +41,18 @@ const SETTINGS_SCHEMAS = {
         .prefault({}),
     mcp: z
         .object({
-        defaultAuthMode: z.enum(['external', 'bearer', 'oauth', 'bearer+oauth']).default('bearer+oauth'),
+        /** Client auth methods enabled on the MCP port (design §6.2); an endpoint can only narrow them. */
+        clientAuth: z
+            .object({
+            bearer: z.boolean().default(true),
+            oauth: z.boolean().default(true),
+            external: z.boolean().default(false),
+        })
+            .prefault({}),
+        external: z.object({ provider: z.enum(EXTERNAL_PROVIDER_IDS).default('cloudflare') }).prefault({}),
         allowDynamicRegistration: z.boolean().default(true),
-        /** Cloudflare Access JWT verification for `external` mode. */
+        /** The Cloudflare Access provider's application (design §6.2). */
         cfAccess: z.object({ teamDomain: z.string().default(''), aud: z.string().default('') }).prefault({}),
-        /** Header set by an auth proxy (Authelia/Authentik) used only to attribute calls in `external` mode. */
-        trustedIdentityHeader: z.string().default(''),
         accessTokenTtlMinutes: z
             .number()
             .int()
@@ -57,18 +64,47 @@ const SETTINGS_SCHEMAS = {
         .prefault({}),
     audit: z
         .object({
-        /** Unset = keep forever (design §10). */
-        retentionDays: z.number().int().min(7).nullable().default(null),
+        /** Null = keep forever (design §10). */
+        retentionDays: z.number().int().min(7).nullable().default(90),
     })
         .prefault({}),
 };
+/** Rules across fields of `mcp`, checked on save only: stored values stay readable as they are. */
+function mcpProblems(value) {
+    const problems = [];
+    if (!Object.values(value.clientAuth).some(Boolean))
+        problems.push('clientAuth: enable at least one method');
+    const provider = externalProvider(value);
+    if (value.clientAuth.external && !provider.configured(value))
+        problems.push(`external: configure ${provider.name} before you enable external auth`);
+    return problems;
+}
 export function isSettingsSection(name) {
     return Object.prototype.hasOwnProperty.call(SETTINGS_SCHEMAS, name);
 }
+/** Stored fields that read as off, not as their open defaults, when they can't be read (design §6.2). */
+const FAIL_CLOSED = {
+    mcp: { clientAuth: { bearer: false, oauth: false, external: false } },
+};
+/** Fields an earlier release stored that a save now refuses, so a stale client can't lose them silently. */
+const RETIRED = {
+    mcp: ['defaultAuthMode', 'trustedIdentityHeader'],
+};
+const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/** The lenient read of a stored section, with {@link FAIL_CLOSED} fields closed when dropped. */
+function readStored(section, raw) {
+    const schema = SETTINGS_SCHEMAS[section];
+    const result = cleanStored(schema, raw, `settings.${section}`);
+    const closed = Object.entries(FAIL_CLOSED[section] ?? {}).filter(([key]) => result.dropped.some((p) => p === '*' || p === key || p.startsWith(`${key}.`)));
+    if (!closed.length)
+        return { ...result, value: result.value };
+    const cleaned = { ...(isPlainObject(result.cleaned) ? result.cleaned : {}), ...Object.fromEntries(closed) };
+    return { value: schema.parse(cleaned), cleaned, dropped: result.dropped };
+}
 /** Stored settings are read leniently: a field a newer schema rejects falls back to its default. */
 export function getSettings(db, section) {
     const row = db.select().from(settings).where(eq(settings.key, section)).get();
-    return parseLeniently(SETTINGS_SCHEMAS[section], row?.value, `settings.${section}`);
+    return readStored(section, row?.value).value;
 }
 /** Startup: removes stored settings fields the schema rejects, once; valid fields stay as stored. */
 export function normalizeStoredSettings(db) {
@@ -76,7 +112,7 @@ export function normalizeStoredSettings(db) {
     for (const row of db.select().from(settings).all()) {
         if (!isSettingsSection(row.key))
             continue;
-        const { cleaned, dropped } = cleanStored(SETTINGS_SCHEMAS[row.key], row.value, `settings.${row.key}`);
+        const { cleaned, dropped } = readStored(row.key, row.value);
         if (!dropped.length)
             continue;
         db.update(settings).set({ value: cleaned }).where(eq(settings.key, row.key)).run();
@@ -86,10 +122,22 @@ export function normalizeStoredSettings(db) {
 }
 export function updateSettings(db, section, patch, actor = {}) {
     const before = getSettings(db, section);
-    const parsed = SETTINGS_SCHEMAS[section].safeParse({ ...before, ...patch });
+    const retired = (RETIRED[section] ?? []).filter((k) => isPlainObject(patch) && k in patch);
+    if (retired.length)
+        throw new ValidationError('invalid_settings', 'Invalid settings', retired.map((k) => `${k}: no longer supported`));
+    // Nested objects merge with the stored ones, so a partial save keeps the fields it leaves out.
+    const merged = { ...before };
+    for (const [key, value] of Object.entries(isPlainObject(patch) ? patch : {})) {
+        const stored = merged[key];
+        merged[key] = isPlainObject(stored) && isPlainObject(value) ? { ...stored, ...value } : value;
+    }
+    const parsed = SETTINGS_SCHEMAS[section].safeParse(merged);
     if (!parsed.success) {
         throw new ValidationError('invalid_settings', 'Invalid settings', parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`));
     }
+    const problems = section === 'mcp' ? mcpProblems(parsed.data) : [];
+    if (problems.length)
+        throw new ValidationError('invalid_settings', 'Invalid settings', problems);
     db.transaction((tx) => {
         tx.insert(settings)
             .values({ key: section, value: parsed.data })

package/dist/settings.js.map

@@ -1 +1 @@
-{"version":3,"file":"settings.js","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3D,uGAAuG;AAEvG,MAAM,gBAAgB,GAAG;IACvB,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,qDAAqD;QACrD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,iGAAiG;QACjG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,kBAAkB,EAAE,CAAC;aAClB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;aACZ,OAAO,CAAC,EAAE,CAAC;QACd,oBAAoB,EAAE,CAAC;aACpB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;aACZ,OAAO,CAAC,EAAE,CAAC;QACd,gGAAgG;QAChG,wBAAwB,EAAE,CAAC;aACxB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;aACX,OAAO,CAAC,EAAE,CAAC;QACd,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,qFAAqF;QACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACjE,2EAA2E;QAC3E,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAChG,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,8DAA8D;QAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpG,wGAAwG;QACxG,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,qBAAqB,EAAE,CAAC;aACrB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;aACZ,OAAO,CAAC,EAAE,CAAC;QACd,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAClE,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,yCAAyC;QACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAChE,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;CACP,CAAC;AAKX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAA4B,EAAM,EAAE,OAAU;IACvE,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9E,OAAO,cAAc,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,YAAY,OAAO,EAAE,CAAgB,CAAC;AACrG,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,uBAAuB,CAAC,EAAM;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtG,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC9B,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,EAAM,EACN,OAAU,EACV,KAAc,EACd,QAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,GAAI,KAAgB,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aACzE,GAAG,EAAE,CAAC;QACT,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,kBAAkB;YAC5B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAmB,CAAC;AACpC,CAAC"}
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../src/settings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE7E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,uGAAuG;AAEvG,MAAM,gBAAgB,GAAG;IACvB,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,qDAAqD;QACrD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,iGAAiG;QACjG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7C,kBAAkB,EAAE,CAAC;aAClB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;aACZ,OAAO,CAAC,EAAE,CAAC;QACd,oBAAoB,EAAE,CAAC;aACpB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;aACZ,OAAO,CAAC,EAAE,CAAC;QACd,iGAAiG;QACjG,wBAAwB,EAAE,CAAC;aACxB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;aACX,OAAO,CAAC,EAAE,CAAC;QACd,2BAA2B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,qFAAqF;QACrF,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACjE,2EAA2E;QAC3E,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,mGAAmG;QACnG,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAChC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;SACrC,CAAC;aACD,QAAQ,CAAC,EAAE,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClG,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,kEAAkE;QAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpG,qBAAqB,EAAE,CAAC;aACrB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;aACZ,OAAO,CAAC,EAAE,CAAC;QACd,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAClE,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,wCAAwC;QACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KAC9D,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;CACP,CAAC;AAKX,mGAAmG;AACnG,SAAS,WAAW,CAAC,KAAsB;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAC5G,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,IAAI,kCAAkC,CAAC,CAAC;IACxF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,yGAAyG;AACzG,MAAM,WAAW,GAAyD;IACxE,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;CACtE,CAAC;AAEF,4GAA4G;AAC5G,MAAM,OAAO,GAA0C;IACrD,GAAG,EAAE,CAAC,iBAAiB,EAAE,uBAAuB,CAAC;CAClD,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,CAAU,EAAgC,EAAE,CACjE,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAE3D,iGAAiG;AACjG,SAAS,UAAU,CAA4B,OAAU,EAAE,GAAY;IACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CACzE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAC9E,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAoB,EAAE,CAAC;IAC7E,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5G,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AAC3F,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAA4B,EAAM,EAAE,OAAU;IACvE,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9E,OAAO,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC;AAC/C,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,uBAAuB,CAAC,EAAM;IAC5C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1C,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC9B,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,EAAM,EACN,OAAU,EACV,KAAc,EACd,QAA6B,EAAE;IAE/B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,EAClB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAChD,CAAC;IACJ,+FAA+F;IAC/F,MAAM,MAAM,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;IACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,kBAAkB,EAClB,kBAAkB,EAClB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;IACjG,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE;QACpB,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;aAC5C,kBAAkB,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;aACzE,GAAG,EAAE,CAAC;QACT,UAAU,CAAC,EAAE,EAAE;YACb,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,kBAAkB;YAC5B,SAAS,EAAE,MAAM;YACjB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE;SAChD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAmB,CAAC;AACpC,CAAC"}

package/drizzle/0016_client_auth_methods.sql

@@ -0,0 +1,55 @@
+ALTER TABLE `plugin_instances` ADD `auth_methods` text;--> statement-breakpoint
+-- The old auth modes become method lists, and nothing gains a method. External mode without Cloudflare Access
+-- relied on the removed trusted header: it gets no method, so it refuses calls until an admin sets one.
+CREATE TEMP TABLE `__client_auth_0016` AS
+WITH `old` AS (
+  SELECT (SELECT CASE WHEN json_valid(`value`) THEN `value` END FROM `settings` WHERE `key` = 'mcp') AS `v`
+), `base` AS (
+  SELECT
+    coalesce(json_extract(`v`, '$.cfAccess.teamDomain'), '') != ''
+      AND coalesce(json_extract(`v`, '$.cfAccess.aud'), '') != '' AS `cf`,
+    CASE WHEN json_extract(`v`, '$.defaultAuthMode') IN ('external', 'bearer', 'oauth', 'bearer+oauth')
+      THEN json_extract(`v`, '$.defaultAuthMode') ELSE 'bearer+oauth' END AS `d`
+  FROM `old`
+)
+SELECT `cf`, `d`,
+  `d` IN ('bearer', 'bearer+oauth') AS `d_bearer`,
+  `d` IN ('oauth', 'bearer+oauth') AS `d_oauth`,
+  `d` = 'external' AND `cf` AS `d_external`,
+  `d` IN ('bearer', 'bearer+oauth')
+    OR EXISTS (SELECT 1 FROM `plugin_instances` WHERE `auth_mode` IN ('bearer', 'bearer+oauth')) AS `g_bearer`,
+  `d` IN ('oauth', 'bearer+oauth')
+    OR EXISTS (SELECT 1 FROM `plugin_instances` WHERE `auth_mode` IN ('oauth', 'bearer+oauth')) AS `g_oauth`,
+  `cf` AND (`d` = 'external' OR EXISTS (SELECT 1 FROM `plugin_instances` WHERE `auth_mode` = 'external')) AS `g_external`
+FROM `base`;--> statement-breakpoint
+UPDATE `plugin_instances` SET `auth_methods` = CASE `auth_mode`
+  WHEN 'bearer' THEN '["bearer"]'
+  WHEN 'oauth' THEN '["oauth"]'
+  WHEN 'bearer+oauth' THEN '["bearer","oauth"]'
+  WHEN 'external' THEN CASE WHEN (SELECT `cf` FROM `__client_auth_0016`) THEN '["external"]' ELSE '[]' END
+  ELSE '[]' END
+WHERE `auth_mode` IS NOT NULL;--> statement-breakpoint
+-- An endpoint that inherited the old default keeps exactly its methods when the new global set is wider,
+-- or when the old default gave it none.
+UPDATE `plugin_instances` SET `auth_methods` = (
+  SELECT CASE `d`
+    WHEN 'bearer' THEN '["bearer"]'
+    WHEN 'oauth' THEN '["oauth"]'
+    WHEN 'bearer+oauth' THEN '["bearer","oauth"]'
+    ELSE CASE WHEN `cf` THEN '["external"]' ELSE '[]' END END
+  FROM `__client_auth_0016`)
+WHERE `auth_mode` IS NULL AND (SELECT
+    (`g_bearer` AND NOT `d_bearer`) OR (`g_oauth` AND NOT `d_oauth`) OR (`g_external` AND NOT `d_external`)
+    OR NOT (`d_bearer` OR `d_oauth` OR `d_external`)
+  FROM `__client_auth_0016`);--> statement-breakpoint
+-- The global methods are the old default and every endpoint's own mode, together.
+UPDATE `settings` SET `value` = json_set(
+  json_remove(`value`, '$.defaultAuthMode', '$.trustedIdentityHeader'),
+  '$.clientAuth', (SELECT json_object(
+    'bearer', json(CASE WHEN `g_bearer` THEN 'true' ELSE 'false' END),
+    'oauth', json(CASE WHEN `g_oauth` THEN 'true' ELSE 'false' END),
+    'external', json(CASE WHEN `g_external` THEN 'true' ELSE 'false' END)) FROM `__client_auth_0016`),
+  '$.external', json_object('provider', 'cloudflare'))
+WHERE `key` = 'mcp' AND json_valid(`value`);--> statement-breakpoint
+DROP TABLE `__client_auth_0016`;--> statement-breakpoint
+ALTER TABLE `plugin_instances` DROP COLUMN `auth_mode`;