vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-28 23:11:17 -07:00
Code Issues Actions 11 Packages Projects Releases Wiki Activity

Fix: enforce MCP token length too

Browse Source
This commit is contained in:
shamoon
2026-08-07 15:09:57 -07:00
parent 2fae37b004
commit 7904d4adc9
5 changed files with 95 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/utils/mcp/homepage-mcp.test.js
+36 -5
View File
@@ -622,13 +622,44 @@ describe("utils/mcp/homepage-mcp", () => {
expect(mod.mcpTokenAuthorized({ headers: {} })).toBe(false);
process.env.HOMEPAGE_MCP_TOKEN = "secret";
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer secret" } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { "x-homepage-mcp-token": "secret" } })).toBe(true);
const token = "mcp-tok-0123456789abcdefghijklmnopqrstuv"; // 40 chars
process.env.HOMEPAGE_MCP_TOKEN = token;
expect(mod.mcpTokenAuthorized({ headers: { authorization: `Bearer ${token}` } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { "x-homepage-mcp-token": token } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer wrong" } })).toBe(false);
process.env.HOMEPAGE_MCP_TOKEN = "é";
// multibyte token at the minimum length still authorizes and doesn't throw on byte-length mismatch
const multibyteToken = "é".repeat(32);
process.env.HOMEPAGE_MCP_TOKEN = multibyteToken;
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer a" } })).toBe(false);
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer é" } })).toBe(true);
expect(mod.mcpTokenAuthorized({ headers: { authorization: `Bearer ${multibyteToken}` } })).toBe(true);
});
it("never authorizes a token below the minimum length, even when presented verbatim", async () => {
const mod = await loadMcpWithConfigDir(mkdtempSync(path.join(tmpdir(), "homepage-mcp-test-")));
process.env.HOMEPAGE_MCP_TOKEN = "change-me";
expect(mod.mcpTokenAuthorized({ headers: { authorization: "Bearer change-me" } })).toBe(false);
expect(mod.mcpTokenAuthorized({ headers: { "x-homepage-mcp-token": "change-me" } })).toBe(false);
});
it("reports a config error only when MCP is enabled with a too-short token", async () => {
const mod = await loadMcpWithConfigDir(mkdtempSync(path.join(tmpdir(), "homepage-mcp-test-")));
process.env.HOMEPAGE_MCP_ENABLED = "true";
process.env.HOMEPAGE_MCP_TOKEN = "change-me";
expect(mod.mcpTokenConfigError()).toMatch(/at least 32 characters/i);
process.env.HOMEPAGE_MCP_TOKEN = "mcp-tok-0123456789abcdefghijklmnopqrstuv";
expect(mod.mcpTokenConfigError()).toBeNull();
// no token configured is valid (session-only mode), so it is not an error
delete process.env.HOMEPAGE_MCP_TOKEN;
expect(mod.mcpTokenConfigError()).toBeNull();
// a weak token is ignored entirely when MCP is disabled
process.env.HOMEPAGE_MCP_ENABLED = "false";
process.env.HOMEPAGE_MCP_TOKEN = "change-me";
expect(mod.mcpTokenConfigError()).toBeNull();
});
});