ocean-brain 0.12.3 → 0.13.1

package/server/dist/modules/mcp-auth.js

@@ -44,64 +44,58 @@ const readBearerToken = (authorizationHeader) => {
   return authorizationHeader.slice("Bearer ".length).trim() || void 0;
 };
 const createMcpAuthMiddleware = (_authConfig, mcpAdminAuth) => {
-  return async (req, res, next) => {
-    try {
-      const status = await mcpAdminAuth.getStatus();
-      if (!status.enabled) {
-        res.status(403).set(JSON_HEADERS).json({
-          code: "MCP_DISABLED",
-          message: "MCP access is disabled by admin."
-        }).end();
-        return;
-      }
-      const bearerToken = readBearerToken(req.headers.authorization);
-      if (!bearerToken) {
-        res.status(401).set(JSON_HEADERS).json({
-          code: "UNAUTHORIZED",
-          message: "A valid MCP bearer token is required."
-        }).end();
-        return;
-      }
-      const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);
-      if (!validation.ok && validation.reason === "not_configured") {
-        res.status(503).set(JSON_HEADERS).json({
-          code: "MCP_AUTH_NOT_CONFIGURED",
-          message: "MCP bearer auth is not configured."
-        }).end();
-        return;
-      }
-      if (!validation.ok) {
-        res.status(403).set(JSON_HEADERS).json({
-          code: "FORBIDDEN",
-          message: "Invalid MCP bearer token."
-        }).end();
-        return;
-      }
-      const versionInfo = getOceanBrainVersionInfo();
-      const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
-      const mcpClientVersion = readMcpClientVersion(req);
-      if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
-        res.status(426).set(JSON_HEADERS).json({
-          code: "MCP_VERSION_INCOMPATIBLE",
-          message: createMcpVersionCompatibilityMessage({
-            serverVersion: versionInfo.version,
-            requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
-            mcpCompatibilityVersion,
-            mcpClientVersion
-          }),
+  return async (req, reply) => {
+    const status = await mcpAdminAuth.getStatus();
+    if (!status.enabled) {
+      await reply.status(403).headers(JSON_HEADERS).send({
+        code: "MCP_DISABLED",
+        message: "MCP access is disabled by admin."
+      });
+      return;
+    }
+    const bearerToken = readBearerToken(req.headers.authorization);
+    if (!bearerToken) {
+      await reply.status(401).headers(JSON_HEADERS).send({
+        code: "UNAUTHORIZED",
+        message: "A valid MCP bearer token is required."
+      });
+      return;
+    }
+    const validation = await mcpAdminAuth.validatePresentedToken(bearerToken);
+    if (!validation.ok && validation.reason === "not_configured") {
+      await reply.status(503).headers(JSON_HEADERS).send({
+        code: "MCP_AUTH_NOT_CONFIGURED",
+        message: "MCP bearer auth is not configured."
+      });
+      return;
+    }
+    if (!validation.ok) {
+      await reply.status(403).headers(JSON_HEADERS).send({
+        code: "FORBIDDEN",
+        message: "Invalid MCP bearer token."
+      });
+      return;
+    }
+    const versionInfo = getOceanBrainVersionInfo();
+    const mcpCompatibilityVersion = readMcpCompatibilityVersion(req);
+    const mcpClientVersion = readMcpClientVersion(req);
+    if (!mcpCompatibilityVersion || !isMcpVersionCompatible(versionInfo.mcp.compatibilityVersion, mcpCompatibilityVersion)) {
+      await reply.status(426).headers(JSON_HEADERS).send({
+        code: "MCP_VERSION_INCOMPATIBLE",
+        message: createMcpVersionCompatibilityMessage({
           serverVersion: versionInfo.version,
-          mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
-          mcpClientVersion: mcpClientVersion ?? null,
-          mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
-          requiredMcpVersion: versionInfo.mcpVersionRequirement,
           requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
-          releaseUrl: versionInfo.releaseUrl
-        }).end();
-        return;
-      }
-      next();
-    } catch (error) {
-      next(error);
+          mcpCompatibilityVersion,
+          mcpClientVersion
+        }),
+        serverVersion: versionInfo.version,
+        mcpVersion: mcpClientVersion ?? mcpCompatibilityVersion ?? null,
+        mcpClientVersion: mcpClientVersion ?? null,
+        mcpCompatibilityVersion: mcpCompatibilityVersion ?? null,
+        requiredMcpVersion: versionInfo.mcpVersionRequirement,
+        requiredMcpCompatibilityVersion: versionInfo.mcp.compatibilityRequirement,
+        releaseUrl: versionInfo.releaseUrl
+      });
     }
   };
 };

package/server/dist/modules/rate-limit.js

@@ -1,31 +1,31 @@
-import { rateLimit } from "express-rate-limit";
+import { isAuthenticatedRequest } from "./auth-guard.js";
+import { createAppError } from "./error-handler.js";
 const AUTH_RATE_LIMIT_MESSAGE = "Too many authentication attempts. Please try again later.";
 const SESSION_ACCESS_RATE_LIMIT_MESSAGE = "Too many authenticated requests. Please try again later.";
-const createAuthAttemptRateLimit = () => rateLimit({
-  windowMs: 15 * 60 * 1e3,
-  limit: 10,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).json({
-      code: "AUTH_RATE_LIMITED",
-      message: AUTH_RATE_LIMIT_MESSAGE
-    });
-  }
+const IMAGE_ASSET_RATE_LIMIT_MESSAGE = "Too many image asset requests. Please try again later.";
+const createOptions = (max, timeWindow, code, message, options = {}) => ({
+  max,
+  timeWindow,
+  hook: "preHandler",
+  enableDraftSpec: true,
+  errorResponseBuilder: (_request, context) => createAppError(context.statusCode, code, message),
+  ...options
 });
-const createSessionAccessRateLimit = () => rateLimit({
-  windowMs: 60 * 1e3,
-  limit: 300,
-  standardHeaders: true,
-  legacyHeaders: false,
-  handler: (_req, res) => {
-    res.status(429).json({
-      code: "SESSION_RATE_LIMITED",
-      message: SESSION_ACCESS_RATE_LIMIT_MESSAGE
-    });
-  }
+const createAuthAttemptRateLimit = () => createOptions(10, 15 * 60 * 1e3, "AUTH_RATE_LIMITED", AUTH_RATE_LIMIT_MESSAGE, {
+  groupId: "auth-attempt"
+});
+const createSessionAccessRateLimit = () => createOptions(300, 60 * 1e3, "SESSION_RATE_LIMITED", SESSION_ACCESS_RATE_LIMIT_MESSAGE, {
+  groupId: "session-access"
+});
+const createImageAssetRateLimit = (authConfig) => ({
+  ...createOptions(10, 15 * 60 * 1e3, "IMAGE_ASSET_RATE_LIMITED", IMAGE_ASSET_RATE_LIMIT_MESSAGE, {
+    groupId: "image-asset",
+    allowList: (request) => authConfig.mode !== "password" || isAuthenticatedRequest(request)
+  }),
+  hook: "onRequest"
 });
 export {
   createAuthAttemptRateLimit,
+  createImageAssetRateLimit,
   createSessionAccessRateLimit
 };

package/server/dist/modules/server-events-handler.js

@@ -12,23 +12,25 @@ const getEventStreamLifetimeMs = (expires) => {
   return Math.max(0, Math.min(expiresAt.getTime() - Date.now(), AUTH_SESSION_IDLE_TIMEOUT_MS));
 };
 const createServerEventsHandler = () => {
-  return async (req, res) => {
-    res.status(200);
-    res.setHeader("Content-Type", "text/event-stream; charset=utf-8");
-    res.setHeader("Cache-Control", "no-cache, no-transform");
-    res.setHeader("Connection", "keep-alive");
-    res.setHeader("X-Accel-Buffering", "no");
-    res.flushHeaders?.();
-    res.write(": connected\n\n");
+  return async (req, reply) => {
+    reply.hijack();
+    const response = reply.raw;
+    response.statusCode = 200;
+    response.setHeader("Content-Type", "text/event-stream; charset=utf-8");
+    response.setHeader("Cache-Control", "no-cache, no-transform");
+    response.setHeader("Connection", "keep-alive");
+    response.setHeader("X-Accel-Buffering", "no");
+    response.flushHeaders();
+    response.write(": connected\n\n");
     const unsubscribe = subscribeServerEvents((event) => {
-      res.write(serializeServerEvent(event));
+      response.write(serializeServerEvent(event));
     });
     const keepAliveTimer = setInterval(() => {
-      res.write(": keepalive\n\n");
+      response.write(": keepalive\n\n");
     }, KEEP_ALIVE_INTERVAL_MS);
     keepAliveTimer.unref?.();
     const sessionExpiryTimer = setTimeout(() => {
-      res.end();
+      response.end();
     }, getEventStreamLifetimeMs(req.session?.cookie.expires));
     sessionExpiryTimer.unref?.();
     let cleanedUp = false;
@@ -41,8 +43,8 @@ const createServerEventsHandler = () => {
       clearTimeout(sessionExpiryTimer);
       unsubscribe();
     };
-    req.on("close", cleanup);
-    res.on("close", cleanup);
+    req.raw.on("close", cleanup);
+    response.on("close", cleanup);
   };
 };
 export {

package/server/dist/modules/session-store.js

@@ -1,4 +1,3 @@
-import session from "express-session";
 const AUTH_SESSION_IDLE_TIMEOUT_MS = 7 * 24 * 60 * 60 * 1e3;
 const ANONYMOUS_SESSION_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
 const AUTH_SESSION_PRUNE_INTERVAL_MS = 60 * 60 * 1e3;
@@ -25,9 +24,8 @@ const getSessionExpiry = (data, now = Date.now()) => {
   }
   return fallbackExpiresAt;
 };
-class TtlMemorySessionStore extends session.Store {
+class TtlMemorySessionStore {
   constructor(options = {}) {
-    super();
     this.options = options;
     this.pruneTimer = setInterval(() => {
       this.pruneExpiredSessions();
@@ -54,7 +52,7 @@ class TtlMemorySessionStore extends session.Store {
       callback(error);
     }
   }
-  set(sid, data, callback) {
+  set(sid, data, callback = () => void 0) {
     try {
       const now = Date.now();
       this.sessions.set(sid, {
@@ -65,14 +63,14 @@ class TtlMemorySessionStore extends session.Store {
       });
       this.pruneExpiredSessions();
       this.evictOldestSessions();
-      callback?.();
+      callback();
     } catch (error) {
-      callback?.(error);
+      callback(error);
     }
   }
-  destroy(sid, callback) {
+  destroy(sid, callback = () => void 0) {
     this.sessions.delete(sid);
-    callback?.();
+    callback();
   }
   touch(sid, data, callback) {
     const entry = this.sessions.get(sid);

package/server/dist/paths.js

@@ -6,9 +6,10 @@ const DATA_DIR = process.env.OCEAN_BRAIN_DATA_DIR || ".";
 const IMAGE_DIR = process.env.OCEAN_BRAIN_IMAGE_DIR || path.resolve(DATA_DIR, "assets/images");
 const SEARCH_INDEX_PATH = process.env.OCEAN_BRAIN_SEARCH_INDEX_PATH || path.resolve(DATA_DIR, "search.sqlite3");
 const EMBEDDING_API_KEY_PATH = path.resolve(DATA_DIR, "embedding-api-key");
+const CLIENT_DIST = process.env.OCEAN_BRAIN_CLIENT_DIST || path.resolve(PACKAGE_ROOT, "client/dist");
 const paths = {
   packageRoot: path.resolve(PACKAGE_ROOT),
-  clientDist: path.resolve(PACKAGE_ROOT, "client/dist"),
+  clientDist: path.resolve(CLIENT_DIST),
   imageDir: path.resolve(IMAGE_DIR),
   searchIndex: path.resolve(SEARCH_INDEX_PATH),
   embeddingApiKey: path.resolve(EMBEDDING_API_KEY_PATH)

package/server/dist/routes/api.js

@@ -1,4 +1,3 @@
-import { Router } from "express";
 import { createLoginHandler, createLogoutHandler, createSessionStatusHandler } from "../features/auth/http/api.js";
 import { createUploadImageHandler } from "../features/image/http/upload.js";
 import {
@@ -17,78 +16,113 @@ import {
 import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
 import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
 import { createServerEventsHandler } from "../modules/server-events-handler.js";
-import useAsync from "../modules/use-async.js";
 import { createMcpRouter } from "./mcp.js";
 const createApiRouter = (authConfig, mcpAdminService) => {
-  const csrfProtection = createCsrfProtection(authConfig);
-  const requireSession = requireSessionForWrite(authConfig);
-  const sessionAccessRateLimit = createSessionAccessRateLimit();
-  return Router().use("/mcp", createMcpRouter(authConfig, mcpAdminService)).get("/auth/session", csrfProtection, useAsync(createSessionStatusHandler(authConfig))).post("/auth/login", csrfProtection, createAuthAttemptRateLimit(), useAsync(createLoginHandler(authConfig))).post(
-    "/auth/logout",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createLogoutHandler(authConfig))
-  ).get(
-    "/mcp-admin/status",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminStatusHandler(mcpAdminService))
-  ).post(
-    "/mcp-admin/enabled",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminSetEnabledHandler(mcpAdminService))
-  ).post(
-    "/mcp-admin/token/rotate",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminRotateTokenHandler(mcpAdminService))
-  ).post(
-    "/mcp-admin/token/revoke",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createMcpAdminRevokeTokenHandler(mcpAdminService))
-  ).get(
-    "/search-admin/status",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminStatusHandler())
-  ).post(
-    "/search-admin/config",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminSaveConfigHandler())
-  ).post(
-    "/search-admin/models",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminListModelsHandler())
-  ).post(
-    "/search-admin/test",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminTestConnectionHandler())
-  ).post(
-    "/search-admin/reindex",
-    sessionAccessRateLimit,
-    requireSession,
-    csrfProtection,
-    useAsync(createSearchAdminReindexHandler())
-  ).post("/image", sessionAccessRateLimit, requireSession, csrfProtection, useAsync(createUploadImageHandler())).get("/events", sessionAccessRateLimit, requireSession, csrfProtection, createServerEventsHandler()).use((_req, res) => {
-    res.status(404).json({
-      code: "API_ROUTE_NOT_FOUND",
-      message: "The requested API route was not found."
-    }).end();
-  });
+  return async (app) => {
+    const csrfProtection = createCsrfProtection(authConfig);
+    const requireSession = requireSessionForWrite(authConfig);
+    const sessionAccessRateLimit = app.rateLimit(createSessionAccessRateLimit());
+    app.register(createMcpRouter(authConfig, mcpAdminService), { prefix: "/mcp" });
+    app.get("/auth/session", createSessionStatusHandler(authConfig));
+    app.post(
+      "/auth/login",
+      {
+        preHandler: csrfProtection,
+        config: { rateLimit: createAuthAttemptRateLimit() }
+      },
+      createLoginHandler(authConfig)
+    );
+    app.post(
+      "/auth/logout",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createLogoutHandler(authConfig)
+    );
+    app.get(
+      "/mcp-admin/status",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession]
+      },
+      createMcpAdminStatusHandler(mcpAdminService)
+    );
+    app.post(
+      "/mcp-admin/enabled",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createMcpAdminSetEnabledHandler(mcpAdminService)
+    );
+    app.post(
+      "/mcp-admin/token/rotate",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createMcpAdminRotateTokenHandler(mcpAdminService)
+    );
+    app.post(
+      "/mcp-admin/token/revoke",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createMcpAdminRevokeTokenHandler(mcpAdminService)
+    );
+    app.get(
+      "/search-admin/status",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession]
+      },
+      createSearchAdminStatusHandler()
+    );
+    app.post(
+      "/search-admin/config",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminSaveConfigHandler()
+    );
+    app.post(
+      "/search-admin/models",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminListModelsHandler()
+    );
+    app.post(
+      "/search-admin/test",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminTestConnectionHandler()
+    );
+    app.post(
+      "/search-admin/reindex",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createSearchAdminReindexHandler()
+    );
+    app.post(
+      "/image",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession, csrfProtection]
+      },
+      createUploadImageHandler()
+    );
+    app.get(
+      "/events",
+      {
+        preHandler: [sessionAccessRateLimit, requireSession]
+      },
+      createServerEventsHandler()
+    );
+    app.all("/*", (_request, reply) => {
+      return reply.status(404).send({
+        code: "API_ROUTE_NOT_FOUND",
+        message: "The requested API route was not found."
+      });
+    });
+  };
 };
 export {
   createApiRouter

package/server/dist/routes/auth-pages.js

@@ -1,21 +1,31 @@
-import { Router } from "express";
 import {
   createLoginPageHandler,
   createLoginPageSubmitHandler,
   createLogoutPageHandler
 } from "../features/auth/http/pages.js";
-import { createCsrfProtection, createLoginCsrfFailureHandler, requireSessionForWrite } from "../modules/auth-guard.js";
+import { createCsrfProtection, requireSessionForWrite } from "../modules/auth-guard.js";
 import { createAuthAttemptRateLimit, createSessionAccessRateLimit } from "../modules/rate-limit.js";
 const createAuthPagesRouter = (authConfig) => {
-  const csrfProtection = createCsrfProtection(authConfig);
-  const sessionAccessRateLimit = createSessionAccessRateLimit();
-  return Router().get("/login", csrfProtection, createLoginPageHandler(authConfig)).post("/login", csrfProtection, createAuthAttemptRateLimit(), createLoginPageSubmitHandler(authConfig)).post(
-    "/logout",
-    sessionAccessRateLimit,
-    requireSessionForWrite(authConfig),
-    csrfProtection,
-    createLogoutPageHandler(authConfig)
-  ).use(createLoginCsrfFailureHandler(authConfig));
+  return async (app) => {
+    const csrfProtection = createCsrfProtection(authConfig);
+    app.get("/login", createLoginPageHandler(authConfig));
+    app.post(
+      "/login",
+      {
+        preHandler: csrfProtection,
+        config: { rateLimit: createAuthAttemptRateLimit() }
+      },
+      createLoginPageSubmitHandler(authConfig)
+    );
+    app.post(
+      "/logout",
+      {
+        preHandler: [requireSessionForWrite(authConfig), csrfProtection],
+        config: { rateLimit: createSessionAccessRateLimit() }
+      },
+      createLogoutPageHandler(authConfig)
+    );
+  };
 };
 export {
   createAuthPagesRouter