vh/homepage
1
0
Fork 0
mirror of https://github.com/gethomepage/homepage.git synced 2026-09-26 22:11:20 -07:00
Code Issues Actions 9 Packages Projects Releases Wiki Activity

Change: just require auth for MCP

Browse Source
This commit is contained in:
shamoon
2026-07-13 09:53:41 -07:00
parent 126d4ac341
commit 8a2d6647d2
5 changed files with 29 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pages/api/mcp/index.js
+2 -2
View File
@@ -1,7 +1,7 @@
import { getServerSession } from "next-auth/next";
import { authOptions } from "pages/api/auth/[...nextauth]";
import { handleMcpRequest, mcpAuthorized, mcpEnabled } from "utils/mcp/homepage-mcp";
import { handleMcpRequest, mcpEnabled, mcpTokenAuthorized } from "utils/mcp/homepage-mcp";
async function hasHomepageSession(req, res) {
if (!process.env.HOMEPAGE_AUTH_ENABLED) return false;
@@ -13,7 +13,7 @@ export default async function handler(req, res) {
return res.status(404).end("Not Found");
}
if (!mcpAuthorized(req) && !(await hasHomepageSession(req, res))) {
if (!mcpTokenAuthorized(req) && !(await hasHomepageSession(req, res))) {
return res.status(401).json({ error: "Unauthorized" });
}
src/pages/api/mcp/index.test.js
+24 -2
View File
@@ -69,6 +69,19 @@ describe("pages/api/mcp", () => {
expect(res.status).toHaveBeenCalledWith(401);
});
it("rejects requests when neither Homepage auth nor an MCP token is configured", async () => {
process.env.HOMEPAGE_MCP_ENABLED = "true";
delete process.env.HOMEPAGE_AUTH_ENABLED;
delete process.env.HOMEPAGE_MCP_TOKEN;
const handler = await loadHandler();
const res = mockResponse();
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", id: 1, method: "tools/list" } }, res);
expect(getServerSession).not.toHaveBeenCalled();
expect(res.status).toHaveBeenCalledWith(401);
});
it("handles JSON-RPC requests when enabled and authorized", async () => {
process.env.HOMEPAGE_MCP_ENABLED = "true";
process.env.HOMEPAGE_MCP_TOKEN = "secret";
@@ -143,10 +156,18 @@ describe("pages/api/mcp", () => {
it("returns 202 for JSON-RPC notifications", async () => {
process.env.HOMEPAGE_MCP_ENABLED = "true";
process.env.HOMEPAGE_MCP_TOKEN = "secret";
const handler = await loadHandler();
const res = mockResponse();
await handler({ method: "POST", headers: {}, body: { jsonrpc: "2.0", method: "notifications/initialized" } }, res);
await handler(
{
method: "POST",
headers: { authorization: "Bearer secret" },
body: { jsonrpc: "2.0", method: "notifications/initialized" },
},
res,
);
expect(res.status).toHaveBeenCalledWith(202);
expect(res.end).toHaveBeenCalledWith();
@@ -154,10 +175,11 @@ describe("pages/api/mcp", () => {
it("rejects non-POST requests", async () => {
process.env.HOMEPAGE_MCP_ENABLED = "true";
process.env.HOMEPAGE_MCP_TOKEN = "secret";
const handler = await loadHandler();
const res = mockResponse();
await handler({ method: "GET", headers: {}, body: {} }, res);
await handler({ method: "GET", headers: { authorization: "Bearer secret" }, body: {} }, res);
expect(res.status).toHaveBeenCalledWith(405);
expect(res.setHeader).toHaveBeenCalledWith("Allow", "POST");