dbgate-api-premium 7.2.1 → 7.2.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dbgate-api-premium",
   "main": "src/index.js",
-  "version": "7.2.1",
+  "version": "7.2.3",
   "homepage": "https://www.dbgate.io/",
   "repository": {
     "type": "git",
@@ -30,11 +30,11 @@
     "compare-versions": "^3.6.0",
     "cors": "^2.8.5",
     "cross-env": "^6.0.3",
-    "dbgate-datalib": "7.2.1",
+    "dbgate-datalib": "7.2.3",
     "dbgate-query-splitter": "^4.12.0",
-    "dbgate-rest": "7.2.1",
-    "dbgate-sqltree": "7.2.1",
-    "dbgate-tools": "7.2.1",
+    "dbgate-rest": "7.2.3",
+    "dbgate-sqltree": "7.2.3",
+    "dbgate-tools": "7.2.3",
     "debug": "^4.3.4",
     "diff": "^5.0.0",
     "diff2html": "^3.4.13",
@@ -96,7 +96,7 @@
     "@types/fs-extra": "^9.0.11",
     "@types/jest": "^30.0.0",
     "@types/lodash": "^4.14.149",
-    "dbgate-types": "7.2.1",
+    "dbgate-types": "7.2.3",
     "env-cmd": "^10.1.0",
     "jest": "^30.4.2",
     "jsdoc-to-markdown": "^9.0.5",

package/src/auth/authProvider.js

@@ -348,6 +348,9 @@ function getDefaultAuthProvider() {
 
 function getAuthProviderFromReq(req) {
   const authProviderId = req?.auth?.amoid || req?.user?.amoid;
+  if (authProviderId == 'mcp') {
+    return require('../controllers/storage').getMcpAuthProvider();
+  }
   return getAuthProviderById(authProviderId) ?? getDefaultAuthProvider();
 }
 

package/src/auth/storageAuthProvider.js

@@ -90,6 +90,42 @@ class SuperadminAuthProvider extends AuthProviderBase {
   }
 }
 
+class McpAuthProvider extends AuthProviderBase {
+  amoid = 'mcp';
+  skipInList = true;
+
+  async getCurrentPermissions() {
+    if (!process.env.STORAGE_DATABASE) return null;
+    return [...(getPredefinedPermissions('mcp') ?? []), ...(await storageReadRolePermissions(-4))];
+  }
+
+  async getCurrentDatabasePermissions() {
+    if (!process.env.STORAGE_DATABASE) return [];
+    return resolvePermissionConnectionIds(await readComplexRolePermissions(-4, 'role_databases'));
+  }
+
+  async getCurrentTablePermissions() {
+    if (!process.env.STORAGE_DATABASE) return [];
+    return resolvePermissionConnectionIds(await readComplexRolePermissions(-4, 'role_tables'));
+  }
+
+  async getCurrentFilePermissions() {
+    if (!process.env.STORAGE_DATABASE) return [];
+    return readComplexRolePermissions(-4, 'role_files');
+  }
+
+  async checkCurrentConnectionPermission(_req, conid) {
+    if (!process.env.STORAGE_DATABASE) return true;
+    return storageCheckRoleConnectionAccess(-4, conid);
+  }
+}
+
+const mcpAuthProvider = new McpAuthProvider();
+
+function getMcpAuthProvider() {
+  return mcpAuthProvider;
+}
+
 class StorageProviderBase extends AuthProviderBase {
   constructor(config) {
     super();
@@ -724,5 +760,6 @@ function createStorageAuthProvider(config) {
 module.exports = {
   createStorageAuthProvider,
   SuperadminAuthProvider,
+  getMcpAuthProvider,
   getBuiltinRoleIdFromRequest,
 };

package/src/controllers/auth.js

@@ -28,10 +28,17 @@ const {
   markUserAsActive,
   markLoginAsLoggedOut,
 } = require('../utility/loginchecker');
+const {
+  readMcpConfig,
+  getPublicBaseUrl,
+  getMcpResourceUrl,
+  setMcpIdentity,
+  safeTokenHashEquals,
+} = require('../utility/mcpAuth');
 
 const logger = getLogger('auth');
 
-function unauthorizedResponse(req, res, text) {
+function unauthorizedResponse(req, res, text, mcpAuthMode = null) {
   // if (req.path == getExpressPath('/config/get-settings')) {
   //   return res.json({});
   // }
@@ -39,10 +46,70 @@ function unauthorizedResponse(req, res, text) {
   //   return res.json([]);
   // }
 
+  if (req.path == getExpressPath('/mcp')) {
+    res.setHeader(
+      'WWW-Authenticate',
+      mcpAuthMode == 'oauth'
+        ? `Bearer resource_metadata="${getPublicBaseUrl(req)}${getExpressPath('/.well-known/oauth-protected-resource')}"`
+        : 'Bearer'
+    );
+  }
+
   return res.status(401).send(text);
 }
 
-function authMiddleware(req, res, next) {
+async function authenticateMcpRequest(req, res, next) {
+  const config = await readMcpConfig();
+  if (!config.enabled) {
+    return res.status(403).send('DBGM-00000 MCP server is disabled');
+  }
+
+  if (config.authMode == 'none') {
+    setMcpIdentity(req);
+    return next();
+  }
+
+  const authHeader = req.headers.authorization;
+  const [scheme, token] = authHeader?.split(' ') ?? [];
+  if (scheme != 'Bearer' || !token) {
+    return unauthorizedResponse(req, res, 'missing or invalid MCP authorization header', config.authMode);
+  }
+
+  if (config.authMode == 'token') {
+    if (!safeTokenHashEquals(token, config.tokenHash)) {
+      return unauthorizedResponse(req, res, 'invalid MCP token', config.authMode);
+    }
+    setMcpIdentity(req, { licenseUid: 'mcp-token', login: 'mcp-token' });
+    return next();
+  }
+
+  try {
+    const decoded = jwt.verify(token, getTokenSecret());
+    if (
+      decoded.tokenUse != 'mcp' ||
+      decoded.aud != getMcpResourceUrl(req) ||
+      decoded.oauthClientId != config.oauthClientId
+    ) {
+      throw new Error('Invalid MCP token claims');
+    }
+    setMcpIdentity(req, decoded);
+    markUserAsActive(decoded.licenseUid, token);
+    return next();
+  } catch (err) {
+    return unauthorizedResponse(req, res, 'invalid MCP OAuth token', config.authMode);
+  }
+}
+
+async function authMiddleware(req, res, next) {
+  if (req.path == getExpressPath('/mcp')) {
+    try {
+      return await authenticateMcpRequest(req, res, next);
+    } catch (err) {
+      logger.error(extractErrorLogData(err), 'DBGM-00000 Error loading MCP authentication configuration');
+      return res.status(500).send('DBGM-00000 Could not load MCP authentication configuration');
+    }
+  }
+
   const SKIP_AUTH_PATHS = [
     '/config/get',
     '/config/logout',
@@ -58,6 +125,14 @@ function authMiddleware(req, res, next) {
     '/storage/request-password-reset',
     '/storage/reset-password',
     '/auth/get-providers',
+    '/.well-known/oauth-protected-resource',
+    '/.well-known/oauth-protected-resource/mcp',
+    '/.well-known/oauth-authorization-server',
+    '/.well-known/openid-configuration',
+    '/authorize',
+    '/token',
+    '/mcp/oauth/authorize',
+    '/mcp/oauth/token',
     '/connections/dblogin-web',
     '/connections/dblogin-app',
     '/connections/dblogin-auth',
@@ -92,6 +167,9 @@ function authMiddleware(req, res, next) {
   const token = authHeader.split(' ')[1];
   try {
     const decoded = jwt.verify(token, getTokenSecret());
+    if (decoded.tokenUse == 'mcp') {
+      throw new Error('MCP token cannot be used for the DbGate API');
+    }
     req.user = decoded;
     markUserAsActive(decoded.licenseUid, token);
 

package/src/controllers/config.js

@@ -32,6 +32,12 @@ const {
 const lock = new AsyncLock();
 let cachedSettingsValue = null;
 
+function coerceSettingsEnvValue(raw) {
+  if (raw === 'true') return true; // so booleans can be enabled AND disabled via env
+  if (raw === 'false') return false;
+  return raw; // leave everything else as a string (numeric settings are parsed on read)
+}
+
 module.exports = {
   // settingsValue: {},
 
@@ -173,9 +179,12 @@ module.exports = {
     }
     for (const envVar in process.env) {
       if (envVar.startsWith('SETTINGS_')) {
-        const key = envVar.substring('SETTINGS_'.length);
-        if (!res[key]) {
-          res[key] = process.env[envVar];
+        // dot-safe: allow `SETTINGS_tabGroup__showServerName` on platforms that forbid '.'
+        // in env-var names; `__` -> '.'. Existing dotted names are unaffected (no settings
+        // key contains '__').
+        const key = envVar.substring('SETTINGS_'.length).replace(/__/g, '.');
+        if (!(key in res)) {
+          res[key] = coerceSettingsEnvValue(process.env[envVar]);
         }
       }
     }

package/src/controllers/connections.js

@@ -489,10 +489,17 @@ module.exports = {
 
     if (portalConnections) {
       const res = portalConnections.find(x => x._id == conid) || null;
-      return mask && !platformInfo.allowShellConnection ? maskConnection(res) : encryptConnection(res);
+      if (res) {
+        return mask && !platformInfo.allowShellConnection ? maskConnection(res) : encryptConnection(res);
+      }
+      if (!(process.send && processArgs.processDisplayName === 'script')) {
+        return null;
+      }
+    }
+    if (!portalConnections) {
+      const res = await this.datastore.get(conid);
+      if (res) return res;
     }
-    const res = await this.datastore.get(conid);
-    if (res) return res;
 
     // In a forked runner-script child process, ask the parent for connections that may be
     // volatile (in-memory only, e.g. ask-for-password).  We only do this when

package/src/controllers/databaseConnections.js

@@ -247,6 +247,15 @@ module.exports = {
     return newOpened;
   },
 
+  async ensureStructureLoaded(conid, database) {
+    const conn = await this.ensureOpened(conid, database);
+    if (conn.isApiConnection || !conn.subprocess) {
+      return conn.structure ?? {};
+    }
+    const response = await this.sendRequest(conn, { msgtype: 'getStructure' });
+    return response.structure ?? conn.structure ?? {};
+  },
+
   /** @param {import('dbgate-types').OpenedDatabaseConnection} conn */
   sendRequest(conn, message, additionalData = {}) {
     const msgid = crypto.randomUUID();

package/src/controllers/mcpAdmin.js

@@ -0,0 +1,156 @@
+const crypto = require('crypto');
+const { isProApp } = require('../utility/checkLicense');
+const { loadPermissionsFromRequest, hasPermission } = require('../utility/hasPermission');
+const { sendToAuditLog } = require('../utility/auditlog');
+const { encryptPasswordString, decryptPasswordString } = require('../utility/crypting');
+const storage = require('./storage');
+const {
+  MCP_AUTH_MODES,
+  hashMcpToken,
+  sanitizeMcpConfig,
+  getMcpResourceUrl,
+} = require('../utility/mcpAuth');
+
+async function requireMcpAdmin(req) {
+  if (!isProApp() || !process.env.STORAGE_DATABASE) {
+    throw new Error('DBGM-00000 MCP administration requires Team Premium');
+  }
+  const permissions = await loadPermissionsFromRequest(req);
+  if (!hasPermission('admin/settings', permissions)) {
+    throw new Error('DBGM-00000 Permission admin/settings not granted');
+  }
+}
+
+async function readStoredConfig() {
+  return sanitizeMcpConfig((await storage.readConfig({ group: 'mcp' })) || {});
+}
+
+function publicConfig(config, req) {
+  let mcpUrl = null;
+  let mcpUrlError = null;
+  let token = null;
+  let oauthClientSecret = null;
+  try {
+    mcpUrl = getMcpResourceUrl(req);
+  } catch (error) {
+    mcpUrlError = error.message;
+  }
+  try {
+    token = decryptPasswordString(config.tokenEncrypted) || null;
+  } catch (error) {
+    token = null;
+  }
+  try {
+    oauthClientSecret = decryptPasswordString(config.oauthClientSecretEncrypted) || null;
+  } catch (error) {
+    oauthClientSecret = null;
+  }
+  return {
+    enabled: config.enabled,
+    authMode: config.authMode,
+    hasToken: !!config.tokenHash,
+    token,
+    tokenSuffix: config.tokenSuffix,
+    tokenGeneratedAt: config.tokenGeneratedAt,
+    mcpUrl,
+    mcpUrlError,
+    oauthClientId: config.oauthClientId,
+    hasOAuthClientSecret: !!config.oauthClientSecretHash,
+    oauthClientSecret,
+    oauthClientSecretSuffix: config.oauthClientSecretSuffix,
+    oauthClientGeneratedAt: config.oauthClientGeneratedAt,
+  };
+}
+
+async function writeStoredConfig(config) {
+  await storage.writeConfig({ group: 'mcp', config });
+}
+
+module.exports = {
+  getConfig_meta: true,
+  async getConfig(_params, req) {
+    await requireMcpAdmin(req);
+    return publicConfig(await readStoredConfig(), req);
+  },
+
+  updateConfig_meta: true,
+  async updateConfig({ enabled, authMode }, req) {
+    await requireMcpAdmin(req);
+    if (typeof enabled !== 'boolean' || !MCP_AUTH_MODES.includes(authMode)) {
+      throw new Error('DBGM-00000 Invalid MCP configuration');
+    }
+
+    const current = await readStoredConfig();
+    const updated = { ...current, enabled, authMode };
+    await writeStoredConfig(updated);
+    sendToAuditLog(req, {
+      category: 'admin',
+      component: 'MCP',
+      action: 'configuration',
+      event: 'mcp.configurationChanged',
+      severity: 'info',
+      detail: { enabled, authMode },
+      message: 'MCP configuration changed',
+    });
+    return publicConfig(updated, req);
+  },
+
+  generateToken_meta: true,
+  async generateToken(_params, req) {
+    await requireMcpAdmin(req);
+    const token = `dbgate_mcp_${crypto.randomBytes(32).toString('base64url')}`;
+    const tokenSuffix = token.slice(-6);
+    const tokenGeneratedAt = new Date().toISOString();
+    const current = await readStoredConfig();
+    const updated = {
+      ...current,
+      tokenHash: hashMcpToken(token),
+      tokenEncrypted: encryptPasswordString(token),
+      tokenSuffix,
+      tokenGeneratedAt,
+    };
+    await writeStoredConfig(updated);
+    sendToAuditLog(req, {
+      category: 'admin',
+      component: 'MCP',
+      action: 'generateToken',
+      event: 'mcp.tokenGenerated',
+      severity: 'info',
+      message: 'MCP token generated',
+    });
+    return { token, tokenSuffix, tokenGeneratedAt };
+  },
+
+  generateOauthClient_meta: true,
+  async generateOauthClient(_params, req) {
+    await requireMcpAdmin(req);
+    const clientId = `dbgate_mcp_client_${crypto.randomBytes(24).toString('base64url')}`;
+    const clientSecret = `dbgate_mcp_secret_${crypto.randomBytes(32).toString('base64url')}`;
+    const clientSecretSuffix = clientSecret.slice(-6);
+    const clientGeneratedAt = new Date().toISOString();
+    const current = await readStoredConfig();
+    const updated = {
+      ...current,
+      oauthClientId: clientId,
+      oauthClientSecretHash: hashMcpToken(clientSecret),
+      oauthClientSecretEncrypted: encryptPasswordString(clientSecret),
+      oauthClientSecretSuffix: clientSecretSuffix,
+      oauthClientGeneratedAt: clientGeneratedAt,
+    };
+    await writeStoredConfig(updated);
+    sendToAuditLog(req, {
+      category: 'admin',
+      component: 'MCP',
+      action: 'generateOAuthClient',
+      event: 'mcp.oauthClientGenerated',
+      severity: 'info',
+      message: 'MCP OAuth client credentials generated',
+    });
+    return {
+      clientId,
+      clientSecret,
+      clientSecretSuffix,
+      clientGeneratedAt,
+    };
+  },
+};

package/src/controllers/storage.js

@@ -2,12 +2,16 @@ const fs = require('fs-extra');
 const _ = require('lodash');
 const path = require('path');
 const { setAuthProviders, getAuthProviderById } = require('../auth/authProvider');
-const { createStorageAuthProvider, SuperadminAuthProvider } = require('../auth/storageAuthProvider');
+const { createStorageAuthProvider, SuperadminAuthProvider, getMcpAuthProvider } = require('../auth/storageAuthProvider');
 const {
   getStorageConnection,
   getDbConnectionParams,
   storageSelectFmt,
   storageReadUserRolePermissions,
+  storageReadRolePermissions: storageDbReadRolePermissions,
+  readComplexRolePermissions: storageDbReadComplexRolePermissions,
+  resolvePermissionConnectionIds: storageDbResolvePermissionConnectionIds,
+  storageCheckMcpConnectionAccess: storageDbCheckMcpConnectionAccess,
   storageReadConfig,
   storageWriteConfig,
   getStorageConnectionError,
@@ -59,6 +63,24 @@ function mapConnection(connnection) {
 let refreshLicenseStarted = false;
 
 module.exports = {
+  getMcpAuthProvider,
+
+  async storageReadRolePermissions(roleId) {
+    return storageDbReadRolePermissions(roleId);
+  },
+
+  async readComplexRolePermissions(roleId, permissionType) {
+    return storageDbReadComplexRolePermissions(roleId, permissionType);
+  },
+
+  async resolvePermissionConnectionIds(permissions) {
+    return storageDbResolvePermissionConnectionIds(permissions);
+  },
+
+  async storageCheckMcpConnectionAccess(req, conid) {
+    return storageDbCheckMcpConnectionAccess(req, conid);
+  },
+
   async _init() {
     if (!process.env.STORAGE_DATABASE) {
       return;
@@ -193,8 +215,12 @@ module.exports = {
   },
 
   readConfig_meta: true,
-  async readConfig({ group }) {
-    return await storageReadConfig(group);
+  async readConfig({ group }, req) {
+    const config = await storageReadConfig(group);
+    if (req && group == 'mcp') {
+      return _.omit(config, ['tokenHash']);
+    }
+    return config;
   },
 
   readAuthConfig_meta: true,
@@ -290,7 +316,10 @@ module.exports = {
   },
 
   writeConfig_meta: true,
-  async writeConfig({ group, config }) {
+  async writeConfig({ group, config }, req) {
+    if (req && group == 'mcp') {
+      throw new Error('DBGM-00000 MCP configuration must be changed through MCP administration');
+    }
     await storageWriteConfig(group, config);
     await this._init();
     return null;
@@ -808,7 +837,7 @@ module.exports = {
             id
           );
 
-    const basePermissions = getPredefinedPermissions(id < 0 && resp[0]?.name ? resp[0]?.name : 'logged-user');
+    const basePermissions = getPredefinedPermissions(id < 0 && resp[0]?.name ? resp[0]?.name : 'logged-user') ?? [];
     const permissions =
       id == 'new'
         ? []
@@ -931,18 +960,18 @@ module.exports = {
 
     const {
       name,
-      usedConnections,
-      usedUsers,
-      usedTeamFilesRead,
-      usedTeamFilesWrite,
-      usedTeamFilesUse,
-      permissions,
-      databasePermissions,
-      tablePermissions,
-      filePermissions,
-      usedTeamFoldersRead,
-      usedTeamFoldersWrite,
-      usedTeamFoldersUse,
+      usedConnections = [],
+      usedUsers = [],
+      usedTeamFilesRead = [],
+      usedTeamFilesWrite = [],
+      usedTeamFilesUse = [],
+      permissions = [],
+      databasePermissions = [],
+      tablePermissions = [],
+      filePermissions = [],
+      usedTeamFoldersRead = [],
+      usedTeamFoldersWrite = [],
+      usedTeamFoldersUse = [],
     } = role;
     let id = role.id;
 
@@ -1087,7 +1116,9 @@ module.exports = {
     const role_connections = await storageSelectFmt(`select * from ~role_connections`);
     const user_connections = await storageSelectFmt(`select * from ~user_connections`);
     const user_roles = await storageSelectFmt(`select * from ~user_roles`);
-    const config = await storageSelectFmt(`select * from ~config`);
+    const config = (await storageSelectFmt(`select * from ~config`)).filter(
+      item => item.group != 'mcp' || item.key != 'tokenHash'
+    );
     const auth_methods_config = await storageSelectFmt(`select * from ~auth_methods_config`);
     const role_permissions = await storageSelectFmt(`select * from ~role_permissions`);
     const roles = await storageSelectFmt(`select * from ~roles`);

package/src/controllers/storageDb.js

@@ -11,6 +11,7 @@ const {
 const _ = require('lodash');
 const logger = getLogger('storageDb');
 const { extractConnectionSslParams } = require('../utility/connectUtility');
+const MCP_ROLE_ID = -4;
 
 async function getDbConnectionParams() {
   const server = process.env.STORAGE_SERVER;
@@ -553,6 +554,10 @@ async function storageCheckUserRoleConnectionAccess(userId, conid) {
   return respByUser.length > 0 || respByRole.length > 0 || respByLogged.length > 0;
 }
 
+async function storageCheckMcpConnectionAccess(req, conid) {
+  return storageCheckRoleConnectionAccess(MCP_ROLE_ID, conid);
+}
+
 async function storageCreateTeamFile({ fileType, file, data, ownerUserId, metadata, teamFolderId }) {
   const [conn, driver] = await getStorageConnection();
   if (!conn) {
@@ -1121,6 +1126,7 @@ module.exports = {
   resolvePermissionConnectionIds,
   storageCheckRoleConnectionAccess,
   storageCheckUserRoleConnectionAccess,
+  storageCheckMcpConnectionAccess,
   storageCreateTeamFile,
   storageGetExistingFile,
   storageGetTeamFileRoleAccess,

package/src/currentVersion.js

@@ -1,5 +1,5 @@
 
 module.exports = { 
-  version: '7.2.1',
-  buildTime: '2026-06-19T10:22:00.879Z'
+  version: '7.2.3',
+  buildTime: '2026-07-20T15:44:40.407Z'
 };

package/src/main.js

@@ -31,6 +31,8 @@ const scheduler = require('./controllers/scheduler');
 const queryHistory = require('./controllers/queryHistory');
 const cloud = require('./controllers/cloud');
 const teamFiles = require('./controllers/teamFiles');
+const mcpAdmin = require('./controllers/mcpAdmin');
+const mcp = require('./mcp');
 
 const onFinished = require('on-finished');
 const processArgs = require('./utility/processArgs');
@@ -94,6 +96,7 @@ function start() {
   // console.log('process.argv', process.argv);
 
   const app = express();
+  app.set('trust proxy', 'loopback, linklocal, uniquelocal');
 
   const server = http.createServer(app);
 
@@ -175,6 +178,17 @@ function start() {
   });
 
   app.use(bodyParser.json({ limit: '50mb' }));
+  app.use(bodyParser.urlencoded({ extended: false }));
+
+  app.get(getExpressPath('/.well-known/oauth-protected-resource'), mcp.handleOAuthProtectedResourceMetadata);
+  app.get(getExpressPath('/.well-known/oauth-protected-resource/mcp'), mcp.handleOAuthProtectedResourceMetadata);
+  app.get(getExpressPath('/.well-known/oauth-authorization-server'), mcp.handleOAuthAuthorizationServerMetadata);
+  app.get(getExpressPath('/.well-known/openid-configuration'), mcp.handleOAuthAuthorizationServerMetadata);
+  app.get(getExpressPath('/authorize'), mcp.handleOAuthAuthorize);
+  app.post(getExpressPath('/token'), mcp.handleOAuthToken);
+  app.get(getExpressPath('/mcp/oauth/authorize'), mcp.handleOAuthAuthorize);
+  app.post(getExpressPath('/mcp/oauth/token'), mcp.handleOAuthToken);
+  app.post(getExpressPath('/mcp'), mcp.handleMcpRequest);
 
   app.use(
     getExpressPath('/uploads'),
@@ -269,6 +283,7 @@ function useAllControllers(app, electron) {
   useController(app, electron, '/cloud', cloud);
   useController(app, electron, '/team-files', teamFiles);
   useController(app, electron, '/rest-connections', restConnections);
+  useController(app, electron, '/mcp-admin', mcpAdmin);
 }
 
 function setElectronSender(electronSender) {