actual-mcp-server 0.7.9 → 0.7.11

package/README.md

@@ -470,7 +470,9 @@ All configuration is via environment variables. Copy `.env.example` to `.env` to
 | `MCP_SSE_AUTHORIZATION` | _(none)_ | No | Static Bearer token (`AUTH_PROVIDER=none`; highly recommended in production) |
 | `MCP_ALLOW_UNAUTHENTICATED` | `false` | No | Opt-out for required-by-default HTTP auth (#242). On a non-loopback bind with no token and no OIDC the server refuses to start; set to `true` to run open deliberately (e.g. behind your own proxy) |
 | `OIDC_ISSUER` | _(none)_ | If OIDC | OIDC issuer URL (e.g., `https://sso.example.com`) |
+| `OIDC_ALLOW_INSECURE_ISSUER` | `false` | No | Allow a plaintext (http) OIDC issuer on a trusted network (#244). Off by default (http issuer refused at startup); set `true` only for local/LAN testing |
 | `OIDC_RESOURCE` | _(none)_ | No | Expected `aud` claim in JWT (your client ID) |
+| `OIDC_ACCEPTED_AUDIENCES` | _(none)_ | No | Extra accepted `aud` values beyond `OIDC_RESOURCE`, comma-separated (#245). For IdPs that put the client-id in `aud` (e.g. Authentik). Strict allowlist, never a wildcard |
 | `OIDC_SCOPES` | _(none)_ | No | Comma-separated required scopes; leave empty for Casdoor |
 | `AUTH_BUDGET_ACL` | _(none)_ | No | Per-user budget ACL; see [AI Client Setup](docs/guides/AI_CLIENT_SETUP.md#oidc-authentication-multi-user) |
 | `MCP_ENABLE_HTTPS` | `false` | No | Enable native TLS. Requires `MCP_HTTPS_CERT` and `MCP_HTTPS_KEY` |
@@ -716,4 +718,4 @@ The software is provided **as-is**, without warranty of any kind. The author acc
 
 ---
 
-**Version:** 0.7.9 | **Tool Count:** 71 (verified LibreChat-compatible)
+**Version:** 0.7.11 | **Tool Count:** 71 (verified LibreChat-compatible)

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "actual-mcp-server",
     "displayName": "Actual MCP Server",
-    "version": "0.7.9",
+    "version": "0.7.11",
     "engines": {
         "node": ">=22.0.0",
         "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
         "verify-tools": "npm run build && node scripts/verify-tools.js",
         "check:coverage": "node scripts/list-actual-api-methods.mjs",
         "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-        "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
+        "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
         "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
         "test:e2e": "npx playwright test",
         "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",

package/dist/src/config.js

@@ -33,8 +33,19 @@ export const configSchema = z.object({
     AUTH_PROVIDER: z.enum(['none', 'oidc']).default('none'),
     // OIDC issuer URL (e.g. https://auth.example.com/realms/myrealm). Required when AUTH_PROVIDER=oidc.
     OIDC_ISSUER: z.string().optional(),
+    // #244: escape hatch for a plaintext (http) OIDC issuer on a trusted network
+    // (e.g. a LAN Casdoor for local testing). Off by default: an http issuer is
+    // refused because a network attacker could swap the JWKS and forge tokens.
+    // Set to 'true' ONLY when the issuer hop is genuinely trusted. Mirrors
+    // ALLOW_INSECURE_UPSTREAM (#161). Loopback issuers never need this.
+    OIDC_ALLOW_INSECURE_ISSUER: z.string().optional().transform(val => val === 'true'),
     // This server's resource identifier URL (e.g. https://actual-mcp.example.com). Required when AUTH_PROVIDER=oidc.
     OIDC_RESOURCE: z.string().optional(),
+    // #245: extra accepted JWT audiences beyond OIDC_RESOURCE, comma-separated.
+    // For IdPs that put the client-id (not the resource URI) in `aud`, e.g. Authentik.
+    // Strict closed allowlist: the accepted set is OIDC_RESOURCE plus these; never a
+    // wildcard. Default empty, so single-audience deployments are unchanged.
+    OIDC_ACCEPTED_AUDIENCES: z.string().optional(),
     // Comma-separated required scopes (e.g. "read,write"). Optional.
     OIDC_SCOPES: z.string().optional(),
     // JSON map of principal → budget sync-ID list for per-user budget ACL.

package/dist/src/lib/oidc-audiences.js

@@ -0,0 +1,18 @@
+/**
+ * OIDC accepted-audiences allowlist (#245).
+ *
+ * Build the strict, closed set of audiences a JWT's `aud` claim may match: the
+ * required `OIDC_RESOURCE` plus any explicitly configured extras
+ * (`OIDC_ACCEPTED_AUDIENCES`, comma-separated, e.g. an IdP like Authentik that
+ * puts the client-id in `aud`). The list is trimmed, empties are removed, and
+ * duplicates are collapsed. There is NO wildcard and NO accept-any: an `aud`
+ * outside this set is rejected by jose, preserving the cross-relying-party replay
+ * protection from #160. With no extras configured the set is exactly
+ * `[OIDC_RESOURCE]`, so existing single-audience deployments are unchanged.
+ *
+ * Pure and side-effect-free so it is unit-testable without booting a server.
+ */
+export function buildAcceptedAudiences(resource, configured) {
+    const parts = [resource ?? '', ...(configured ?? '').split(',')];
+    return Array.from(new Set(parts.map((a) => a.trim()).filter((a) => a.length > 0)));
+}

package/dist/src/lib/oidc-discovery.js

@@ -0,0 +1,132 @@
+import { createModuleLogger } from './loggerFactory.js';
+/**
+ * OIDC JWKS discovery (#244).
+ *
+ * Background: the OIDC verifier used to build its key set from a hardcoded
+ * `${OIDC_ISSUER}/.well-known/jwks`, which is wrong for most identity providers
+ * (their real `jwks_uri` comes from the discovery document and often lives on a
+ * different path). The fetch then 404s and every token is rejected. This module
+ * resolves the real `jwks_uri` from the issuer's OpenID discovery document, with
+ * the hardening the security review required:
+ *   - the issuer must be https (a plaintext issuer lets a network attacker swap
+ *     the JWKS and forge tokens), except an explicit loopback host for local dev;
+ *   - the discovery fetch must not follow cross-origin redirects (fail closed);
+ *   - the resolved `jwks_uri` must be https and on the SAME host as the issuer, so
+ *     a tampered or misconfigured discovery document cannot point key fetching at
+ *     an attacker-controlled host. Cross-host issuers (for example Google, which
+ *     serves keys from googleapis.com) are intentionally not auto-trusted; that is
+ *     a separate, configurable follow-up (#245).
+ *
+ * The pure helpers (assertSecureIssuer, resolveJwksUri) are unit-tested without a
+ * network; discoverJwksUri wraps them around a single startup fetch and fails
+ * closed on any problem.
+ */
+const logger = createModuleLogger('OIDC_DISCOVERY');
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
+/** Bound the startup discovery fetch so a hung IdP cannot hang startup forever. */
+const DISCOVERY_TIMEOUT_MS = 10_000;
+export function isLoopbackHost(host) {
+    return host ? LOOPBACK_HOSTS.has(host.toLowerCase()) : false;
+}
+/**
+ * Parse and validate the issuer URL. Throws unless it is https, or an explicit
+ * loopback host (local dev). Returns the parsed URL.
+ */
+export function assertSecureIssuer(issuer, allowInsecure = false) {
+    if (!issuer)
+        throw new Error('OIDC_ISSUER is not set');
+    let url;
+    try {
+        url = new URL(issuer);
+    }
+    catch {
+        throw new Error(`OIDC_ISSUER is not a valid URL: ${issuer}`);
+    }
+    // https is required unless the host is loopback (local dev) or the operator has
+    // explicitly opted into a plaintext issuer on a trusted network (#244).
+    if (url.protocol !== 'https:' && !isLoopbackHost(url.hostname) && !allowInsecure) {
+        throw new Error(`OIDC_ISSUER must use https (got ${url.protocol}//${url.hostname}). A plaintext issuer ` +
+            'lets a network attacker swap the JWKS and forge tokens. Use https, a loopback host for ' +
+            'local dev, or set OIDC_ALLOW_INSECURE_ISSUER=true only on a trusted network.');
+    }
+    // Reject embedded credentials (user:pass@host): URL.hostname strips them, so a
+    // credentialed issuer could slip past the same-origin check and leak secrets to logs.
+    if (url.username || url.password) {
+        throw new Error('OIDC_ISSUER must not contain embedded credentials (user:pass@host)');
+    }
+    // A real issuer has no query or fragment; reject them so the discovery URL
+    // built from the issuer cannot be malformed or misdirected.
+    if (url.search || url.hash) {
+        throw new Error('OIDC_ISSUER must not contain a query string or fragment');
+    }
+    return url;
+}
+/**
+ * Pure: resolve and validate the `jwks_uri` from a parsed discovery document
+ * against the issuer. Throws (fail closed) if it is missing, not https, carries
+ * embedded credentials, or is not same-origin (scheme + host + port) with the issuer.
+ */
+export function resolveJwksUri(discoveryDoc, issuer, allowInsecure = false) {
+    const issuerUrl = assertSecureIssuer(issuer, allowInsecure);
+    if (!discoveryDoc || typeof discoveryDoc !== 'object') {
+        throw new Error('OIDC discovery document is empty or not an object');
+    }
+    const jwksUri = discoveryDoc.jwks_uri;
+    if (typeof jwksUri !== 'string' || jwksUri.length === 0) {
+        throw new Error('OIDC discovery document has no usable "jwks_uri"');
+    }
+    let jwks;
+    try {
+        jwks = new URL(jwksUri);
+    }
+    catch {
+        throw new Error(`OIDC "jwks_uri" is not a valid URL: ${jwksUri}`);
+    }
+    if (jwks.protocol !== 'https:' && !isLoopbackHost(jwks.hostname) && !allowInsecure) {
+        throw new Error(`OIDC "jwks_uri" must use https (got ${jwks.protocol}); refusing to fetch keys over plaintext`);
+    }
+    if (jwks.username || jwks.password) {
+        throw new Error('OIDC "jwks_uri" must not contain embedded credentials (user:pass@host)');
+    }
+    // Same ORIGIN (scheme + host + port), not just hostname: a different port on the
+    // same host is a different service, so comparing origins keeps the guarantee the
+    // security review asked for. Both are https here, so this is effectively host+port.
+    if (jwks.origin.toLowerCase() !== issuerUrl.origin.toLowerCase()) {
+        throw new Error(`OIDC "jwks_uri" origin (${jwks.origin}) does not match the issuer origin (${issuerUrl.origin}); ` +
+            'refusing a cross-origin key fetch. A cross-host issuer (e.g. Google) needs an explicit trusted-host allowlist (#245).');
+    }
+    return jwks.toString();
+}
+/**
+ * Fetch the issuer's OpenID discovery document and return a validated `jwks_uri`.
+ * Fails closed on any problem (non-https issuer, redirect, non-200, bad JSON,
+ * missing/invalid/cross-host jwks_uri). `fetchImpl` is injectable for testing.
+ */
+export async function discoverJwksUri(issuer, allowInsecure = false, fetchImpl = fetch) {
+    assertSecureIssuer(issuer, allowInsecure);
+    const base = issuer.endsWith('/') ? issuer.slice(0, -1) : issuer;
+    const discoveryUrl = `${base}/.well-known/openid-configuration`;
+    let res;
+    try {
+        // redirect: 'error' fails the fetch on ANY redirect, so a 30x to another
+        // origin can never silently redirect key discovery to an attacker host. The
+        // timeout keeps a hung IdP from hanging startup forever (it fails closed).
+        res = await fetchImpl(discoveryUrl, { redirect: 'error', signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS) });
+    }
+    catch (err) {
+        throw new Error(`OIDC discovery fetch failed for ${discoveryUrl}: ${err.message}`);
+    }
+    if (!res.ok) {
+        throw new Error(`OIDC discovery fetch returned HTTP ${res.status} for ${discoveryUrl}`);
+    }
+    let doc;
+    try {
+        doc = await res.json();
+    }
+    catch {
+        throw new Error(`OIDC discovery document at ${discoveryUrl} is not valid JSON`);
+    }
+    const jwksUri = resolveJwksUri(doc, issuer, allowInsecure);
+    logger.info('Resolved JWKS URI from OIDC discovery', { jwksUri });
+    return jwksUri;
+}

package/dist/src/server/httpServer.js

@@ -11,11 +11,14 @@ import { connectionPool } from '../lib/ActualConnectionPool.js';
 import observability from '../observability.js';
 import config from '../config.js';
 import { createRemoteJWKSet, jwtVerify } from 'jose';
+import { MCPAuthTokenVerificationError } from 'mcp-auth';
 import { createMcpAuth } from '../auth/setup.js';
+import { discoverJwksUri } from '../lib/oidc-discovery.js';
+import { buildAcceptedAudiences } from '../lib/oidc-audiences.js';
 import { budgetAclMiddleware } from '../auth/budget-acl.js';
 import * as https from 'node:https';
 import * as fs from 'node:fs';
-// AsyncLocalStorage for request context — moved to src/lib/requestContext.ts
+// AsyncLocalStorage for request context: moved to src/lib/requestContext.ts
 // so adapter code can import it without a circular dependency on httpServer.
 // Re-exported here for backward compatibility with any callers that imported
 // `requestContext` from this module.
@@ -57,28 +60,75 @@ advertisedUrl) {
             const requiredScopes = config.OIDC_SCOPES
                 ? config.OIDC_SCOPES.split(',').map((s) => s.trim()).filter(Boolean)
                 : [];
-            // Custom jose-based JWT verifier — bypasses mcp-auth's strict PKCE/discovery
+            // #245: the strict, closed audience allowlist (OIDC_RESOURCE plus any
+            // explicitly configured OIDC_ACCEPTED_AUDIENCES). jose treats the array as
+            // match-any membership, so an IdP that puts the client-id in `aud` works
+            // while an `aud` outside the set is still rejected (#160 preserved). No
+            // wildcard, empties filtered; default is exactly [OIDC_RESOURCE].
+            const acceptedAudiences = buildAcceptedAudiences(config.OIDC_RESOURCE, config.OIDC_ACCEPTED_AUDIENCES);
+            // #245: fail closed if the allowlist is empty (e.g. a whitespace-only
+            // OIDC_RESOURCE that passes the truthy check in setup.ts but trims away).
+            // Never fall through to "no audience option", which would disable the #160
+            // audience check and accept any aud from the trusted issuer.
+            if (acceptedAudiences.length === 0) {
+                throw new Error('OIDC mode requires a non-empty OIDC_RESOURCE (the JWT audience). Refusing to start ' +
+                    'without audience enforcement, which would allow cross-relying-party token replay (#160/#245).');
+            }
+            // Custom jose-based JWT verifier that bypasses mcp-auth's strict PKCE/discovery
             // validation that fails when the IdP (e.g. Casdoor v2.13) doesn't advertise
             // code_challenge_methods_supported in its discovery document.
-            // JWKS is fetched lazily on the first request and cached by jose internally.
-            const jwks = createRemoteJWKSet(new URL(`${config.OIDC_ISSUER}/.well-known/jwks`));
+            // #244: resolve the JWKS URI from the issuer's OpenID discovery document
+            // instead of a hardcoded `${OIDC_ISSUER}/.well-known/jwks` (which 404s for
+            // most IdPs). discoverJwksUri fetches discovery once at startup and fails
+            // closed on a non-https issuer, a cross-origin redirect, a missing/invalid
+            // jwks_uri, or a jwks_uri on a different host than the issuer. jose's
+            // createRemoteJWKSet then fetches the keys lazily and caches them.
+            const jwksUri = await discoverJwksUri(config.OIDC_ISSUER, config.OIDC_ALLOW_INSECURE_ISSUER);
+            const jwks = createRemoteJWKSet(new URL(jwksUri));
             const customJwtVerify = async (token) => {
                 // Enforce the audience claim (#160, OWASP A07). Without it, any
                 // signature-valid token from the trusted issuer is accepted, so a token
                 // minted for a different relying party in a shared IdP tenant can be
-                // replayed against this server. OIDC_RESOURCE is the client-id the IdP
-                // puts in `aud` (Casdoor sets aud=clientId) and is required in OIDC mode,
-                // so it is always present here; the spread is defensive. jose throws
-                // ERR_JWT_CLAIM_VALIDATION_FAILED on a missing or mismatched aud.
-                const { payload } = await jwtVerify(token, jwks, {
-                    issuer: config.OIDC_ISSUER,
-                    ...(config.OIDC_RESOURCE ? { audience: config.OIDC_RESOURCE } : {}),
-                });
+                // replayed against this server. The accepted set is the strict allowlist
+                // built above (#245: OIDC_RESOURCE plus configured extras); it is always
+                // non-empty because OIDC_RESOURCE is required in OIDC mode, so the spread
+                // is defensive. jose throws ERR_JWT_CLAIM_VALIDATION_FAILED on a missing
+                // or out-of-set aud.
+                //
+                // #244: map a jose verification failure (expired, malformed, wrong aud,
+                // bad signature) to MCPAuthTokenVerificationError so mcp-auth's bearer
+                // handler returns a clean 401 with a WWW-Authenticate header instead of
+                // re-throwing the raw jose error as a 500. Pass only the jose error as
+                // the cause (never the raw token), so no token material leaks.
+                let payload;
+                try {
+                    ({ payload } = await jwtVerify(token, jwks, {
+                        issuer: config.OIDC_ISSUER,
+                        // Guaranteed non-empty by the startup guard above, so audience is
+                        // always enforced (#160/#245); never omit it.
+                        audience: acceptedAudiences,
+                    }));
+                }
+                catch (err) {
+                    throw new MCPAuthTokenVerificationError('invalid_token', err instanceof Error ? err : undefined);
+                }
+                // #244: require a usable `sub`. authenticateRequest (#163) and budget-acl
+                // key authorization on req.auth.subject, so a token with no string `sub`
+                // cannot be mapped to a principal. Reject it here as an invalid token (a
+                // clean 401) rather than letting it through to a downstream subject check.
+                if (typeof payload.sub !== 'string' || payload.sub.length === 0) {
+                    throw new MCPAuthTokenVerificationError('invalid_token');
+                }
                 const rawAud = payload.aud;
                 const audience = Array.isArray(rawAud) ? rawAud : (rawAud ? [rawAud] : []);
                 const rawScope = typeof payload.scope === 'string' ? payload.scope : '';
                 return {
                     token,
+                    // #244: populate subject from the JWT `sub` claim (guaranteed a non-empty
+                    // string by the check above). mcp-auth sets req.auth to exactly this
+                    // object, and authenticateRequest (#163) plus budget-acl.ts key off
+                    // req.auth.subject; without it OIDC mode rejects every request.
+                    subject: payload.sub,
                     issuer: payload.iss ?? config.OIDC_ISSUER,
                     clientId: audience[0] ?? '',
                     audience,
@@ -94,7 +144,7 @@ advertisedUrl) {
                 requiredScopes,
                 showErrorDetails: process.env.NODE_ENV !== 'production',
             }), budgetAclMiddleware);
-            logger.info(`[OIDC] JWT authentication enabled — issuer: ${config.OIDC_ISSUER}`);
+            logger.info(`[OIDC] JWT authentication enabled. Issuer: ${config.OIDC_ISSUER}`);
         }
     }
     const transports = new Map();
@@ -352,7 +402,7 @@ advertisedUrl) {
                 // when rejectInit fires (e.g. session init fails before any tools/call
                 // arrives), the rejection would otherwise hit process.on('unhandledRejection')
                 // and exit the server. The original error is already logged inside the
-                // onsessioninitialized catch block below — we deliberately do NOT re-log here
+                // onsessioninitialized catch block below: we deliberately do NOT re-log here
                 // to avoid duplicate noise and any risk of leaking credentials.
                 initPromise.catch(() => { });
                 const transport = new StreamableHTTPServerTransport({
@@ -590,7 +640,7 @@ advertisedUrl) {
         console.info(`📨 MCP endpoint: ${advertised}`);
         console.info(`❤️ Health check: ${scheme}://${healthHost}:${port}/health`);
         if (config.AUTH_PROVIDER === 'oidc') {
-            logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required — issuer: ${config.OIDC_ISSUER})`);
+            logger.info(`🔒 OIDC authentication enabled (JWT Bearer token required; issuer: ${config.OIDC_ISSUER})`);
         }
         else if (config.MCP_SSE_AUTHORIZATION) {
             logger.info(`🔒 HTTP authentication enabled (static Bearer token required)`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "actual-mcp-server",
   "displayName": "Actual MCP Server",
-  "version": "0.7.9",
+  "version": "0.7.11",
   "engines": {
     "node": ">=22.0.0",
     "npm": ">=10.0.0"
@@ -30,7 +30,7 @@
     "verify-tools": "npm run build && node scripts/verify-tools.js",
     "check:coverage": "node scripts/list-actual-api-methods.mjs",
     "direct-sync": "node scripts/direct-sync/bank-sync-direct.mjs",
-    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
+    "test:unit-js": "node tests/unit/transactions_create.test.js && node tests/unit/generated_tools.smoke.test.js && node tests/unit/schema_validation.test.js && node tests/unit/config_https_validation.test.js && node tests/unit/config_data_dir.test.js && node tests/unit/config_drift.test.js && node tests/unit/port_alignment.test.js && node tests/unit/dockerfile_data_dir_alignment.test.js && node tests/unit/unraid_template_alignment.test.js && node tests/unit/entrypoint_invariants.test.js && node tests/unit/compose_profile_sync.test.js && node tests/unit/advertised_tools_sync.test.js && node tests/unit/knip_config.test.js && node tests/unit/readme_stats_sync.test.js && node tests/unit/config_insecure_upstream.test.js && node tests/unit/auth_posture.test.js && node tests/unit/auth_posture_wiring.test.js && node tests/unit/auth-acl.test.js && node tests/unit/bug76.test.js && node tests/unit/budgets_setAmount.test.js && node tests/unit/budgets_transfer.test.js && node tests/unit/transactions_uncategorized.test.js && node tests/unit/httpServer_session_init.test.js && node tests/unit/httpServer_session_not_found.test.js && node tests/unit/manual_mcp_client_retry.test.js && node tests/unit/manual_mcp_client_session.test.js && node tests/unit/manual_mcp_client_circuit.test.js && node tests/unit/manual_runner_killswitch.test.js && node tests/unit/adapter_auth_rate_limit.test.js && node tests/unit/adapter_session_reuse.test.js && node tests/unit/retry_classifier.test.js && node tests/unit/adapter_module_surface.test.js && node tests/unit/adapter_nonidempotent_no_retry.test.js && node tests/unit/pool_liveness.test.js && node tests/unit/pool_shutdown_all.test.js && node tests/unit/query_where_operators.test.js && node tests/unit/query_run_validation.test.js && node tests/unit/adapter_with_write_session.test.js && node tests/unit/category_groups_delete.test.js && node tests/unit/rules_delete.test.js && node tests/unit/schedules_delete.test.js && node tests/unit/payees_delete.test.js && node tests/unit/rules_create_or_update.test.js && node tests/unit/unhandled-rejection.test.js && node tests/unit/rejection-allowlist-purity.test.js && node tests/unit/httpServer_bearer_auth.test.js && node tests/unit/httpServer_oidc_audience.test.js && node tests/unit/httpServer_oidc_auth_verification.test.js && node tests/unit/httpServer_oidc_jwks_discovery.test.js && node tests/unit/httpServer_body_limit.test.js && node tests/unit/httpServer_bind_host.test.js && node tests/unit/adapter_write_pool_cooperation.test.js && node tests/unit/budget_acl_enforcement.test.js && node tests/unit/budget_preference_store.test.js && node tests/unit/budget_preference_restore.test.js && node tests/unit/tags_list.test.js && node tests/unit/tags_create.test.js && node tests/unit/tags_update.test.js && node tests/unit/tags_delete.test.js && node tests/unit/notes_get.test.js && node tests/unit/notes_update.test.js && node tests/unit/payees_common_list.test.js && node tests/unit/transactions_update_guard.test.js && node tests/unit/entities_search.test.js && node tests/unit/transactions_import_schema.test.js && node tests/unit/tool_schema_shape.test.js && node tests/unit/zod_error_format.test.js && node tests/unit/tool_count_sync.test.js && node tests/unit/stdio_transport.test.js && node tests/unit/logger_structured.test.js && node tests/unit/logger_redaction.test.js && node tests/unit/logger_correlation.test.js && node tests/unit/check_coverage.test.js",
     "test:adapter": "npm run build && node dist/src/tests_adapter_runner.js",
     "test:e2e": "npx playwright test",
     "test:e2e:docker": "./tests/e2e/run-docker-e2e.sh",