veryfront 0.1.80 → 0.1.81

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.80",
+    "version": "0.1.81",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "exclude": [

package/esm/src/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAOzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAInC;;;OAGG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBhG,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,UAAU;YAYJ,SAAS;IA2BvB,OAAO,CAAC,QAAQ;IAmChB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAuCjB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IAsD5E,OAAO,CAAC,qBAAqB;YAkBf,YAAY;IAe1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,cAAc;YAYR,oBAAoB;CA0BnC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/src/mcp/server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAG/C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAI7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAOzE,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;AAOzD,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,SAAS;IACpB,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,iBAAiB,CAAC,CAA0B;IACpD,OAAO,CAAC,kBAAkB,CAAS;gBAEvB,MAAM,EAAE,eAAe;IAQnC;;;OAGG;IACH,oBAAoB,CAAC,MAAM,EAAE,uBAAuB,GAAG,IAAI;IAK3D,aAAa,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAsBhG,OAAO,CAAC,QAAQ;IA8BhB,OAAO,CAAC,UAAU;YAYJ,SAAS;IA2BvB,OAAO,CAAC,QAAQ;IAmChB,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,YAAY;IA6CpB,OAAO,CAAC,WAAW;IAcnB,OAAO,CAAC,SAAS;IAuCjB,iBAAiB,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IA+E5E,OAAO,CAAC,qBAAqB;YAkBf,YAAY;IAoB1B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,cAAc;YAqBR,oBAAoB;CA0BnC;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAElE"}

package/esm/src/mcp/server.js

@@ -9,6 +9,9 @@ import { withSpan } from "../observability/tracing/otlp-setup.js";
 import { VERSION } from "../utils/version.js";
 import { validateContentType } from "../security/input-validation/limits.js";
 import { VeryfrontError } from "../security/input-validation/errors.js";
+import { logger as baseLogger } from "../utils/index.js";
+const logger = baseLogger.component("mcp-server");
+const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
 function asParamsRecord(params) {
     if (!params || Array.isArray(params))
         return {};
@@ -20,6 +23,9 @@ export class MCPServer {
     integrationsLoaded = false;
     constructor(config) {
         this.config = config;
+        if (!config.auth || config.auth.type === "none") {
+            logger.warn("MCP server has no authentication configured — all requests will be accepted");
+        }
     }
     /**
      * Configure integration tools to be lazily loaded on first tools/list call.
@@ -207,13 +213,23 @@ export class MCPServer {
     }
     createHTTPHandler() {
         return async (request) => {
+            const requestOrigin = request.headers.get("Origin");
             if (request.method === "OPTIONS")
-                return this.handleCORS();
+                return this.handleCORS(requestOrigin);
             if (this.config.auth?.type && this.config.auth.type !== "none") {
                 const authorized = await this.validateAuth(request);
                 if (!authorized)
                     return new dntShim.Response("Unauthorized", { status: 401 });
             }
+            // Enforce request body size limit (fast path via Content-Length header)
+            const contentLength = request.headers.get("content-length");
+            if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
+                return new dntShim.Response(JSON.stringify({
+                    jsonrpc: "2.0",
+                    id: null,
+                    error: { code: -32600, message: "Request body too large" },
+                }), { status: 413, headers: { "Content-Type": "application/json" } });
+            }
             try {
                 validateContentType(request, "application/json");
             }
@@ -227,7 +243,15 @@ export class MCPServer {
             }
             let rpcRequest;
             try {
-                rpcRequest = await request.json();
+                const bodyText = await request.text();
+                if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
+                    return new dntShim.Response(JSON.stringify({
+                        jsonrpc: "2.0",
+                        id: null,
+                        error: { code: -32600, message: "Request body too large" },
+                    }), { status: 413, headers: { "Content-Type": "application/json" } });
+                }
+                rpcRequest = JSON.parse(bodyText);
             }
             catch (_) {
                 // expected: malformed JSON in request body
@@ -246,7 +270,7 @@ export class MCPServer {
             return new dntShim.Response(JSON.stringify(rpcResponse), {
                 headers: {
                     "Content-Type": "application/json",
-                    ...this.getCORSHeaders(),
+                    ...this.getCORSHeaders(requestOrigin),
                 },
             });
         };
@@ -275,21 +299,33 @@ export class MCPServer {
         if (auth.type !== "bearer")
             return false;
         const token = authHeader.replace("Bearer ", "");
-        if (!auth.validate)
+        // When bearer auth is configured without a validate function, reject all requests
+        if (!auth.validate) {
+            logger.warn("Bearer auth configured without validate function — rejecting request");
             return false;
+        }
         return await auth.validate(token);
     }
-    handleCORS() {
-        return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders() });
+    handleCORS(requestOrigin) {
+        return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
     }
-    getCORSHeaders() {
+    getCORSHeaders(requestOrigin) {
         if (!this.config.cors?.enabled)
             return {};
-        const origin = this.config.cors.origins?.[0] ?? "*";
+        const origins = this.config.cors.origins;
+        if (!origins || origins.length === 0)
+            return {};
+        // Match request origin against the configured origins list
+        const matchedOrigin = requestOrigin && origins.includes(requestOrigin)
+            ? requestOrigin
+            : undefined;
+        if (!matchedOrigin)
+            return {};
         return {
-            "Access-Control-Allow-Origin": origin,
+            "Access-Control-Allow-Origin": matchedOrigin,
             "Access-Control-Allow-Methods": "POST, OPTIONS",
             "Access-Control-Allow-Headers": "Content-Type, Authorization, X-End-User-Id, X-Project-Id",
+            "Vary": "Origin",
         };
     }
     async loadIntegrationTools(config) {

package/esm/src/proxy/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,kCAAkC,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,eAAO,MAAM,sBAAsB,0MAYzB,CAAC;AA6EX,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA4CD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;0BA6K1B,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,YAAY,CAAC;0BA+NvC,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;;;0BAjVrD,MAAM,EAAE;;EA+XpC;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAwB7F"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../../src/src/proxy/handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,kCAAkC,CAAC;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQnD,eAAO,MAAM,sBAAsB,0MAYzB,CAAC;AAoGX,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC9D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAC7D,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CAC9E;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AA8ED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB;0BAiL1B,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,YAAY,CAAC;0BA+NvC,OAAO,CAAC,OAAO,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;;;;;;;;0BArVrD,MAAM,EAAE;;EAmYpC;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEjE,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAwB7F"}

package/esm/src/proxy/handler.js

@@ -6,7 +6,7 @@ import { cwd, getEnv } from "../platform/compat/process.js";
 import { join } from "../platform/compat/path/index.js";
 import { injectContext, ProxySpanNames, withSpan } from "./tracing.js";
 import { computeContentSourceId } from "../cache/keys.js";
-import { jwtVerify } from "jose";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 export const INTERNAL_PROXY_HEADERS = [
     "x-token",
     "x-project-slug",
@@ -20,6 +20,26 @@ export const INTERNAL_PROXY_HEADERS = [
     "x-branch-id",
     "x-branch-name",
 ];
+const remoteJwksByUrl = new Map();
+function getApiJwks(apiBaseUrl, logger) {
+    try {
+        const normalizedBaseUrl = apiBaseUrl.endsWith("/") ? apiBaseUrl : `${apiBaseUrl}/`;
+        const jwksUrl = new URL(".well-known/jwks.json", normalizedBaseUrl);
+        const cacheKey = jwksUrl.toString();
+        let jwks = remoteJwksByUrl.get(cacheKey);
+        if (!jwks) {
+            jwks = createRemoteJWKSet(jwksUrl);
+            remoteJwksByUrl.set(cacheKey, jwks);
+        }
+        return jwks;
+    }
+    catch (error) {
+        logger?.error("Invalid API base URL for JWKS lookup", error, {
+            apiBaseUrl,
+        });
+        return undefined;
+    }
+}
 async function lookupProjectByDomain(domain, apiBaseUrl, token, logger) {
     return withSpan(ProxySpanNames.PROXY_DOMAIN_LOOKUP, async () => {
         const domainWithoutPort = domain.replace(/:\d+$/, "");
@@ -70,7 +90,38 @@ function extractUserToken(cookieHeader) {
     const match = cookieHeader.match(/(?:^|;\s*)authToken=([^;]+)/);
     return match?.[1] ? decodeURIComponent(match[1]) : undefined;
 }
-async function extractUserIdFromToken(token, log) {
+async function extractUserIdFromToken(token, apiBaseUrl, log) {
+    let algorithm;
+    try {
+        algorithm = decodeProtectedHeader(token).alg;
+    }
+    catch (error) {
+        log?.debug("Failed to decode JWT header", {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return undefined;
+    }
+    if (algorithm === "RS256") {
+        const jwks = getApiJwks(apiBaseUrl, log);
+        if (!jwks)
+            return undefined;
+        try {
+            const { payload } = await jwtVerify(token, jwks, {
+                algorithms: ["RS256"],
+            });
+            return payload.userId;
+        }
+        catch (error) {
+            log?.debug("RS256 JWT verification failed", {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return undefined;
+        }
+    }
+    if (algorithm !== "HS256") {
+        log?.debug("Unsupported JWT algorithm", { algorithm: algorithm ?? null });
+        return undefined;
+    }
     const jwtSecret = getEnv("JWT_SECRET");
     if (!jwtSecret) {
         log?.warn("JWT_SECRET not configured — cannot verify user token");
@@ -184,7 +235,7 @@ export function createProxyHandler(options) {
             });
             return { status: 302, message: "Authentication required", redirectUrl };
         }
-        const userId = await extractUserIdFromToken(userToken, logger);
+        const userId = await extractUserIdFromToken(userToken, config.apiBaseUrl, logger);
         if (!userId) {
             const redirectUrl = makeAuthRedirectUrl(req);
             logger?.info("Could not extract userId from token", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "veryfront",
-  "version": "0.1.80",
+  "version": "0.1.81",
   "description": "The simplest way to build AI-powered apps",
   "keywords": [
     "react",

package/src/deno.js

@@ -1,6 +1,6 @@
 export default {
   "name": "veryfront",
-  "version": "0.1.80",
+  "version": "0.1.81",
   "license": "Apache-2.0",
   "nodeModulesDir": "auto",
   "exclude": [

package/src/src/mcp/server.ts

@@ -12,6 +12,11 @@ import { VERSION } from "../utils/version.js";
 import { validateContentType } from "../security/input-validation/limits.js";
 import { VeryfrontError } from "../security/input-validation/errors.js";
 import type { IntegrationRuntimeConfig } from "../integrations/types.js";
+import { logger as baseLogger } from "../utils/index.js";
+
+const logger = baseLogger.component("mcp-server");
+
+const MAX_REQUEST_BODY_SIZE = 1_048_576; // 1 MB
 
 type JSONRPCParams = Record<string, unknown> | unknown[];
 
@@ -51,6 +56,10 @@ export class MCPServer {
 
   constructor(config: MCPServerConfig) {
     this.config = config;
+
+    if (!config.auth || config.auth.type === "none") {
+      logger.warn("MCP server has no authentication configured — all requests will be accepted");
+    }
   }
 
   /**
@@ -304,13 +313,27 @@ export class MCPServer {
 
   createHTTPHandler(): (request: dntShim.Request) => Promise<dntShim.Response> {
     return async (request: dntShim.Request) => {
-      if (request.method === "OPTIONS") return this.handleCORS();
+      const requestOrigin = request.headers.get("Origin");
+      if (request.method === "OPTIONS") return this.handleCORS(requestOrigin);
 
       if (this.config.auth?.type && this.config.auth.type !== "none") {
         const authorized = await this.validateAuth(request);
         if (!authorized) return new dntShim.Response("Unauthorized", { status: 401 });
       }
 
+      // Enforce request body size limit (fast path via Content-Length header)
+      const contentLength = request.headers.get("content-length");
+      if (contentLength && Number(contentLength) > MAX_REQUEST_BODY_SIZE) {
+        return new dntShim.Response(
+          JSON.stringify({
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32600, message: "Request body too large" },
+          }),
+          { status: 413, headers: { "Content-Type": "application/json" } },
+        );
+      }
+
       try {
         validateContentType(request, "application/json");
       } catch (error) {
@@ -327,7 +350,18 @@ export class MCPServer {
 
       let rpcRequest: JSONRPCRequest;
       try {
-        rpcRequest = await request.json();
+        const bodyText = await request.text();
+        if (bodyText.length > MAX_REQUEST_BODY_SIZE) {
+          return new dntShim.Response(
+            JSON.stringify({
+              jsonrpc: "2.0",
+              id: null,
+              error: { code: -32600, message: "Request body too large" },
+            }),
+            { status: 413, headers: { "Content-Type": "application/json" } },
+          );
+        }
+        rpcRequest = JSON.parse(bodyText) as JSONRPCRequest;
       } catch (_) {
         // expected: malformed JSON in request body
         return new dntShim.Response(
@@ -350,7 +384,7 @@ export class MCPServer {
       return new dntShim.Response(JSON.stringify(rpcResponse), {
         headers: {
           "Content-Type": "application/json",
-          ...this.getCORSHeaders(),
+          ...this.getCORSHeaders(requestOrigin),
         },
       });
     };
@@ -384,24 +418,38 @@ export class MCPServer {
     if (auth.type !== "bearer") return false;
 
     const token = authHeader.replace("Bearer ", "");
-    if (!auth.validate) return false;
+
+    // When bearer auth is configured without a validate function, reject all requests
+    if (!auth.validate) {
+      logger.warn("Bearer auth configured without validate function — rejecting request");
+      return false;
+    }
 
     return await auth.validate(token);
   }
 
-  private handleCORS(): dntShim.Response {
-    return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders() });
+  private handleCORS(requestOrigin?: string | null): dntShim.Response {
+    return new dntShim.Response(null, { status: 204, headers: this.getCORSHeaders(requestOrigin) });
   }
 
-  private getCORSHeaders(): Record<string, string> {
+  private getCORSHeaders(requestOrigin?: string | null): Record<string, string> {
     if (!this.config.cors?.enabled) return {};
 
-    const origin = this.config.cors.origins?.[0] ?? "*";
+    const origins = this.config.cors.origins;
+    if (!origins || origins.length === 0) return {};
+
+    // Match request origin against the configured origins list
+    const matchedOrigin = requestOrigin && origins.includes(requestOrigin)
+      ? requestOrigin
+      : undefined;
+
+    if (!matchedOrigin) return {};
 
     return {
-      "Access-Control-Allow-Origin": origin,
+      "Access-Control-Allow-Origin": matchedOrigin,
       "Access-Control-Allow-Methods": "POST, OPTIONS",
       "Access-Control-Allow-Headers": "Content-Type, Authorization, X-End-User-Id, X-Project-Id",
+      "Vary": "Origin",
     };
   }
 

package/src/src/proxy/handler.ts

@@ -7,7 +7,7 @@ import { cwd, getEnv } from "../platform/compat/process.js";
 import { join } from "../platform/compat/path/index.js";
 import { injectContext, ProxySpanNames, withSpan } from "./tracing.js";
 import { computeContentSourceId } from "../cache/keys.js";
-import { jwtVerify } from "jose";
+import { createRemoteJWKSet, decodeProtectedHeader, jwtVerify } from "jose";
 
 export const INTERNAL_PROXY_HEADERS = [
   "x-token",
@@ -37,6 +37,29 @@ interface DomainLookupResult {
   }>;
 }
 
+const remoteJwksByUrl = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
+
+function getApiJwks(apiBaseUrl: string, logger?: ProxyLogger) {
+  try {
+    const normalizedBaseUrl = apiBaseUrl.endsWith("/") ? apiBaseUrl : `${apiBaseUrl}/`;
+    const jwksUrl = new URL(".well-known/jwks.json", normalizedBaseUrl);
+    const cacheKey = jwksUrl.toString();
+    let jwks = remoteJwksByUrl.get(cacheKey);
+
+    if (!jwks) {
+      jwks = createRemoteJWKSet(jwksUrl);
+      remoteJwksByUrl.set(cacheKey, jwks);
+    }
+
+    return jwks;
+  } catch (error) {
+    logger?.error("Invalid API base URL for JWKS lookup", error as Error, {
+      apiBaseUrl,
+    });
+    return undefined;
+  }
+}
+
 async function lookupProjectByDomain(
   domain: string,
   apiBaseUrl: string,
@@ -154,8 +177,42 @@ function extractUserToken(cookieHeader: string): string | undefined {
 
 async function extractUserIdFromToken(
   token: string,
+  apiBaseUrl: string,
   log?: ProxyLogger,
 ): Promise<string | undefined> {
+  let algorithm: string | undefined;
+
+  try {
+    algorithm = decodeProtectedHeader(token).alg;
+  } catch (error) {
+    log?.debug("Failed to decode JWT header", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return undefined;
+  }
+
+  if (algorithm === "RS256") {
+    const jwks = getApiJwks(apiBaseUrl, log);
+    if (!jwks) return undefined;
+
+    try {
+      const { payload } = await jwtVerify(token, jwks, {
+        algorithms: ["RS256"],
+      });
+      return (payload as { userId?: string }).userId;
+    } catch (error) {
+      log?.debug("RS256 JWT verification failed", {
+        error: error instanceof Error ? error.message : String(error),
+      });
+      return undefined;
+    }
+  }
+
+  if (algorithm !== "HS256") {
+    log?.debug("Unsupported JWT algorithm", { algorithm: algorithm ?? null });
+    return undefined;
+  }
+
   const jwtSecret = getEnv("JWT_SECRET");
 
   if (!jwtSecret) {
@@ -304,7 +361,11 @@ export function createProxyHandler(options: ProxyHandlerOptions) {
       return { status: 302, message: "Authentication required", redirectUrl };
     }
 
-    const userId = await extractUserIdFromToken(userToken, logger);
+    const userId = await extractUserIdFromToken(
+      userToken,
+      config.apiBaseUrl,
+      logger,
+    );
     if (!userId) {
       const redirectUrl = makeAuthRedirectUrl(req);
       logger?.info("Could not extract userId from token", {