mailsocket-mcp 0.2.0__tar.gz → 0.2.1__tar.gz

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mailsocket-mcp
-Version: 0.2.0
+Version: 0.2.1
 Summary: MCP server exposing mailsocket inboxes + wait-for-OTP to AI agents.
 Author: mailsocket
 License-Expression: MIT

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/mailsocket_mcp/remote.py

@@ -68,6 +68,10 @@ KEY_RE = re.compile(r"^ms_live_[A-Za-z0-9_\-]{8,200}$")
 # Any query parameter that looks like a credential is refused outright.
 _CREDENTIAL_PARAMS = {"api_key", "apikey", "key", "token", "access_token", "authorization"}
 _KEY_LIKE = re.compile(r"ms_live_", re.IGNORECASE)
+# Access-log placeholder for any path that carries (or was refused for) a key.
+REDACTED_PATH = "/mcp/<redacted>"
+# How many extra percent-decoding rounds a path gets before key detection.
+_MAX_PATH_DECODES = 3
 WWW_AUTHENTICATE = 'Bearer realm="mailsocket"'
 KEY_HINT = "Send a valid key as `Authorization: Bearer ms_live_...`."
 DEFAULT_ALLOWED_HOST = "mcp.mailsocket.app"
@@ -144,6 +148,30 @@ def _bearer_key(headers: Headers) -> tuple[str | None, str | None]:
     return token, None
 
 
+def _path_has_key(path: str) -> bool:
+    """True if ``ms_live_`` (any case) appears in the path as given OR after
+    up to ``_MAX_PATH_DECODES`` rounds of percent-decoding, so
+    ``/mcp/MS_LIVE_…`` and double-encoded ``/mcp/%256Ds_live_…`` are caught."""
+    candidate = path
+    for _ in range(_MAX_PATH_DECODES + 1):
+        if _KEY_LIKE.search(candidate):
+            return True
+        decoded = unquote(candidate)
+        if decoded == candidate:
+            return False
+        candidate = decoded
+    return False
+
+
+def _log_path(path: str) -> str:
+    """Path for the access log: a fixed placeholder whenever the path carries
+    a key (the credential_in_url refusal uses the same test), else the path
+    with any ``ms_live_`` token scrubbed."""
+    if _path_has_key(path):
+        return REDACTED_PATH
+    return _redact(path, None)
+
+
 def _query_has_credential(query_string: bytes) -> bool:
     try:
         pairs = parse_qsl(query_string.decode("latin-1"), keep_blank_values=True)
@@ -253,12 +281,13 @@ class RemoteMCPApp:
             await self._dispatch(scope, receive, send_logged)
         finally:
             # Access log: method, path (NO query string), status, duration.
-            # Headers are never logged, so neither is the key; the path is
-            # scrubbed of any ms_live_ token in case a client put one there.
+            # Headers are never logged, so neither is the key. A path with a
+            # key in it (any case, up to 3x percent-encoded) is replaced by a
+            # fixed placeholder — never partially scrubbed.
             access_logger.info(
                 "%s %s %s %.0fms",
                 scope.get("method", "-"),
-                _redact(str(scope.get("path", "-")), None),
+                _log_path(str(scope.get("path", "-"))),
                 status_holder["status"],
                 (time.monotonic() - started) * 1000,
             )
@@ -278,7 +307,7 @@ class RemoteMCPApp:
             await _error(421, "invalid_host", "Invalid Host header.")(scope, receive, send)
             return
 
-        if _KEY_LIKE.search(unquote(path)):
+        if _path_has_key(path):
             # e.g. POST /mcp/ms_live_… — refuse it (the logged path is
             # redacted too, but the request must not proceed either).
             await _error(

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/mailsocket_mcp/server.py

@@ -52,7 +52,7 @@ __all__ = [
 # Canonical version, re-exported as ``mailsocket_mcp.__version__`` (see
 # __init__.py). Defined here, not in __init__.py, because __init__.py imports
 # this module at package-load time and a circular self-import would break.
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 # The headline wait is bounded: an agent can request up to the transport's
 # ceiling as the overall deadline (clamped), though transport overhead can push

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/mailsocket_mcp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mailsocket-mcp
-Version: 0.2.0
+Version: 0.2.1
 Summary: MCP server exposing mailsocket inboxes + wait-for-OTP to AI agents.
 Author: mailsocket
 License-Expression: MIT

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mailsocket-mcp"
-version = "0.2.0"
+version = "0.2.1"
 description = "MCP server exposing mailsocket inboxes + wait-for-OTP to AI agents."
 readme = "README.md"
 requires-python = ">=3.10"

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/tests/test_remote.py

@@ -538,12 +538,65 @@ def test_key_in_url_path_is_400_and_never_logged(upstream, caplog, path):
     assert _leaks(caplog.text, KEY_REAL) == []
     access = [rec.getMessage() for rec in caplog.records if rec.name == "mailsocket_mcp.access"]
     assert len(access) == 1 and " 400 " in access[0]
-    assert "ms_live_" not in access[0] and "***" in access[0]
+    assert "ms_live_" not in access[0]
+    assert access[0].startswith("POST /mcp/<redacted> 400 ")
 
 
-def test_access_log_path_redaction_even_if_request_not_refused(caplog):
-    """Belt and braces: the access-log path itself is scrubbed."""
-    assert remote._redact(f"/mcp/{KEY_REAL}", None) == "/mcp/***"
+PATH_BODY = "F1PathBodySecret0123456789"
+
+
+@pytest.mark.parametrize(
+    "path",
+    [
+        f"/mcp/MS_LIVE_{PATH_BODY}",  # upper case
+        f"/mcp/Ms_LiVe_{PATH_BODY}",  # mixed case
+        f"/mcp/%256Ds_live_{PATH_BODY}",  # double-encoded "m"
+        f"/mcp/%25256D%2573_live_{PATH_BODY}",  # triple-encoded "m", double "s"
+        f"/mcp/%6D%53_LIVE_{PATH_BODY}",  # single-encoded, upper case
+    ],
+)
+def test_f1_case_and_multi_encoded_key_in_path_is_400_and_log_is_placeholder(upstream, caplog, path):
+    """F1 #3: POST /mcp/MS_LIVE_<body> and /mcp/%256Ds_live_<body> are refused
+    (credential_in_url) and the access log carries only /mcp/<redacted> —
+    the case-sensitive single-pass scrub used to log <body> verbatim."""
+    caplog.set_level(logging.DEBUG)
+    app = make_app(upstream)
+
+    async def go():
+        async with serving(app) as client:
+            return await client.post(path, headers=bearer(KEY_REAL), json=rpc("tools/list"))
+
+    r = run(go)
+    assert r.status_code == 400
+    assert r.json()["error"]["code"] == "credential_in_url"
+    assert upstream.calls == []
+    assert PATH_BODY not in r.text
+    # every SERVER-side record (the in-process test client's own "httpx2"
+    # request log is excluded — it is not part of the deployed server)
+    server_side = [rec.getMessage() for rec in caplog.records if not rec.name.startswith("httpx")]
+    assert server_side, "expected server-side log records"
+    assert [line for line in server_side if PATH_BODY in line] == []
+    access = [rec.getMessage() for rec in caplog.records if rec.name == "mailsocket_mcp.access"]
+    assert len(access) == 1
+    assert access[0].startswith("POST /mcp/<redacted> 400 ")
+
+
+@pytest.mark.parametrize(
+    "path,expected",
+    [
+        (f"/mcp/{KEY_REAL}", "/mcp/<redacted>"),
+        (f"/mcp/MS_LIVE_{PATH_BODY}", "/mcp/<redacted>"),
+        (f"/x/%256Ds_live_{PATH_BODY}", "/mcp/<redacted>"),  # 2 decodes
+        (f"/x/%25256Ds_live_{PATH_BODY}", "/mcp/<redacted>"),  # 3 decodes
+        (f"/x/%2525256Ds_live_{PATH_BODY}", f"/x/%2525256Ds_live_{PATH_BODY}"),  # 4: beyond the cap
+        ("/mcp", "/mcp"),
+        ("/healthz", "/healthz"),
+    ],
+)
+def test_access_log_path_is_placeholder_whenever_path_has_a_key(path, expected):
+    """Belt and braces: the access-log path helper itself (case-insensitive,
+    up to 3 extra percent-decoding rounds)."""
+    assert remote._log_path(path) == expected
 
 
 def test_access_log_has_no_headers_or_query(upstream, caplog):

{mailsocket_mcp-0.2.0 → mailsocket_mcp-0.2.1}/tests/test_server.py

@@ -365,13 +365,13 @@ def test_version_exported():
 
 
 def test_metadata_consistency_across_files():
-    """Versions match everywhere: MCP 0.2.0 (pyproject, server.json, __version__)
+    """Versions match everywhere: MCP 0.2.1 (pyproject, server.json, __version__)
     and its Python SDK sibling 0.1.2 (pyproject, __version__, user agent)."""
     import tomllib
     from pathlib import Path
 
     root = Path(__file__).resolve().parents[1]
-    expected = "0.2.0"
+    expected = "0.2.1"
     expected_sdk = "0.1.2"
 
     pyproject = tomllib.loads((root / "pyproject.toml").read_text())