Repository navigation
chore: sync main with upstream Wei-Shaw/sub2api (10 commits) - #4
Merged
Merged
Conversation
- Reject JSON-RPC batches and non-object bodies before the SDK; return each tool result once as text and bound the encoded payload (H1). - Enable MCP only when MCP_PUBLIC_URL is set; drop the frontend URL fallback and expose a read-only mcp_enabled public setting (M1). - Expire never-authorized clients after 24h, cap pending registrations globally, aggregate MCP IP limits by IPv6 /64, and limit registration bodies to 4 KiB (M2). - Revoke MCP grants with revoke-all-sessions and always require step-up for administrator write grants (M3). - Rate limit /api/v1/mcp per IP before authentication and write last_used_at at most once per minute (M4). - Persistently revoke grants when an account is disabled or demoted, derive result redaction from SensitiveCredentialKeys, allowlist browser sessions for step-up, audit every MCP read, reject invisible characters in client_name, and document site-root-only deployment (L1-L5, L7). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Replace the cube icon with the official MCP logo in the sidebar and on the MCP connection and consent pages. - Show the MCP entry only when the deployment enables MCP (mcp_enabled). - Explain that administrator write grants always need TOTP verification, and add MCP OAuth to the audit log auth-method filter. - Remove the unreferenced screenshots and their .gitignore exceptions (L6). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Registration was capped at 1000 pending clients site-wide while the limit per IP was 10 per minute, so one address could exhaust the cap and block every new MCP client. - Issue client IDs as HMAC-signed tokens carrying the client name, redirect URI digests and grant types. Registration writes nothing; rows are created only when a user approves a client, so there is no shared capacity to exhaust. - Persist the signing key in security_secrets via the existing get-or-create helper, cached lock-free, so instances share it. - Drop mcp_oauth_clients from migration 249 and keep the client name on each grant. Prune expired grants on authorization, before the owner row is locked. - Fix an unchecked type assertion in managementmcp tests flagged by golangci-lint v2.14.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed client IDs are now about 200 characters. Show them on one line on the consent page and in the connection list, with the full value in the title. The random part leads, so truncated IDs still differ. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # backend/go.mod # backend/go.sum
go-sdk v1.4.1 fixes GO-2026-4773 (cross-site tool execution) and GO-2026-4770 (null Unicode JSON parsing), which fail govulncheck. v1.4.1 also adds transport-level cross-origin and Content-Type checks that would reject requests Authenticate already accepts: - trust the same allowed origins in the SDK's CrossOriginProtection so CORS-allowlisted browser clients are not refused with 403; - accept application/json with parameters (e.g. charset) by normalizing the header, while still refusing non-JSON bodies with 415.
feat: add OAuth-authenticated management MCP
Fixes frontend-security on main for two new high advisories: - GHSA-83rm-6c8r-g728 (vue-i18n / @intlify/* srcdoc XSS): v9 and v10 are end of life and will not be patched, so move vue-i18n and @intlify/message-compiler to 11.4.16. - GHSA-qr28-fpjm-wq7f (decode-uri-component quadratic DoS): add a pnpm override to >=0.5.1; its API and types are unchanged. vue-i18n 11 requires Node >= 22, so CI and release workflows move from Node 20 to Node 24, matching the Docker build image. JIT message compilation is always on since v10, so the obsolete __INTLIFY_JIT_COMPILATION__ define is removed; the build still has no new Function. SubscriptionPlanCard spec asserted raw keys that v9's runtime build returned; it now asserts the rendered test messages.
Merge upstream/main (10 commits, mainly the OAuth management MCP) into the fork. The three conflicts are all the vue-i18n upgrade: upstream moved to ^11.4.16 in d851a38, so take its package.json, lockfile and SubscriptionPlanCard.spec.ts over the fork's earlier 11.4.14 bump. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Syncs the fork's
mainwith the latest upstream (10 commits, mainly the OAuth management MCP and the MCP go-sdk bump).The 3 conflicts are all the vue-i18n upgrade. Upstream moved to
^11.4.16, so upstream'spackage.json, lockfile andSubscriptionPlanCard.spec.tsreplace the fork's earlier11.4.14bump. The Node >= 22enginesfield the fork added is dropped because upstream does not declare one.Local results: eslint,
vue-tsc, vitest (379 files / 3,058 tests),pnpm auditexception check, govulncheck (0 affecting the code),go test -tags=unitfor payment, handler and service. Creem still passes the same real-API round trip on the same code (paid, webhook, refund, late payment).Not covered: the full backend unit suite and golangci-lint were run on the Creem branch with the same upstream commit, not on this branch.
🤖 Generated with Claude Code