actual-mcp-server 0.7.8 → 0.7.11

package/README.md

@@ -468,8 +468,11 @@ All configuration is via environment variables. Copy `.env.example` to `.env` to
 | **Security & Authentication** ||||
 | `AUTH_PROVIDER` | `none` | No | Auth mode: `none` (static Bearer) or `oidc` (JWKS-validated JWT) |
 | `MCP_SSE_AUTHORIZATION` | _(none)_ | No | Static Bearer token (`AUTH_PROVIDER=none`; highly recommended in production) |
+| `MCP_ALLOW_UNAUTHENTICATED` | `false` | No | Opt-out for required-by-default HTTP auth (#242). On a non-loopback bind with no token and no OIDC the server refuses to start; set to `true` to run open deliberately (e.g. behind your own proxy) |
 | `OIDC_ISSUER` | _(none)_ | If OIDC | OIDC issuer URL (e.g., `https://sso.example.com`) |
+| `OIDC_ALLOW_INSECURE_ISSUER` | `false` | No | Allow a plaintext (http) OIDC issuer on a trusted network (#244). Off by default (http issuer refused at startup); set `true` only for local/LAN testing |
 | `OIDC_RESOURCE` | _(none)_ | No | Expected `aud` claim in JWT (your client ID) |
+| `OIDC_ACCEPTED_AUDIENCES` | _(none)_ | No | Extra accepted `aud` values beyond `OIDC_RESOURCE`, comma-separated (#245). For IdPs that put the client-id in `aud` (e.g. Authentik). Strict allowlist, never a wildcard |
 | `OIDC_SCOPES` | _(none)_ | No | Comma-separated required scopes; leave empty for Casdoor |
 | `AUTH_BUDGET_ACL` | _(none)_ | No | Per-user budget ACL; see [AI Client Setup](docs/guides/AI_CLIENT_SETUP.md#oidc-authentication-multi-user) |
 | `MCP_ENABLE_HTTPS` | `false` | No | Enable native TLS. Requires `MCP_HTTPS_CERT` and `MCP_HTTPS_KEY` |
@@ -715,4 +718,4 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.7.8 | **Tool Count:** 71 (verified LibreChat-compatible)
+**Version:** 0.7.11 | **Tool Count:** 71 (verified LibreChat-compatible)

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "actual-mcp-server",
     "displayName": "Actual MCP Server",
-    "version": "0.7.8",
+    "version": "0.7.11",
     "engines": {
         "node": ">=22.0.0",
         "npm": ">=10.0.0"
@@ -30,14 +30,14 @@
         "verify-tools": "npm run build && node scripts/verify-tools.js",
         "check:coverage": "node scripts/list-actual-api-methods.mjs",
         "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-        "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
+        "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
         "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
         "test:e2e": "npx playwright test",
         "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",
         "test:e2e:docker:smoke": "./tests/e2e/run-docker-e2e.sh smoke",
         "test:e2e:docker:full": "./tests/e2e/run-docker-e2e.sh full",
         "test:all": "npm run test:adapter && npm run test:unit-js && npm run test:e2e:docker:smoke",
-        "test:mcp-client": "npm run build && node scripts/register-tsconfig-paths.js -- --http --test-mcp-client",
+        "test:mcp-client": "npm run build && MCP_ALLOW_UNAUTHENTICATED=true node scripts/register-tsconfig-paths.js -- --http --test-mcp-client",
         "test:integration": "MCP_TEST_LEVEL=sanity node tests/manual/index.js",
         "test:integration:sanity": "MCP_TEST_LEVEL=sanity node tests/manual/index.js",
         "test:integration:smoke": "MCP_TEST_LEVEL=smoke node tests/manual/index.js",

package/dist/src/config.js

@@ -13,6 +13,11 @@ export const configSchema = z.object({
     MCP_BRIDGE_PORT: z.string().default('3600'),
     MCP_TRANSPORT_MODE: z.enum(['--http']).default('--http'),
     MCP_SSE_AUTHORIZATION: z.string().optional(),
+    // #242: explicit opt-out for the required-by-default HTTP auth gate. When auth
+    // is unconfigured AND the bind is non-loopback, the server refuses to start
+    // unless this is the exact string 'true'. Strict parse (only 'true' enables)
+    // so a typo like 'yes'/'1' cannot silently leave the server open.
+    MCP_ALLOW_UNAUTHENTICATED: z.string().optional().transform(val => val === 'true'),
     MCP_ENABLE_HTTPS: z.string().optional().transform(val => val === 'true'),
     MCP_HTTPS_CERT: z.string().optional(),
     MCP_HTTPS_KEY: z.string().optional(),
@@ -28,8 +33,19 @@ export const configSchema = z.object({
     AUTH_PROVIDER: z.enum(['none', 'oidc']).default('none'),
     // OIDC issuer URL (e.g. https://auth.example.com/realms/myrealm). Required when AUTH_PROVIDER=oidc.
     OIDC_ISSUER: z.string().optional(),
+    // #244: escape hatch for a plaintext (http) OIDC issuer on a trusted network
+    // (e.g. a LAN Casdoor for local testing). Off by default: an http issuer is
+    // refused because a network attacker could swap the JWKS and forge tokens.
+    // Set to 'true' ONLY when the issuer hop is genuinely trusted. Mirrors
+    // ALLOW_INSECURE_UPSTREAM (#161). Loopback issuers never need this.
+    OIDC_ALLOW_INSECURE_ISSUER: z.string().optional().transform(val => val === 'true'),
     // This server's resource identifier URL (e.g. https://actual-mcp.example.com). Required when AUTH_PROVIDER=oidc.
     OIDC_RESOURCE: z.string().optional(),
+    // #245: extra accepted JWT audiences beyond OIDC_RESOURCE, comma-separated.
+    // For IdPs that put the client-id (not the resource URI) in `aud`, e.g. Authentik.
+    // Strict closed allowlist: the accepted set is OIDC_RESOURCE plus these; never a
+    // wildcard. Default empty, so single-audience deployments are unchanged.
+    OIDC_ACCEPTED_AUDIENCES: z.string().optional(),
     // Comma-separated required scopes (e.g. "read,write"). Optional.
     OIDC_SCOPES: z.string().optional(),
     // JSON map of principal → budget sync-ID list for per-user budget ACL.

package/dist/src/index.js

@@ -124,9 +124,10 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
         import('./actualConnection.js'),
         import('./lib/ActualMCPConnection.js'),
     ]);
-    const [{ startHttpServer }, { startStdioServer }, loggerModule, utilsModule, actualToolsManagerModule,] = await Promise.all([
+    const [{ startHttpServer }, { startStdioServer }, { enforceHttpAuthPosture }, loggerModule, utilsModule, actualToolsManagerModule,] = await Promise.all([
         import('./server/httpServer.js'),
         import('./server/stdioServer.js'),
+        import('./lib/authPosture.js'),
         import('./logger.js'),
         import('./utils.js'),
         import('./actualToolsManager.js'),
@@ -242,12 +243,31 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
                 }
             }
         }
+        // #242: the interface both the self-test and the normal HTTP path bind to.
+        const bindHost = process.env.MCP_BRIDGE_BIND_HOST || '0.0.0.0';
+        // #242: HTTP auth required-by-default. Decide ONCE, before binding, whether
+        // the configured posture is safe. On a non-loopback bind with no auth and no
+        // explicit opt-out this refuses startup (exit 1) rather than silently serving
+        // financial data open on the LAN. stdio mode never reaches this check.
+        if (useHttp || useTestMcpClient) {
+            const decision = enforceHttpAuthPosture({
+                bindHost,
+                hasStaticToken: !!process.env.MCP_SSE_AUTHORIZATION,
+                oidcEnabled: process.env.AUTH_PROVIDER === 'oidc',
+                allowUnauthenticated: process.env.MCP_ALLOW_UNAUTHENTICATED === 'true',
+            });
+            // enforceHttpAuthPosture already called process.exit(1) on 'refuse'. This
+            // explicit return makes the open-start path structurally unreachable even
+            // if process.exit were ever non-terminal, so we never bind on a refuse.
+            if (decision === 'refuse')
+                return;
+        }
         // If requested, run the MCP client-side tests now that all variables are ready
         if (useTestMcpClient) {
             logger.info('⚙️  --test-mcp-client specified, starting HTTP server and running client-side MCP tests...');
             // start server in http mode. Bind all interfaces by default (#239): advertisedUrl
             // uses the LAN IP (getLocalIp), so the self-test client must be able to reach it.
-            await startHttpServer(mcp, PORT, HTTP_PATH, capabilities, implementedTools, SERVER_DESCRIPTION, SERVER_INSTRUCTIONS, toolSchemas, version, process.env.MCP_BRIDGE_BIND_HOST || '0.0.0.0', advertisedUrl);
+            await startHttpServer(mcp, PORT, HTTP_PATH, capabilities, implementedTools, SERVER_DESCRIPTION, SERVER_INSTRUCTIONS, toolSchemas, version, bindHost, advertisedUrl);
             // dynamic import to avoid circular at top
             const { testMcpClient } = await import('./tests/testMcpClient.js');
             try {
@@ -284,7 +304,7 @@ Docs & source: https://github.com/agigante80/actual-mcp-server`);
             logger.info('Mode: HTTP');
             await startHttpServer(mcp, PORT, HTTP_PATH, capabilities, implementedTools, SERVER_DESCRIPTION, SERVER_INSTRUCTIONS, toolSchemas, version, 
             // bind host (ensure server accepts connections on that interface)
-            process.env.MCP_BRIDGE_BIND_HOST || '0.0.0.0', 
+            bindHost, 
             // advertised URL shown to clients
             advertisedUrl);
         }

package/dist/src/lib/authPosture.js

@@ -0,0 +1,91 @@
+import { createModuleLogger } from './loggerFactory.js';
+/**
+ * Auth posture gate (#242): make HTTP authentication required-by-default.
+ *
+ * Background: with AUTH_PROVIDER unset and a blank MCP_SSE_AUTHORIZATION the
+ * per-request gate in httpServer.ts serves every request, and the server binds
+ * 0.0.0.0 by default, so a forgotten token publishes a financial MCP server open
+ * on the LAN. This module decides ONCE at startup whether that posture is safe,
+ * before the socket is bound.
+ *
+ * We refuse startup (Option 1) rather than 401 per request (Option 2): a
+ * per-request loopback check would key on req.ip, which is attacker-suppliable
+ * via X-Forwarded-For once `trust proxy` is enabled behind the documented reverse
+ * proxy, turning the check into a spoofable bypass. The bind host is fixed config
+ * no client can influence, so deciding once at startup is the sound boundary.
+ */
+const logger = createModuleLogger('AUTH_POSTURE');
+/**
+ * True only for binds that never leave the local host: `localhost`, the entire
+ * IPv4 loopback block (127.0.0.0/8, so 127.0.0.2 counts, not just 127.0.0.1),
+ * IPv6 loopback in compressed and longhand form, and the IPv4-mapped IPv6
+ * loopback. `0.0.0.0` and `::` bind ALL interfaces (including non-loopback ones)
+ * so they are exposed, not loopback. An empty or undefined host is treated as
+ * exposed (fail-safe): the real runtime default is `0.0.0.0`.
+ */
+export function isLoopbackHost(host) {
+    if (!host)
+        return false;
+    const h = host.trim().toLowerCase();
+    if (h === 'localhost')
+        return true;
+    // IPv4 loopback is the whole 127.0.0.0/8 block, not only 127.0.0.1.
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h))
+        return true;
+    // IPv6 loopback: compressed (::1) and fully-expanded longhand.
+    if (h === '::1' || h === '0:0:0:0:0:0:0:1' || h === '0000:0000:0000:0000:0000:0000:0000:0001')
+        return true;
+    // IPv4-mapped IPv6 loopback (e.g. ::ffff:127.0.0.1).
+    if (/^::ffff:127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h))
+        return true;
+    return false;
+}
+/**
+ * Pure decision function (no side effects) so it is exhaustively unit-testable
+ * without booting a server. Precedence: configured auth serves; otherwise a
+ * loopback bind serves; otherwise the explicit opt-out serves (with a warning);
+ * otherwise refuse.
+ */
+export function evaluateHttpAuthPosture(input) {
+    const { bindHost, hasStaticToken, oidcEnabled, allowUnauthenticated } = input;
+    if (hasStaticToken || oidcEnabled) {
+        return { decision: 'serve', reason: 'authentication is configured' };
+    }
+    if (isLoopbackHost(bindHost)) {
+        return { decision: 'serve', reason: `loopback bind (${bindHost}) is not exposed` };
+    }
+    if (allowUnauthenticated) {
+        return {
+            decision: 'serve-open-warn',
+            reason: `MCP_ALLOW_UNAUTHENTICATED=true on a non-loopback bind (${bindHost ?? '0.0.0.0'})`,
+        };
+    }
+    return {
+        decision: 'refuse',
+        reason: `no authentication configured on a non-loopback bind (${bindHost ?? '0.0.0.0'})`,
+    };
+}
+/**
+ * Evaluate the posture and enforce it: refuse exits the process non-zero with a
+ * remediation message, the opt-out logs a loud warning, and a safe posture is a
+ * no-op. `exit` and `log` are injectable only for the existing process.exit-spy
+ * test pattern; production callers use the defaults. Returns the decision so a
+ * caller (or test that stubs exit to not throw) can observe it.
+ */
+export function enforceHttpAuthPosture(input, log = logger, exit = process.exit) {
+    const { decision, reason } = evaluateHttpAuthPosture(input);
+    if (decision === 'refuse') {
+        log.error(`Refusing to start: ${reason}. HTTP auth is required-by-default. ` +
+            'Set MCP_SSE_AUTHORIZATION to a strong token (openssl rand -hex 32), or ' +
+            'set AUTH_PROVIDER=oidc, or bind a loopback host. To deliberately run open ' +
+            '(for example behind your own authenticating proxy), set MCP_ALLOW_UNAUTHENTICATED=true.');
+        exit(1);
+    }
+    else if (decision === 'serve-open-warn') {
+        log.warn(`Serving HTTP WITHOUT authentication: ${reason}. Anyone who can reach this ` +
+            'port can read and modify your financial data. This is allowed only because ' +
+            'MCP_ALLOW_UNAUTHENTICATED=true. Put an authenticating reverse proxy in front, ' +
+            'or set MCP_SSE_AUTHORIZATION / AUTH_PROVIDER=oidc.');
+    }
+    return decision;
+}

package/dist/src/lib/oidc-audiences.js

@@ -0,0 +1,18 @@
+/**
+ * OIDC accepted-audiences allowlist (#245).
+ *
+ * Build the strict, closed set of audiences a JWT's `aud` claim may match: the
+ * required `OIDC_RESOURCE` plus any explicitly configured extras
+ * (`OIDC_ACCEPTED_AUDIENCES`, comma-separated, e.g. an IdP like Authentik that
+ * puts the client-id in `aud`). The list is trimmed, empties are removed, and
+ * duplicates are collapsed. There is NO wildcard and NO accept-any: an `aud`
+ * outside this set is rejected by jose, preserving the cross-relying-party replay
+ * protection from #160. With no extras configured the set is exactly
+ * `[OIDC_RESOURCE]`, so existing single-audience deployments are unchanged.
+ *
+ * Pure and side-effect-free so it is unit-testable without booting a server.
+ */
+export function buildAcceptedAudiences(resource, configured) {
+    const parts = [resource ?? '', ...(configured ?? '').split(',')];
+    return Array.from(new Set(parts.map((a) => a.trim()).filter((a) => a.length > 0)));
+}

package/dist/src/lib/oidc-discovery.js

@@ -0,0 +1,132 @@
+import { createModuleLogger } from './loggerFactory.js';
+/**
+ * OIDC JWKS discovery (#244).
+ *
+ * Background: the OIDC verifier used to build its key set from a hardcoded
+ * `${OIDC_ISSUER}/.well-known/jwks`, which is wrong for most identity providers
+ * (their real `jwks_uri` comes from the discovery document and often lives on a
+ * different path). The fetch then 404s and every token is rejected. This module
+ * resolves the real `jwks_uri` from the issuer's OpenID discovery document, with
+ * the hardening the security review required:
+ *   - the issuer must be https (a plaintext issuer lets a network attacker swap
+ *     the JWKS and forge tokens), except an explicit loopback host for local dev;
+ *   - the discovery fetch must not follow cross-origin redirects (fail closed);
+ *   - the resolved `jwks_uri` must be https and on the SAME host as the issuer, so
+ *     a tampered or misconfigured discovery document cannot point key fetching at
+ *     an attacker-controlled host. Cross-host issuers (for example Google, which
+ *     serves keys from googleapis.com) are intentionally not auto-trusted; that is
+ *     a separate, configurable follow-up (#245).
+ *
+ * The pure helpers (assertSecureIssuer, resolveJwksUri) are unit-tested without a
+ * network; discoverJwksUri wraps them around a single startup fetch and fails
+ * closed on any problem.
+ */
+const logger = createModuleLogger('OIDC_DISCOVERY');
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+/** Bound the startup discovery fetch so a hung IdP cannot hang startup forever. */
+const DISCOVERY_TIMEOUT_MS = 10_000;
+export function isLoopbackHost(host) {
+    return host ? LOOPBACK_HOSTS.has(host.toLowerCase()) : false;
+}
+/**
+ * Parse and validate the issuer URL. Throws unless it is https, or an explicit
+ * loopback host (local dev). Returns the parsed URL.
+ */
+export function assertSecureIssuer(issuer, allowInsecure = false) {
+    if (!issuer)
+        throw new Error('OIDC_ISSUER is not set');
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new Error(`OIDC_ISSUER is not a valid URL: ${issuer}`);
+    }
+    // https is required unless the host is loopback (local dev) or the operator has
+    // explicitly opted into a plaintext issuer on a trusted network (#244).
+    if (url.protocol !== 'https:' && !isLoopbackHost(url.hostname) && !allowInsecure) {
+        throw new Error(`OIDC_ISSUER must use https (got ${url.protocol}//${url.hostname}). A plaintext issuer ` +
+            'lets a network attacker swap the JWKS and forge tokens. Use https, a loopback host for ' +
+            'local dev, or set OIDC_ALLOW_INSECURE_ISSUER=true only on a trusted network.');
+    }
+    // Reject embedded credentials (user:pass@host): URL.hostname strips them, so a
+    // credentialed issuer could slip past the same-origin check and leak secrets to logs.
+    if (url.username || url.password) {
+        throw new Error('OIDC_ISSUER must not contain embedded credentials (user:pass@host)');
+    }
+    // A real issuer has no query or fragment; reject them so the discovery URL
+    // built from the issuer cannot be malformed or misdirected.
+    if (url.search || url.hash) {
+        throw new Error('OIDC_ISSUER must not contain a query string or fragment');
+    }
+    return url;
+}
+/**
+ * Pure: resolve and validate the `jwks_uri` from a parsed discovery document
+ * against the issuer. Throws (fail closed) if it is missing, not https, carries
+ * embedded credentials, or is not same-origin (scheme + host + port) with the issuer.
+ */
+export function resolveJwksUri(discoveryDoc, issuer, allowInsecure = false) {
+    const issuerUrl = assertSecureIssuer(issuer, allowInsecure);
+    if (!discoveryDoc || typeof discoveryDoc !== 'object') {
+        throw new Error('OIDC discovery document is empty or not an object');
+    }
+    const jwksUri = discoveryDoc.jwks_uri;
+    if (typeof jwksUri !== 'string' || jwksUri.length === 0) {
+        throw new Error('OIDC discovery document has no usable "jwks_uri"');
+    }
+    let jwks;
+    try {
+        jwks = new URL(jwksUri);
+    }
+    catch {
+        throw new Error(`OIDC "jwks_uri" is not a valid URL: ${jwksUri}`);
+    }
+    if (jwks.protocol !== 'https:' && !isLoopbackHost(jwks.hostname) && !allowInsecure) {
+        throw new Error(`OIDC "jwks_uri" must use https (got ${jwks.protocol}); refusing to fetch keys over plaintext`);
+    }
+    if (jwks.username || jwks.password) {
+        throw new Error('OIDC "jwks_uri" must not contain embedded credentials (user:pass@host)');
+    }
+    // Same ORIGIN (scheme + host + port), not just hostname: a different port on the
+    // same host is a different service, so comparing origins keeps the guarantee the
+    // security review asked for. Both are https here, so this is effectively host+port.
+    if (jwks.origin.toLowerCase() !== issuerUrl.origin.toLowerCase()) {
+        throw new Error(`OIDC "jwks_uri" origin (${jwks.origin}) does not match the issuer origin (${issuerUrl.origin}); ` +
+            'refusing a cross-origin key fetch. A cross-host issuer (e.g. Google) needs an explicit trusted-host allowlist (#245).');
+    }
+    return jwks.toString();
+}
+/**
+ * Fetch the issuer's OpenID discovery document and return a validated `jwks_uri`.
+ * Fails closed on any problem (non-https issuer, redirect, non-200, bad JSON,
+ * missing/invalid/cross-host jwks_uri). `fetchImpl` is injectable for testing.
+ */
+export async function discoverJwksUri(issuer, allowInsecure = false, fetchImpl = fetch) {
+    assertSecureIssuer(issuer, allowInsecure);
+    const base = issuer.endsWith('/') ? issuer.slice(0, -1) : issuer;
+    const discoveryUrl = `${base}/.well-known/openid-configuration`;
+    let res;
+    try {
+        // redirect: 'error' fails the fetch on ANY redirect, so a 30x to another
+        // origin can never silently redirect key discovery to an attacker host. The
+        // timeout keeps a hung IdP from hanging startup forever (it fails closed).
+        res = await fetchImpl(discoveryUrl, { redirect: 'error', signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+    }
+    catch (err) {
+        throw new Error(`OIDC discovery fetch failed for ${discoveryUrl}: ${err.message}`);
+    }
+    if (!res.ok) {
+        throw new Error(`OIDC discovery fetch returned HTTP ${res.status} for ${discoveryUrl}`);
+    }
+    let doc;
+    try {
+        doc = await res.json();
+    }
+    catch {
+        throw new Error(`OIDC discovery document at ${discoveryUrl} is not valid JSON`);
+    }
+    const jwksUri = resolveJwksUri(doc, issuer, allowInsecure);
+    logger.info('Resolved JWKS URI from OIDC discovery', { jwksUri });
+    return jwksUri;
+}

package/dist/src/server/httpServer.js

@@ -11,11 +11,14 @@ import { connectionPool } from '../lib/ActualConnectionPool.js';
 import observability from '../observability.js';
 import config from '../config.js';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { MCPAuthTokenVerificationError } from 'mcp-auth';
 import { createMcpAuth } from '../auth/setup.js';
+import { discoverJwksUri } from '../lib/oidc-discovery.js';
+import { buildAcceptedAudiences } from '../lib/oidc-audiences.js';
 import { budgetAclMiddleware } from '../auth/budget-acl.js';
 import * as https from 'node:https';
 import * as fs from 'node:fs';
-// AsyncLocalStorage for request context — moved to src/lib/requestContext.ts
+// AsyncLocalStorage for request context: moved to src/lib/requestContext.ts
 // so adapter code can import it without a circular dependency on httpServer.
 // Re-exported here for backward compatibility with any callers that imported
 // `requestContext` from this module.
@@ -57,28 +60,75 @@ advertisedUrl) {
             const requiredScopes = config.OIDC_SCOPES
                 ? config.OIDC_SCOPES.split(',').map((s) => s.trim()).filter(Boolean)
                 : [];
-            // Custom jose-based JWT verifier — bypasses mcp-auth's strict PKCE/discovery
+            // #245: the strict, closed audience allowlist (OIDC_RESOURCE plus any
+            // explicitly configured OIDC_ACCEPTED_AUDIENCES). jose treats the array as
+            // match-any membership, so an IdP that puts the client-id in `aud` works
+            // while an `aud` outside the set is still rejected (#160 preserved). No
+            // wildcard, empties filtered; default is exactly [OIDC_RESOURCE].
+            const acceptedAudiences = buildAcceptedAudiences(config.OIDC_RESOURCE, config.OIDC_ACCEPTED_AUDIENCES);
+            // #245: fail closed if the allowlist is empty (e.g. a whitespace-only
+            // OIDC_RESOURCE that passes the truthy check in setup.ts but trims away).
+            // Never fall through to "no audience option", which would disable the #160
+            // audience check and accept any aud from the trusted issuer.
+            if (acceptedAudiences.length === 0) {
+                throw new Error('OIDC mode requires a non-empty OIDC_RESOURCE (the JWT audience). Refusing to start ' +
+                    'without audience enforcement, which would allow cross-relying-party token replay (#160/#245).');
+            }
+            // Custom jose-based JWT verifier that bypasses mcp-auth's strict PKCE/discovery
             // validation that fails when the IdP (e.g. Casdoor v2.13) doesn't advertise
             // code_challenge_methods_supported in its discovery document.
-            // JWKS is fetched lazily on the first request and cached by jose internally.
-            const jwks = createRemoteJWKSet(new URL(`${config.OIDC_ISSUER}/.well-known/jwks`));
+            // #244: resolve the JWKS URI from the issuer's OpenID discovery document
+            // instead of a hardcoded `${OIDC_ISSUER}/.well-known/jwks` (which 404s for
+            // most IdPs). discoverJwksUri fetches discovery once at startup and fails
+            // closed on a non-https issuer, a cross-origin redirect, a missing/invalid
+            // jwks_uri, or a jwks_uri on a different host than the issuer. jose's
+            // createRemoteJWKSet then fetches the keys lazily and caches them.
+            const jwksUri = await discoverJwksUri(config.OIDC_ISSUER, config.OIDC_ALLOW_INSECURE_ISSUER);
+            const jwks = createRemoteJWKSet(new URL(jwksUri));
             const customJwtVerify = async (token) => {
                 // Enforce the audience claim (#160, OWASP A07). Without it, any
                 // signature-valid token from the trusted issuer is accepted, so a token
                 // minted for a different relying party in a shared IdP tenant can be
-                // replayed against this server. OIDC_RESOURCE is the client-id the IdP
-                // puts in `aud` (Casdoor sets aud=clientId) and is required in OIDC mode,
-                // so it is always present here; the spread is defensive. jose throws
-                // ERR_JWT_CLAIM_VALIDATION_FAILED on a missing or mismatched aud.
-                const { payload } = await jwtVerify(token, jwks, {
-                    issuer: config.OIDC_ISSUER,
-                    ...(config.OIDC_RESOURCE ? { audience: config.OIDC_RESOURCE } : {}),
-                });
+                // replayed against this server. The accepted set is the strict allowlist
+                // built above (#245: OIDC_RESOURCE plus configured extras); it is always
+                // non-empty because OIDC_RESOURCE is required in OIDC mode, so the spread
+                // is defensive. jose throws ERR_JWT_CLAIM_VALIDATION_FAILED on a missing
+                // or out-of-set aud.
+                //
+                // #244: map a jose verification failure (expired, malformed, wrong aud,
+                // bad signature) to MCPAuthTokenVerificationError so mcp-auth's bearer
+                // handler returns a clean 401 with a WWW-Authenticate header instead of
+                // re-throwing the raw jose error as a 500. Pass only the jose error as
+                // the cause (never the raw token), so no token material leaks.
+                let payload;
+                try {
+                    ({ payload } = await jwtVerify(token, jwks, {
+                        issuer: config.OIDC_ISSUER,
+                        // Guaranteed non-empty by the startup guard above, so audience is
+                        // always enforced (#160/#245); never omit it.
+                        audience: acceptedAudiences,
+                    }));
+                }
+                catch (err) {
+                    throw new MCPAuthTokenVerificationError('invalid_token', err instanceof Error ? err : undefined);
+                }
+                // #244: require a usable `sub`. authenticateRequest (#163) and budget-acl
+                // key authorization on req.auth.subject, so a token with no string `sub`
+                // cannot be mapped to a principal. Reject it here as an invalid token (a
+                // clean 401) rather than letting it through to a downstream subject check.
+                if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+                    throw new MCPAuthTokenVerificationError('invalid_token');
+                }
                 const rawAud = payload.aud;
                 const audience = Array.isArray(rawAud) ? rawAud : (rawAud ? [rawAud] : []);
                 const rawScope = typeof payload.scope === 'string' ? payload.scope : '';
                 return {
                     token,
+                    // #244: populate subject from the JWT `sub` claim (guaranteed a non-empty
+                    // string by the check above). mcp-auth sets req.auth to exactly this
+                    // object, and authenticateRequest (#163) plus budget-acl.ts key off
+                    // req.auth.subject; without it OIDC mode rejects every request.
+                    subject: payload.sub,
                     issuer: payload.iss ?? config.OIDC_ISSUER,
                     clientId: audience[0] ?? '',
                     audience,
@@ -94,7 +144,7 @@ advertisedUrl) {
                 requiredScopes,
                 showErrorDetails: process.env.NODE_ENV !== 'production',
             }), budgetAclMiddleware);
-            logger.info(`[OIDC] JWT authentication enabled — issuer: ${config.OIDC_ISSUER}`);
+            logger.info(`[OIDC] JWT authentication enabled. Issuer: ${config.OIDC_ISSUER}`);
         }
     }
     const transports = new Map();
@@ -352,7 +402,7 @@ advertisedUrl) {
                 // when rejectInit fires (e.g. session init fails before any tools/call
                 // arrives), the rejection would otherwise hit process.on('unhandledRejection')
                 // and exit the server. The original error is already logged inside the
-                // onsessioninitialized catch block below — we deliberately do NOT re-log here
+                // onsessioninitialized catch block below: we deliberately do NOT re-log here
                 // to avoid duplicate noise and any risk of leaking credentials.
                 initPromise.catch(() => { });
                 const transport = new StreamableHTTPServerTransport({
@@ -590,7 +640,7 @@ advertisedUrl) {
         console.info(`📨 MCP endpoint: ${advertised}`);
         console.info(`❤️ Health check: ${scheme}://${healthHost}:${port}/health`);
         if (config.AUTH_PROVIDER === 'oidc') {
-            logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required — issuer: ${config.OIDC_ISSUER})`);
+            logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required; issuer: ${config.OIDC_ISSUER})`);
         }
         else if (config.MCP_SSE_AUTHORIZATION) {
             logger.info(`🔒 HTTP authentication enabled (static Bearer token required)`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.7.8",
+  "version": "0.7.11",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,14 +30,14 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",
     "test:e2e:docker:smoke": "./tests/e2e/run-docker-e2e.sh smoke",
     "test:e2e:docker:full": "./tests/e2e/run-docker-e2e.sh full",
     "test:all": "npm run test:adapter && npm run test:unit-js && npm run test:e2e:docker:smoke",
-    "test:mcp-client": "npm run build && node scripts/register-tsconfig-paths.js -- --http --test-mcp-client",
+    "test:mcp-client": "npm run build && MCP_ALLOW_UNAUTHENTICATED=true node scripts/register-tsconfig-paths.js -- --http --test-mcp-client",
     "test:integration": "MCP_TEST_LEVEL=sanity node tests/manual/index.js",
     "test:integration:sanity": "MCP_TEST_LEVEL=sanity node tests/manual/index.js",
     "test:integration:smoke": "MCP_TEST_LEVEL=smoke node tests/manual/index.js",