webspresso 0.0.91 → 0.0.93

package/plugins/admin-panel/client/parts/05-rich-text-file-helpers.js

@@ -396,10 +396,15 @@ function getFieldRenderer(col, modelMeta) {
     const custom = window.__customFieldRenderers && window.__customFieldRenderers[col.customField.type];
     if (custom) {
       return (col, value, onChange, readonly, error) => {
-        if (custom.edit && typeof custom.edit === 'object' && custom.edit.view) {
-          return m(custom.edit, { col, value, onChange, readonly, error });
-        } else if (typeof custom.edit === 'function') {
-          return custom.edit(value, onChange, col, readonly, error);
+        try {
+          if (custom.edit && typeof custom.edit === 'object' && custom.edit.view) {
+            return m(custom.edit, { col, value, onChange, readonly, error });
+          } else if (typeof custom.edit === 'function') {
+            return custom.edit(value, onChange, col, readonly, error);
+          }
+        } catch (err) {
+          console.error('[Admin Panel] Error rendering custom field edit for "' + col.customField.type + '":', err);
+          return m('div.text-red-500.text-xs', 'Edit render error: ' + (err.message || String(err)));
         }
       };
     }
@@ -409,10 +414,15 @@ function getFieldRenderer(col, modelMeta) {
   if (col.type && window.__customFieldRenderers && window.__customFieldRenderers[col.type]) {
     const custom = window.__customFieldRenderers[col.type];
     return (col, value, onChange, readonly, error) => {
-      if (custom.edit && typeof custom.edit === 'object' && custom.edit.view) {
-        return m(custom.edit, { col, value, onChange, readonly, error });
-      } else if (typeof custom.edit === 'function') {
-        return custom.edit(value, onChange, col, readonly, error);
+      try {
+        if (custom.edit && typeof custom.edit === 'object' && custom.edit.view) {
+          return m(custom.edit, { col, value, onChange, readonly, error });
+        } else if (typeof custom.edit === 'function') {
+          return custom.edit(value, onChange, col, readonly, error);
+        }
+      } catch (err) {
+        console.error('[Admin Panel] Error rendering custom field edit for "' + col.type + '":', err);
+        return m('div.text-red-500.text-xs', 'Edit render error: ' + (err.message || String(err)));
       }
     };
   }

package/plugins/admin-panel/client/parts/07-model-list.js

@@ -73,10 +73,15 @@ function formatCellValue(value, col, record = null) {
   const customRendererType = (col && col.customField && col.customField.type) || (col && col.type);
   const custom = window.__customFieldRenderers && window.__customFieldRenderers[customRendererType];
   if (custom && custom.display) {
-    if (typeof custom.display === 'object' && custom.display.view) {
-      return m(custom.display, { value, col, record });
-    } else if (typeof custom.display === 'function') {
-      return custom.display(value, record);
+    try {
+      if (typeof custom.display === 'object' && custom.display.view) {
+        return m(custom.display, { value, col, record });
+      } else if (typeof custom.display === 'function') {
+        return custom.display(value, record);
+      }
+    } catch (err) {
+      console.error('[Admin Panel] Error rendering custom field display for "' + customRendererType + '":', err);
+      return String(value);
     }
   }
   

package/plugins/admin-panel/client/parts/08-record-list.js

@@ -325,10 +325,15 @@ const RecordList = {
                       const blob = new Blob([JSON.stringify(response.data, null, 2)], { type: 'application/json' });
                       const url = URL.createObjectURL(blob);
                       const a = document.createElement('a');
+                      a.style.display = 'none';
                       a.href = url;
                       a.download = modelName + '-export.json';
+                      document.body.appendChild(a);
                       a.click();
-                      URL.revokeObjectURL(url);
+                      setTimeout(function () {
+                        if (a.parentNode) a.parentNode.removeChild(a);
+                        URL.revokeObjectURL(url);
+                      }, 1000);
                     } catch (err) {
                       alert('Error: ' + err.message);
                     } finally {
@@ -351,15 +356,24 @@ const RecordList = {
                       const payload = state.selectAllMode 
                         ? { selectAll: true, filters: state.filters }
                         : { ids: Array.from(state.selectedRecords) };
+                      if (!state.selectAllMode && (!payload.ids || payload.ids.length === 0)) {
+                        alert('Please select at least one record to export');
+                        return;
+                      }
                       const response = await api.post('/extensions/export?model=' + modelName + '&format=csv', payload);
                       // Download as file
                       const blob = new Blob([response.data], { type: 'text/csv' });
                       const url = URL.createObjectURL(blob);
                       const a = document.createElement('a');
+                      a.style.display = 'none';
                       a.href = url;
                       a.download = modelName + '-export.csv';
+                      document.body.appendChild(a);
                       a.click();
-                      URL.revokeObjectURL(url);
+                      setTimeout(function () {
+                        if (a.parentNode) a.parentNode.removeChild(a);
+                        URL.revokeObjectURL(url);
+                      }, 1000);
                     } catch (err) {
                       alert('Error: ' + err.message);
                     } finally {
@@ -382,6 +396,10 @@ const RecordList = {
                       const payload = state.selectAllMode 
                         ? { selectAll: true, filters: state.filters }
                         : { ids: Array.from(state.selectedRecords) };
+                      if (!state.selectAllMode && (!payload.ids || payload.ids.length === 0)) {
+                        alert('Please select at least one record to export');
+                        return;
+                      }
                       if (state.trashedView) payload.trashed = 'only';
                       await downloadDataExchangeXlsx(modelName, payload);
                     } catch (err) {

package/plugins/admin-panel/index.js

@@ -51,6 +51,7 @@ function adminPanelPlugin(options = {}) {
     configure,
     uploadUrl: uploadUrlOption,
     richTextSanitize = true,
+    dataExchange: dataExchangeOption = true,
   } = options;
 
   const adminUsersConfig = typeof adminUsersOption === 'object' ? adminUsersOption : { enabled: adminUsersOption !== false };
@@ -190,6 +191,17 @@ function adminPanelPlugin(options = {}) {
         }));
         ctx.app._webspressoSessionInitialized = true;
       }
+
+      // Auto-register built-in exchange services if enabled and serviceRegistry exists
+      if (enabled && dataExchangeOption !== false && ctx.app && ctx.app.serviceRegistry) {
+        const { createExchangeServices } = require('../../src/services/builtins/exchange');
+        const exchangeServices = createExchangeServices({ db });
+        for (const [name, def] of Object.entries(exchangeServices)) {
+          if (!ctx.app.serviceRegistry.has(name)) {
+            ctx.app.serviceRegistry.register(name, def);
+          }
+        }
+      }
     },
 
     /**
@@ -268,7 +280,7 @@ function adminPanelPlugin(options = {}) {
         path: adminPath,
         db,
         AdminUser,
-        hashPassword: (password, rounds) => bcrypt.hash(password, rounds),
+        hashPassword: (password, rounds) => bcrypt.hash(password, process.env.NODE_ENV === 'test' ? 4 : (rounds || 10)),
         comparePassword: (password, hash) => bcrypt.compare(password, hash),
         richTextSanitize,
       });
@@ -287,7 +299,7 @@ function adminPanelPlugin(options = {}) {
         adminUsersHandlers = createAdminUsersApiHandlers({
           db,
           AdminUser,
-          hashPassword: (password, rounds) => bcrypt.hash(password, rounds),
+          hashPassword: (password, rounds) => bcrypt.hash(password, process.env.NODE_ENV === 'test' ? 4 : (rounds || 10)),
         });
       }
 
@@ -379,6 +391,49 @@ function adminPanelPlugin(options = {}) {
       // Query API routes (auth required)
       ctx.addRoute('get', `${adminPath}/api/models/:model/queries/:query`, requireAuth, apiHandlers.queryHandler);
 
+      // Data exchange (Excel export & CSV/XLSX import) routes
+      const dataExchangeConfig = typeof dataExchangeOption === 'object' ? dataExchangeOption : { enabled: dataExchangeOption !== false };
+      if (dataExchangeConfig.enabled !== false && !ctx.app?._dataExchangeRoutesRegistered) {
+        const { createExportXlsxHandler } = require('../data-exchange/export-xlsx');
+        const { createImportHandler } = require('../data-exchange/import');
+        const exportHandler = createExportXlsxHandler({ db, maxRows: dataExchangeConfig.maxRows || 10000 });
+        const importHandler = createImportHandler({
+          db,
+          maxRows: dataExchangeConfig.maxRows || 10000,
+          maxFileBytes: dataExchangeConfig.maxFileBytes || 10 * 1024 * 1024,
+        });
+
+        const base = `${adminPath}/api/data-exchange`;
+        ctx.addRoute('get', `${base}/export/:model`, requireAuth, exportHandler);
+        ctx.addRoute('post', `${base}/export/:model`, requireAuth, exportHandler);
+        ctx.addRoute('post', `${base}/import/:model`, requireAuth, importHandler);
+
+        if (!registry.bulkActions.has('export-xlsx')) {
+          registry.registerBulkAction('export-xlsx', {
+            label: 'Export as Excel',
+            icon: 'download',
+            color: 'blue',
+            models: '*',
+            confirm: false,
+            handler: async (records, modelName, { db: d }) => {
+              const { getModel } = require('../../core/orm/model');
+              const model = d.getModel ? d.getModel(modelName) : getModel(modelName);
+              const pk = model?.primaryKey || 'id';
+              const ids = records.map((r) => r[pk]).join(',');
+              return {
+                download: true,
+                url: `${adminPath}/api/data-exchange/export/${modelName}?ids=${encodeURIComponent(ids)}`,
+                filename: `${modelName}_export.xlsx`,
+              };
+            },
+          });
+        }
+
+        if (ctx.app) {
+          ctx.app._dataExchangeRoutesRegistered = true;
+        }
+      }
+
       // ==========================================
       // Static Vendor Assets (Offline Zero-CDN)
       // ==========================================
@@ -476,10 +531,14 @@ function generateAdminPanelHtml(adminPath, registry) {
 
   const settings = registry.settings;
   const fieldRenderersCode = Array.from(registry.fieldRenderers.entries()).map(([type, r]) => {
-    return `window.__customFieldRenderers['${type}'] = {
-      display: ${r.display ? serializeJs(r.display) : 'null'},
-      edit: ${r.edit ? serializeJs(r.edit) : 'null'}
-    };`;
+    return `try {
+      window.__customFieldRenderers['${type}'] = {
+        display: ${r.display ? serializeJs(r.display) : 'null'},
+        edit: ${r.edit ? serializeJs(r.edit) : 'null'}
+      };
+    } catch (err) {
+      console.error('[Admin Panel] Failed to register custom field renderer "${type}":', err);
+    }`;
   }).join('\n');
 
   return `<!DOCTYPE html>

package/plugins/admin-panel/modules/bulk-actions.js

@@ -238,11 +238,18 @@ async function executeBulkAction(action, selectedIds, modelName) {
     if (result.result?.download) {
       // Trigger download
       const link = document.createElement('a');
-      link.href = window.__ADMIN_PATH__ + result.result.url;
+      link.style.display = 'none';
+      const rawUrl = result.result.url || '';
+      const adminPath = window.__ADMIN_PATH__ || '/_admin';
+      link.href = (rawUrl.startsWith('/') && !rawUrl.startsWith(adminPath))
+        ? adminPath + rawUrl
+        : rawUrl;
       link.download = result.result.filename || 'export';
       document.body.appendChild(link);
       link.click();
-      document.body.removeChild(link);
+      setTimeout(function () {
+        if (link.parentNode) link.parentNode.removeChild(link);
+      }, 1000);
       return { success: true, message: 'Download started' };
     }
 

package/plugins/admin-panel/modules/dashboard.js

@@ -384,7 +384,14 @@ const Widget = {
           ? m('div.flex.justify-center.py-8', m(Spinner))
           : error 
             ? m('div.text-red-500.text-sm', error)
-            : (WidgetRenderers[widget.id] || WidgetRenderers.default).render(data),
+            : (() => {
+                try {
+                  return (WidgetRenderers[widget.id] || WidgetRenderers.default).render(data);
+                } catch (err) {
+                  console.error('[Admin Panel] Error rendering widget "' + widget.id + '":', err);
+                  return m('div.text-red-500.text-xs', 'Widget render error: ' + (err.message || String(err)));
+                }
+              })(),
       ]),
     ]);
   },

package/plugins/data-exchange/export-xlsx.js

@@ -7,6 +7,32 @@ const ExcelJS = require('exceljs');
 const { sanitizeForOutput } = require('../../core/orm/utils');
 const { resolveExportRecords } = require('./record-selection');
 
+/**
+ * @param {import('../../core/orm/types').ModelDefinition} model
+ * @param {object[]} records
+ * @returns {Promise<Buffer>}
+ */
+function getModelExportColumns(model, cleanRecords = []) {
+  const hiddenSet = new Set(model.hidden || []);
+  const colSet = new Set();
+  if (model.columns && typeof model.columns.keys === 'function') {
+    for (const c of model.columns.keys()) {
+      if (!hiddenSet.has(c)) colSet.add(c);
+    }
+  }
+  if (model.schema?.shape) {
+    for (const c of Object.keys(model.schema.shape)) {
+      if (!hiddenSet.has(c)) colSet.add(c);
+    }
+  }
+  if (colSet.size === 0 && cleanRecords.length > 0) {
+    for (const c of Object.keys(cleanRecords[0])) {
+      if (!hiddenSet.has(c)) colSet.add(c);
+    }
+  }
+  return Array.from(colSet);
+}
+
 /**
  * @param {import('../../core/orm/types').ModelDefinition} model
  * @param {object[]} records
@@ -14,12 +40,7 @@ const { resolveExportRecords } = require('./record-selection');
  */
 async function buildXlsxBuffer(model, records) {
   const clean = sanitizeForOutput(records, model);
-  const hiddenSet = new Set(model.hidden || []);
-  const columns = (model.columns && model.columns.size > 0)
-    ? Array.from(model.columns.keys()).filter((c) => !hiddenSet.has(c))
-    : (model.schema?.shape
-        ? Object.keys(model.schema.shape).filter((c) => !hiddenSet.has(c))
-        : Object.keys(clean[0] || {}));
+  const columns = getModelExportColumns(model, clean);
 
   const wb = new ExcelJS.Workbook();
   const ws = wb.addWorksheet('Export', {
@@ -87,4 +108,5 @@ function createExportXlsxHandler(opts) {
 module.exports = {
   buildXlsxBuffer,
   createExportXlsxHandler,
+  getModelExportColumns,
 };

package/plugins/data-exchange/import.js

@@ -10,13 +10,18 @@ const { buildHeaderMapping, dataRowsToObjects } = require('./parse-table');
 
 function allowedImportColumns(model) {
   const hidden = new Set(model.hidden || []);
-  if (model.columns && model.columns.size > 0) {
-    return Array.from(model.columns.keys()).filter((c) => !hidden.has(c));
+  const cols = new Set();
+  if (model.columns && typeof model.columns.keys === 'function') {
+    for (const c of model.columns.keys()) {
+      if (!hidden.has(c)) cols.add(c);
+    }
   }
   if (model.schema && model.schema.shape) {
-    return Object.keys(model.schema.shape).filter((c) => !hidden.has(c));
+    for (const c of Object.keys(model.schema.shape)) {
+      if (!hidden.has(c)) cols.add(c);
+    }
   }
-  return [];
+  return Array.from(cols);
 }
 
 /**
@@ -35,12 +40,12 @@ function coerceCell(raw, meta, column) {
   }
 
   if (!meta || !meta.type) {
-    if (raw === 'true' || raw === '1' || raw === 'yes') return true;
-    if (raw === 'false' || raw === '0' || raw === 'no') return false;
     if (typeof raw === 'string' && /^-?\d+(\.\d+)?$/.test(raw)) {
       const num = Number(raw);
       if (!Number.isNaN(num)) return num;
     }
+    if (raw === 'true' || raw === 'yes') return true;
+    if (raw === 'false' || raw === 'no') return false;
     return raw;
   }
 
@@ -66,6 +71,14 @@ function coerceCell(raw, meta, column) {
       if (s === 'false' || s === '0' || s === 'no') return false;
       throw new Error(`Invalid boolean for ${column}`);
     }
+    case 'date':
+    case 'datetime':
+    case 'timestamp': {
+      if (raw instanceof Date) return raw;
+      const d = new Date(raw);
+      if (Number.isNaN(d.getTime())) throw new Error(`Invalid date for ${column}`);
+      return raw;
+    }
     case 'json': {
       if (typeof raw === 'object') return raw;
       try {
@@ -84,7 +97,7 @@ function buildPayloadForRow(model, data, mode) {
   const payload = {};
   for (const [col, raw] of Object.entries(data)) {
     if (!allowed.has(col)) continue;
-    const meta = model.columns.get(col);
+    const meta = model.columns?.get ? model.columns.get(col) : undefined;
     let v;
     try {
       v = coerceCell(raw, meta, col);
@@ -95,14 +108,14 @@ function buildPayloadForRow(model, data, mode) {
     payload[col] = v;
   }
 
-  const pk = model.primaryKey;
-  const pkMeta = model.columns.get(pk);
-  if (
-    mode === 'insert' &&
-    pkMeta?.autoIncrement &&
-    (payload[pk] === undefined || payload[pk] === null || payload[pk] === '')
-  ) {
-    delete payload[pk];
+  const pk = model.primaryKey || 'id';
+  const pkMeta = model.columns?.get ? model.columns.get(pk) : undefined;
+  if (mode === 'insert') {
+    // In insert mode, remove auto-increment / auto-generated primary key
+    // so new records are created without unique constraint collision
+    if (pkMeta?.autoIncrement || pkMeta?.auto === 'create' || payload[pk] === undefined || payload[pk] === null || payload[pk] === '') {
+      delete payload[pk];
+    }
   }
 
   return payload;
@@ -139,15 +152,26 @@ async function parseXlsxToRows(buffer) {
 }
 
 function cellValueToPlain(cell) {
+  if (!cell) return '';
   const v = cell.value;
   if (v === null || v === undefined) return '';
   if (v instanceof Date) return v.toISOString();
-  if (typeof v === 'object' && v !== null) {
+  if (typeof v === 'object') {
+    if (v.error) return '';
     if ('text' in v && typeof v.text === 'string') return v.text;
     if ('richText' in v && Array.isArray(v.richText)) {
-      return v.richText.map((t) => t.text || '').join('');
+      return v.richText.map((t) => (t && t.text) ? t.text : '').join('');
+    }
+    if ('result' in v && v.result !== undefined) {
+      return cellValueToPlain({ value: v.result });
+    }
+    if ('hyperlink' in v) {
+      return v.text || v.hyperlink || '';
+    }
+    if (typeof v.toString === 'function' && v.toString !== Object.prototype.toString) {
+      return v.toString();
     }
-    if ('result' in v && v.result !== undefined) return v.result;
+    return '';
   }
   return v;
 }
@@ -191,7 +215,8 @@ function createImportHandler(opts) {
         let upsertKey = req.query.upsertKey || req.body?.upsertKey || model.primaryKey;
         upsertKey = String(upsertKey);
 
-        if (!model.columns.has(upsertKey)) {
+        const allowedCols = allowedImportColumns(model);
+        if (!allowedCols.includes(upsertKey)) {
           return res.status(400).json({ error: `upsertKey "${upsertKey}" is not a column` });
         }
         if (model.hidden?.includes(upsertKey)) {
@@ -250,7 +275,7 @@ function createImportHandler(opts) {
               continue;
             }
 
-            const keyMeta = model.columns.get(upsertKey);
+            const keyMeta = model.columns?.get ? model.columns.get(upsertKey) : undefined;
             let keyVal;
             try {
               keyVal = coerceCell(data[upsertKey], keyMeta, upsertKey);

package/plugins/data-exchange/index.js

@@ -49,6 +49,7 @@ function dataExchangePlugin(options = {}) {
 
     onRoutesReady(ctx) {
       if (!enabled) return;
+      if (ctx.app && ctx.app._dataExchangeRoutesRegistered) return;
 
       const db = dbOption ?? ctx.db;
       if (!db) {
@@ -87,6 +88,10 @@ function dataExchangePlugin(options = {}) {
           },
         });
       }
+
+      if (ctx.app) {
+        ctx.app._dataExchangeRoutesRegistered = true;
+      }
     },
   };
 }

package/plugins/data-exchange/parse-table.js

@@ -15,18 +15,27 @@ function normalizeHeaderCell(h) {
  * @returns {(string|null)[]} index → model column or null if unknown
  */
 function buildHeaderMapping(headerRow, allowedKeys) {
-  const lowerToKey = new Map();
+  const exactLowerToKey = new Map();
+  const strippedToKey = new Map();
   for (const k of allowedKeys) {
-    lowerToKey.set(String(k).toLowerCase().replace(/\s+/g, '_'), k);
+    const kStr = String(k);
+    exactLowerToKey.set(kStr.toLowerCase().replace(/\s+/g, '_'), k);
+    strippedToKey.set(kStr.toLowerCase().replace(/[_\s-]+/g, ''), k);
   }
   const mapping = [];
   for (let i = 0; i < headerRow.length; i++) {
-    const norm = normalizeHeaderCell(headerRow[i]).toLowerCase().replace(/\s+/g, '_');
-    if (!norm) {
+    const raw = normalizeHeaderCell(headerRow[i]);
+    if (!raw) {
       mapping.push(null);
       continue;
     }
-    mapping.push(lowerToKey.get(norm) ?? null);
+    const norm = raw.toLowerCase().replace(/\s+/g, '_');
+    let matched = exactLowerToKey.get(norm);
+    if (!matched) {
+      const stripped = raw.toLowerCase().replace(/[_\s-]+/g, '');
+      matched = strippedToKey.get(stripped);
+    }
+    mapping.push(matched ?? null);
   }
   return mapping;
 }

package/plugins/data-exchange/record-selection.js

@@ -70,6 +70,8 @@ async function resolveExportRecords(db, modelName, req) {
         if (record) records.push(record);
       }
     }
+  } else if (Array.isArray(idList) && idList.length === 0) {
+    records = [];
   } else {
     records = await repo.findAll();
   }

package/plugins/index.js

@@ -39,6 +39,7 @@ const {
   redis,
   createRedisAdapter,
 } = require('./realtime');
+const { mcpPlugin, createMcpServer, McpServer } = require('./mcp');
 
 module.exports = {
   sitemapPlugin,
@@ -77,6 +78,9 @@ module.exports = {
   redis,
   createRedisAdapter,
   queuePlugin: require('./queue'),
+  mcpPlugin,
+  createMcpServer,
+  McpServer,
 };
 
 

package/plugins/mcp/auth.js

@@ -0,0 +1,104 @@
+/**
+ * Webspresso MCP Authentication & Security
+ * Provides token validation and localhost IP restrictions for HTTP/SSE transports
+ * @module plugins/mcp/auth
+ */
+
+const crypto = require('crypto');
+
+/**
+ * Constant-time string comparison to avoid timing attacks
+ * @param {string} a
+ * @param {string} b
+ * @returns {boolean}
+ */
+function safeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const bufA = Buffer.from(a);
+  const bufB = Buffer.from(b);
+  if (bufA.length !== bufB.length) return false;
+  return crypto.timingSafeEqual(bufA, bufB);
+}
+
+/**
+ * Check if incoming request is from localhost
+ * @param {import('express').Request} req
+ * @returns {boolean}
+ */
+function isLocalhost(req) {
+  const ip = req.ip || req.connection?.remoteAddress || '';
+  return (
+    ip === '127.0.0.1' ||
+    ip === '::1' ||
+    ip === '::ffff:127.0.0.1' ||
+    ip.endsWith('127.0.0.1') ||
+    req.hostname === 'localhost'
+  );
+}
+
+/**
+ * Creates authentication middleware for MCP HTTP/SSE endpoints
+ * @param {Object} [options={}]
+ * @param {string} [options.token] - Pre-shared secret token
+ * @param {boolean} [options.localhostOnly=false] - Only allow localhost connections
+ * @param {function(import('express').Request): (boolean|Promise<boolean>)} [options.verify] - Custom verify function
+ * @returns {import('express').RequestHandler}
+ */
+function createMcpAuthMiddleware(options = {}) {
+  const { token, localhostOnly = false, verify } = options;
+
+  return async function mcpAuthMiddleware(req, res, next) {
+    // 1. Localhost check
+    if (localhostOnly && !isLocalhost(req)) {
+      return res.status(403).json({
+        jsonrpc: '2.0',
+        error: { code: -32000, message: 'Forbidden: MCP server only allows localhost connections' },
+      });
+    }
+
+    // 2. Custom verification
+    if (typeof verify === 'function') {
+      try {
+        const ok = await verify(req);
+        if (!ok) {
+          return res.status(401).json({
+            jsonrpc: '2.0',
+            error: { code: -32000, message: 'Unauthorized: Custom MCP verification failed' },
+          });
+        }
+        return next();
+      } catch (err) {
+        return res.status(401).json({
+          jsonrpc: '2.0',
+          error: { code: -32000, message: `Unauthorized: ${err.message}` },
+        });
+      }
+    }
+
+    // 3. Pre-shared token check
+    if (token) {
+      let clientToken = '';
+      const authHeader = req.headers.authorization;
+      if (authHeader && authHeader.startsWith('Bearer ')) {
+        clientToken = authHeader.slice('Bearer '.length).trim();
+      } else if (req.query && req.query.token) {
+        clientToken = String(req.query.token).trim();
+      }
+
+      if (!clientToken || !safeEqual(clientToken, token)) {
+        return res.status(401).json({
+          jsonrpc: '2.0',
+          error: { code: -32000, message: 'Unauthorized: Invalid or missing MCP bearer token' },
+        });
+      }
+    }
+
+    next();
+  };
+}
+
+module.exports = {
+  createMcpAuthMiddleware,
+  isLocalhost,
+  safeEqual,
+};