bankmcp 0.1.3 → 0.1.4

package/dist/lib/local.js

@@ -2,6 +2,7 @@
 // page and receives the bank redirect. Enable Banking requires https redirect
 // URLs, so a self-signed certificate is created on first run.
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { X509Certificate } from "node:crypto";
 import { join } from "node:path";
 import { createServer as createHttpsServer } from "node:https";
 import selfsigned from "selfsigned";
@@ -9,17 +10,46 @@ import { config } from "./config.js";
 import { createApp } from "./app.js";
 let server;
 let starting;
+/** Browsers reject server certificates valid for more than 398 days; earlier versions issued 10-year ones. */
+export function certificateStillGood(pem, now = Date.now()) {
+    try {
+        const x = new X509Certificate(pem);
+        const from = Date.parse(x.validFrom);
+        const to = Date.parse(x.validTo);
+        const day = 86_400_000;
+        return to - from <= 398 * day && to - now > 30 * day;
+    }
+    catch {
+        return false;
+    }
+}
 async function certificate() {
     const certPath = join(config.dataDir, "localhost-cert.pem");
     const keyPath = join(config.dataDir, "localhost-key.pem");
-    if (existsSync(certPath) && existsSync(keyPath))
-        return { cert: readFileSync(certPath, "utf8"), key: readFileSync(keyPath, "utf8") };
+    if (existsSync(certPath) && existsSync(keyPath)) {
+        const cert = readFileSync(certPath, "utf8");
+        if (certificateStillGood(cert))
+            return { cert, key: readFileSync(keyPath, "utf8") };
+        console.error("[bank] replacing the stored localhost certificate (too long-lived or about to expire)");
+    }
+    // Apple caps TLS server certificate lifetime at 398 days; Chrome on macOS
+    // defers to the system verifier and rejects anything longer as ERR_CERT_INVALID,
+    // which offers no click-through. Stay just under the limit.
     const notAfterDate = new Date();
-    notAfterDate.setFullYear(notAfterDate.getFullYear() + 10);
+    notAfterDate.setDate(notAfterDate.getDate() + 397);
     const pems = await selfsigned.generate([{ name: "commonName", value: "localhost" }], {
         keySize: 2048,
         notAfterDate,
-        extensions: [{ name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] }],
+        // selfsigned defaults to sha1, which browsers reject outright as
+        // ERR_CERT_INVALID with no click-through. macOS additionally requires
+        // basicConstraints and an extendedKeyUsage of serverAuth.
+        algorithm: "sha256",
+        extensions: [
+            { name: "basicConstraints", cA: false, critical: true },
+            { name: "keyUsage", digitalSignature: true, keyEncipherment: true, critical: true },
+            { name: "extKeyUsage", serverAuth: true },
+            { name: "subjectAltName", altNames: [{ type: 2, value: "localhost" }, { type: 7, ip: "127.0.0.1" }] },
+        ],
     });
     mkdirSync(config.dataDir, { recursive: true });
     writeFileSync(certPath, pems.cert, { mode: 0o600 });

package/dist/lib/mcp.js

@@ -1,7 +1,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { registerTools } from "./tools.js";
 import { registerPrompts } from "./prompts.js";
-export const VERSION = "0.1.3";
+export const VERSION = "0.1.4";
 export function createServer() {
     const server = new McpServer({ name: "bank", version: VERSION }, {
         instructions: [

package/dist/lib/server.js

@@ -6,6 +6,15 @@ import { createApp } from "./app.js";
 import { setupAvailable } from "./setup.js";
 const app = createApp({ remote: true });
 const tls = tlsOptions();
+// In local mode config.baseUrl is https://localhost:PORT, but this entry point
+// only speaks TLS when a certificate is configured. Serving plain http while
+// advertising https leaves the setup page and the bank redirect unreachable,
+// so say what is wrong instead of starting into a broken state.
+if (config.localMode && !tls) {
+    console.error(`[bank] BANKMCP_LOCAL=1 makes the public URL ${config.baseUrl}, but no TLS certificate is configured, so this process can only serve http.\n` +
+        `[bank] Run the stdio entry point instead (npx bankmcp), which terminates TLS itself, or set TLS_CERT_PATH and TLS_KEY_PATH.`);
+    process.exit(1);
+}
 const httpServer = tls ? createHttpsServer(tls, app) : createHttpServer(app);
 httpServer.listen(config.port, () => {
     console.log(`[bank ${new Date().toISOString()}] listening on ${tls ? "https" : "http"}://0.0.0.0:${config.port}, public URL ${config.baseUrl}`);

package/dist/lib/store.js

@@ -4,6 +4,10 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { config } from "./config.js";
+/** How long a started-but-unfinished bank login stays interesting. */
+export const PENDING_AUTH_TTL_MS = 60 * 60 * 1000;
+/** True while a pending authorization is recent enough to still be completed. */
+export const pendingAuthIsLive = (p, now = Date.now()) => Date.parse(p.started) >= now - PENDING_AUTH_TTL_MS;
 const empty = () => ({
     version: 1,
     sessions: {},
@@ -109,9 +113,8 @@ export class Store {
     // --- Pending bank authorizations ---
     addPendingAuth(p) {
         this.update((d) => {
-            const cutoff = Date.now() - 60 * 60 * 1000;
             for (const [k, v] of Object.entries(d.pending_auth))
-                if (Date.parse(v.started) < cutoff)
+                if (!pendingAuthIsLive(v))
                     delete d.pending_auth[k];
             d.pending_auth[p.state] = p;
         });

package/dist/lib/tools.js

@@ -2,7 +2,7 @@ import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { config, isConfigured } from "./config.js";
 import { eb, EnableBankingError } from "./enablebanking.js";
-import { store } from "./store.js";
+import { pendingAuthIsLive, store } from "./store.js";
 import { daysAgo, daysLeft, describeAccount, isoDate, simplifyBalances, simplifyTransaction } from "./data.js";
 import { runWatches } from "./watcher.js";
 const MAX_CONSENT_DAYS = 180;
@@ -135,7 +135,11 @@ export function registerTools(server) {
                 accounts: s.accounts().filter((a) => a.session_id === session.id).length,
             });
         }
-        const pending = Object.values(s.data.pending_auth).map((p) => ({ bank: p.bank.name, started: p.started }));
+        // Expired ones are only swept when the next login starts, so filter here
+        // too; listing logins that can no longer be completed just misleads.
+        const pending = Object.values(s.data.pending_auth)
+            .filter((p) => pendingAuthIsLive(p))
+            .map((p) => ({ bank: p.bank.name, started: p.started }));
         return json({ banks, pending_logins: pending, hint: banks.length ? undefined : "No bank connected yet. Use start_consent." });
     }));
     server.registerTool("disconnect_bank", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bankmcp",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "BankMCP™: self-hosted, read-only MCP server that lets any AI assistant (Claude, ChatGPT, Mistral, Cursor, or a local model) answer questions about your own bank accounts via open banking (Enable Banking, PSD2)",
   "license": "MIT",
   "type": "module",