omni-notify-mcp 1.3.21 → 1.3.22

package/dist/ui/server.js

@@ -152,32 +152,37 @@ const LEGACY_SECRETS_PATH = join(homedir(), ".notify-mcp-secrets");
 function e164(s) {
     return String(s ?? "").replace(/[^\d+]/g, "");
 }
+// The ONE list of credential-shaped fields, read by both maskSecrets() (out)
+// and mergePreservingSecrets() (back in). Before story #442 these were two
+// hand-written lists of `if`/`guard` calls kept in sync by hand — that's
+// exactly how ntfy.token got added to a channel (story #427's "brainless
+// config" import) without ever being added to either list, and leaked in the
+// clear over `GET /api/config` for as long as the channel existed. A field
+// belongs here the moment its channel gets one that authenticates outbound
+// (a token, password, or bearer webhook URL) — see
+// tests/smoke.test.mjs's naming-convention test, which independently catches
+// a field like this one being added to defaultConfig() but not to this list.
+const SENSITIVE_FIELDS = [
+    ["email", "pass"],
+    ["email", "clientSecret"],
+    ["email", "refreshToken"],
+    ["email", "accessToken"],
+    ["sms", "secretAccessKey"],
+    ["telegram", "token"],
+    ["ntfy", "token"],
+    ["discord", "webhookUrl"],
+    ["discord", "clientSecret"],
+    ["slack", "webhookUrl"],
+    ["slack", "botToken"],
+    ["slack", "clientSecret"],
+    ["teams", "webhookUrl"],
+];
 function maskSecrets(config) {
     const c = JSON.parse(JSON.stringify(config));
-    if (c.email?.pass)
-        c.email.pass = MASKED;
-    if (c.email?.clientSecret)
-        c.email.clientSecret = MASKED;
-    if (c.email?.refreshToken)
-        c.email.refreshToken = MASKED;
-    if (c.email?.accessToken)
-        c.email.accessToken = MASKED;
-    if (c.sms?.secretAccessKey)
-        c.sms.secretAccessKey = MASKED;
-    if (c.telegram?.token)
-        c.telegram.token = MASKED;
-    if (c.discord?.webhookUrl)
-        c.discord.webhookUrl = MASKED;
-    if (c.discord?.clientSecret)
-        c.discord.clientSecret = MASKED;
-    if (c.slack?.webhookUrl)
-        c.slack.webhookUrl = MASKED;
-    if (c.slack?.botToken)
-        c.slack.botToken = MASKED;
-    if (c.slack?.clientSecret)
-        c.slack.clientSecret = MASKED;
-    if (c.teams?.webhookUrl)
-        c.teams.webhookUrl = MASKED;
+    for (const [sec, field] of SENSITIVE_FIELDS) {
+        if (c[sec]?.[field])
+            c[sec][field] = MASKED;
+    }
     delete c.whatsapp;
     return c;
 }
@@ -192,24 +197,11 @@ function mergePreservingSecrets(existing, update) {
     }
     if (typeof update.muteAll === "boolean")
         merged.muteAll = update.muteAll;
-    const guard = (path) => {
-        const [sec, field] = path;
+    for (const [sec, field] of SENSITIVE_FIELDS) {
         if (update[sec]?.[field] === MASKED) {
             merged[sec][field] = existing[sec]?.[field] ?? "";
         }
-    };
-    guard(["email", "pass"]);
-    guard(["email", "clientSecret"]);
-    guard(["email", "refreshToken"]);
-    guard(["email", "accessToken"]);
-    guard(["sms", "secretAccessKey"]);
-    guard(["telegram", "token"]);
-    guard(["discord", "webhookUrl"]);
-    guard(["discord", "clientSecret"]);
-    guard(["slack", "webhookUrl"]);
-    guard(["slack", "botToken"]);
-    guard(["slack", "clientSecret"]);
-    guard(["teams", "webhookUrl"]);
+    }
     return merged;
 }
 const app = express();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omni-notify-mcp",
-  "version": "1.3.21",
+  "version": "1.3.22",
   "description": "Reach your AI agents from anywhere — and let them reach you. Every notification channel is set up in one config UI with one-click server launch: desktop, Telegram, Slack, SMS, email, ntfy. Agents then notify you when long work finishes or a decision is needed, ask you a question and wait for your answer, and receive and reply to the messages you send them — with Do Not Disturb and idle detection deciding what actually gets through.",
   "main": "dist/index.js",
   "type": "module",