paygate-mcp 2.9.0 → 3.1.0

package/dist/server.js

@@ -45,6 +45,7 @@ const alerts_1 = require("./alerts");
 const teams_1 = require("./teams");
 const redis_client_1 = require("./redis-client");
 const redis_sync_1 = require("./redis-sync");
+const tokens_1 = require("./tokens");
 /** Max request body size: 1MB */
 const MAX_BODY_SIZE = 1_048_576;
 class PayGateServer {
@@ -75,6 +76,8 @@ class PayGateServer {
     teams;
     /** Redis sync adapter for distributed state (null if not using Redis) */
     redisSync = null;
+    /** Scoped token manager for short-lived delegated tokens */
+    tokens;
     /** Server start time (ms since epoch) */
     startedAt = Date.now();
     /** Whether the server is draining (shutting down gracefully) */
@@ -158,6 +161,11 @@ class PayGateServer {
         this.gate.teamRecorder = (apiKey, credits) => {
             this.teams.recordUsage(apiKey, credits);
         };
+        // Scoped token manager (uses admin key as signing secret, padded to min length)
+        const tokenSecret = this.adminKey.length >= 8
+            ? this.adminKey
+            : this.adminKey + require('crypto').randomBytes(8).toString('hex');
+        this.tokens = new tokens_1.ScopedTokenManager(tokenSecret);
         // Redis distributed state (if configured)
         if (redisUrl) {
             const redisOpts = (0, redis_client_1.parseRedisUrl)(redisUrl);
@@ -173,6 +181,10 @@ class PayGateServer {
             this.gate.onCreditsDeducted = (apiKey, amount) => {
                 sync.atomicDeduct(apiKey, amount).catch(() => { });
             };
+            // Wire token revocation sync: incoming pub/sub → local revocation list
+            sync.onTokenRevoked = (fingerprint, expiresAt, revokedAt, reason) => {
+                this.tokens.revocationList.addEntry({ fingerprint, expiresAt, revokedAt, reason });
+            };
         }
     }
     async start() {
@@ -309,6 +321,15 @@ class PayGateServer {
             // ─── Multi-tenant namespace endpoints ──────────────────────────────
             case '/namespaces':
                 return this.handleListNamespaces(req, res);
+            // ─── Scoped token endpoints ────────────────────────────────────────
+            case '/tokens':
+                if (req.method === 'POST')
+                    return this.handleCreateToken(req, res);
+                break;
+            case '/tokens/revoke':
+                return this.handleRevokeToken(req, res);
+            case '/tokens/revoked':
+                return this.handleListRevokedTokens(req, res);
             // ─── OAuth 2.1 endpoints ─────────────────────────────────────────
             case '/.well-known/oauth-authorization-server':
                 return this.handleOAuthMetadata(req, res);
@@ -372,6 +393,8 @@ class PayGateServer {
         // Extract client IP for IP allowlist checking
         const clientIp = req.headers['x-forwarded-for']?.split(',')[0]?.trim()
             || req.socket.remoteAddress || '';
+        // Extract scoped token tool restrictions (set by resolveApiKey)
+        const scopedTokenTools = req._scopedTokenTools;
         // ─── Batch tool calls ────────────────────────────────────────────────
         if (request.method === 'tools/call_batch') {
             const params = request.params;
@@ -387,7 +410,7 @@ class PayGateServer {
                 res.end(JSON.stringify(errResp));
                 return;
             }
-            const batchResponse = await this.handler.handleBatchRequest(calls, request.id, apiKey, clientIp);
+            const batchResponse = await this.handler.handleBatchRequest(calls, request.id, apiKey, clientIp, scopedTokenTools);
             // Audit + metrics for batch
             if (batchResponse.error) {
                 this.audit.log('gate.deny', (0, audit_1.maskKeyForAudit)(apiKey || 'anonymous'), `Batch denied (${calls.length} calls)`, {
@@ -429,7 +452,7 @@ class PayGateServer {
             }
             return;
         }
-        const response = await this.handler.handleRequest(request, apiKey, clientIp);
+        const response = await this.handler.handleRequest(request, apiKey, clientIp, scopedTokenTools);
         // Inject pricing metadata into tools/list responses
         if (request.method === 'tools/list' && response.result) {
             const result = response.result;
@@ -577,17 +600,42 @@ class PayGateServer {
         res.end(JSON.stringify({ message: 'Session terminated' }));
     }
     /**
-     * Resolve API key from X-API-Key header or OAuth Bearer token.
+     * Resolve API key from X-API-Key header, scoped token, or OAuth Bearer token.
+     * Priority: X-API-Key → pgt_ scoped token → OAuth Bearer token.
+     * Also stores resolved token metadata for ACL narrowing.
      */
     resolveApiKey(req) {
         let apiKey = req.headers['x-api-key'] || null;
-        if (!apiKey && this.oauth) {
+        // Check if X-API-Key is actually a scoped token
+        if (apiKey && tokens_1.ScopedTokenManager.isToken(apiKey)) {
+            const validation = this.tokens.validate(apiKey);
+            if (validation.valid && validation.payload) {
+                // Store token metadata on request for ACL narrowing
+                req._scopedTokenTools = validation.payload.allowedTools;
+                return validation.payload.apiKey;
+            }
+            return null; // Invalid/expired token
+        }
+        // Check Bearer token (OAuth or scoped token)
+        if (!apiKey) {
             const authHeader = req.headers['authorization'];
             if (authHeader?.startsWith('Bearer ')) {
                 const bearerToken = authHeader.slice(7);
-                const tokenInfo = this.oauth.validateToken(bearerToken);
-                if (tokenInfo) {
-                    apiKey = tokenInfo.apiKey;
+                // Try scoped token first
+                if (tokens_1.ScopedTokenManager.isToken(bearerToken)) {
+                    const validation = this.tokens.validate(bearerToken);
+                    if (validation.valid && validation.payload) {
+                        req._scopedTokenTools = validation.payload.allowedTools;
+                        return validation.payload.apiKey;
+                    }
+                    return null;
+                }
+                // Fall back to OAuth
+                if (this.oauth) {
+                    const tokenInfo = this.oauth.validateToken(bearerToken);
+                    if (tokenInfo) {
+                        apiKey = tokenInfo.apiKey;
+                    }
                 }
             }
         }
@@ -669,6 +717,9 @@ class PayGateServer {
                 teamsAssign: 'POST /teams/assign — Assign key to team (requires X-Admin-Key)',
                 teamsRemove: 'POST /teams/remove — Remove key from team (requires X-Admin-Key)',
                 teamsUsage: 'GET /teams/usage?teamId=... — Team usage summary (requires X-Admin-Key)',
+                createToken: 'POST /tokens — Create scoped token (requires X-Admin-Key)',
+                revokeToken: 'POST /tokens/revoke — Revoke a scoped token (requires X-Admin-Key)',
+                listRevokedTokens: 'GET /tokens/revoked — List revoked tokens (requires X-Admin-Key)',
                 ...(this.oauth ? {
                     oauthMetadata: 'GET /.well-known/oauth-authorization-server — OAuth 2.1 server metadata',
                     oauthRegister: 'POST /oauth/register — Register OAuth client',
@@ -2177,6 +2228,135 @@ class PayGateServer {
         res.writeHead(200, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ namespaces, count: namespaces.length }, null, 2));
     }
+    // ─── /tokens — Create scoped token ──────────────────────────────────────────
+    async handleCreateToken(req, res) {
+        if (!this.checkAdmin(req, res))
+            return;
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.key) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required param: key (API key to delegate from)' }));
+            return;
+        }
+        // Verify the parent key exists and is active
+        const keyRecord = this.gate.store.getKey(params.key);
+        if (!keyRecord || !keyRecord.active) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'API key not found or inactive' }));
+            return;
+        }
+        const ttl = Math.max(1, Math.min(86400, Math.floor(Number(params.ttl) || 3600)));
+        const token = this.tokens.create({
+            apiKey: params.key,
+            ttlSeconds: ttl,
+            allowedTools: params.allowedTools,
+            label: params.label,
+        });
+        this.audit.log('token.created', 'admin', `Scoped token created for key: ${keyRecord.name}`, {
+            keyMasked: (0, audit_1.maskKeyForAudit)(params.key),
+            ttl,
+            allowedTools: params.allowedTools,
+            label: params.label,
+        });
+        res.writeHead(201, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            token,
+            expiresAt: new Date(Date.now() + ttl * 1000).toISOString(),
+            ttl,
+            parentKey: keyRecord.name,
+            allowedTools: params.allowedTools || [],
+            label: params.label || null,
+            message: 'Use this token as X-API-Key or Bearer token. It will expire automatically.',
+        }));
+    }
+    // ─── /tokens/revoke — Revoke a scoped token ────────────────────────────────
+    async handleRevokeToken(req, res) {
+        if (req.method !== 'POST') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        const body = await this.readBody(req);
+        let params;
+        try {
+            params = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        if (!params.token) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Missing required param: token' }));
+            return;
+        }
+        // Validate that it's a real, validly-signed token (even if expired)
+        if (!tokens_1.ScopedTokenManager.isToken(params.token)) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Not a scoped token (must start with pgt_)' }));
+            return;
+        }
+        const entry = this.tokens.revokeToken(params.token, params.reason);
+        if (!entry) {
+            // Already revoked or invalid signature
+            res.writeHead(409, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Token already revoked or invalid signature' }));
+            return;
+        }
+        this.audit.log('token.revoked', 'admin', `Scoped token revoked`, {
+            fingerprint: entry.fingerprint.slice(0, 12) + '...',
+            expiresAt: entry.expiresAt,
+            reason: entry.reason,
+        });
+        // Sync to Redis so other instances reject this token too
+        if (this.redisSync) {
+            this.redisSync.publishEvent({
+                type: 'token_revoked',
+                key: entry.fingerprint,
+                data: { expiresAt: entry.expiresAt, revokedAt: entry.revokedAt, reason: entry.reason },
+            }).catch(() => { });
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            message: 'Token revoked',
+            fingerprint: entry.fingerprint,
+            expiresAt: entry.expiresAt,
+            revokedAt: entry.revokedAt,
+        }));
+    }
+    // ─── /tokens/revoked — List revoked tokens ─────────────────────────────────
+    handleListRevokedTokens(req, res) {
+        if (req.method !== 'GET') {
+            res.writeHead(405, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Method not allowed' }));
+            return;
+        }
+        if (!this.checkAdmin(req, res))
+            return;
+        const entries = this.tokens.revocationList.list();
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            count: entries.length,
+            entries: entries.map(e => ({
+                fingerprint: e.fingerprint,
+                expiresAt: e.expiresAt,
+                revokedAt: e.revokedAt,
+                reason: e.reason || null,
+            })),
+        }));
+    }
     /**
      * Sync a key mutation to Redis. Call after any local KeyStore mutation
      * (setAcl, setExpiry, setQuota, setTags, setIpAllowlist, setSpendingLimit).
@@ -2215,6 +2395,7 @@ class PayGateServer {
         this.oauth?.destroy();
         this.sessions.destroy();
         this.audit.destroy();
+        this.tokens.destroy();
         if (this.redisSync) {
             await this.redisSync.destroy();
         }
@@ -2265,6 +2446,7 @@ class PayGateServer {
         this.oauth?.destroy();
         this.sessions.destroy();
         this.audit.destroy();
+        this.tokens.destroy();
         if (this.redisSync) {
             await this.redisSync.destroy();
         }