admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: address critical code review issues (4 fixes)

Browse Source 
This commit addresses 4 critical issues identified in code review:

1. **Token Rotation Race Condition** (token_broker.py)
   - Added per-user locking mechanism to prevent concurrent refresh token corruption
   - Implemented double-check pattern for cache after acquiring lock
   - Users can now safely refresh concurrently without token desync

2. **Hardcoded OAuth Client ID** (PHP files)
   - Made client ID configurable via `astroglobe_client_id` in system config
   - Updated McpServerClient to provide getClientId() method
   - Injected McpServerClient into IdpTokenRefresher and OAuthController
   - Updated admin settings UI to display client ID configuration status
   - App gracefully handles missing client ID with warnings in admin UI

3. **Missing Cache Invalidation** (management.py:revoke_user_access)
   - Added cache.invalidate() call when revoking user access
   - Ensures both storage AND cache are cleared atomically
   - Prevents stale cached tokens from being used after revocation

4. **Error Message Exposure** (management.py)
   - Created _sanitize_error_for_client() helper function
   - Updated all error handlers to log detailed errors internally
   - Returns generic messages to clients to prevent information leakage
   - Protects against exposing database paths, API URLs, tokens, etc.

All changes are backward compatible and preserve existing functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2025-12-18 00:01:54 +01:00
co-authored by Claude Sonnet 4.5
parent 619c62d89a
commit 44391d3d1d
8 changed files with 172 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nextcloud_mcp_server/api/management.py
+55 -20
View File
@@ -95,6 +95,27 @@ async def validate_token_and_get_user(
return user_id, validated
def _sanitize_error_for_client(error: Exception, context: str = "") -> str:
"""
Return a safe, generic error message for clients.
Detailed error is logged internally but not exposed to clients to prevent
information leakage (database paths, API URLs, tokens, etc.).
Args:
error: The exception that occurred
context: Optional context for logging (e.g., "revoke_user_access")
Returns:
Generic error message safe for client consumption
"""
# Log detailed error for debugging
logger.error(f"Error in {context}: {error}", exc_info=True)
# Return generic message
return "An internal error occurred. Please contact your administrator."
async def get_server_status(request: Request) -> JSONResponse:
"""GET /api/v1/status - Server status and version.
@@ -221,9 +242,9 @@ async def get_vector_sync_status(request: Request) -> JSONResponse:
)
except Exception as e:
logger.error(f"Error getting vector sync status: {e}")
error_msg = _sanitize_error_for_client(e, "get_vector_sync_status")
return JSONResponse(
{"error": "Internal error", "message": str(e)},
{"error": error_msg},
status_code=500,
)
@@ -242,9 +263,9 @@ async def get_user_session(request: Request) -> JSONResponse:
# Validate OAuth token and extract user
token_user_id, validated = await validate_token_and_get_user(request)
except Exception as e:
logger.warning(f"Unauthorized access to /api/v1/users/{{user_id}}/session: {e}")
error_msg = _sanitize_error_for_client(e, "get_user_session_auth")
return JSONResponse(
{"error": "Unauthorized", "message": str(e)},
{"error": error_msg},
status_code=401,
)
@@ -323,9 +344,9 @@ async def get_user_session(request: Request) -> JSONResponse:
return JSONResponse(response_data)
except Exception as e:
logger.error(f"Error getting user session for {token_user_id}: {e}")
error_msg = _sanitize_error_for_client(e, "get_user_session")
return JSONResponse(
{"error": "Internal error", "message": str(e)},
{"error": error_msg},
status_code=500,
)
@@ -364,19 +385,33 @@ async def revoke_user_access(request: Request) -> JSONResponse:
status_code=403,
)
# Get refresh token storage from app state
storage = request.app.state.oauth_context.get("storage")
if not storage:
logger.error("Refresh token storage not available in app state")
# Get token broker from app state
oauth_context = request.app.state.oauth_context
if oauth_context is None:
logger.error("OAuth context not initialized")
return JSONResponse(
{"error": "Storage not configured"},
{"error": "OAuth not enabled"},
status_code=500,
)
token_broker = oauth_context.get("token_broker")
if not token_broker:
logger.error("Token broker not available in app state")
return JSONResponse(
{"error": "Token broker not configured"},
status_code=500,
)
try:
# Delete refresh token
await storage.delete_refresh_token(token_user_id)
logger.info(f"Revoked background access for user: {token_user_id}")
# Delete refresh token from storage
await token_broker.storage.delete_refresh_token(token_user_id)
# CRITICAL: Invalidate all cached tokens for this user
await token_broker.cache.invalidate(token_user_id)
logger.info(
f"Revoked background access for user {token_user_id} (cache and storage cleared)"
)
return JSONResponse(
{
@@ -386,9 +421,9 @@ async def revoke_user_access(request: Request) -> JSONResponse:
)
except Exception as e:
logger.error(f"Error revoking access for {token_user_id}: {e}")
error_msg = _sanitize_error_for_client(e, "revoke_user_access")
return JSONResponse(
{"error": "Internal error", "message": str(e)},
{"success": False, "error": error_msg},
status_code=500,
)
@@ -1049,9 +1084,9 @@ async def vector_search(request: Request) -> JSONResponse:
return JSONResponse(response_data)
except Exception as e:
logger.error(f"Error executing vector search: {e}")
error_msg = _sanitize_error_for_client(e, "vector_search")
return JSONResponse(
{"error": "Internal error", "message": str(e)},
{"error": error_msg},
status_code=500,
)
@@ -1221,8 +1256,8 @@ async def get_chunk_context(request: Request) -> JSONResponse:
return JSONResponse(response_data)
except Exception as e:
logger.error(f"Error getting chunk context: {e}", exc_info=True)
error_msg = _sanitize_error_for_client(e, "get_chunk_context")
return JSONResponse(
{"error": "Internal error", "message": str(e)},
{"error": error_msg},
status_code=500,
)
nextcloud_mcp_server/auth/token_broker.py
+60 -26
View File
@@ -127,6 +127,10 @@ class TokenBrokerService:
self.client_secret = client_secret
self.cache = TokenCache(cache_ttl, cache_early_refresh)
self._oidc_config = None
# Per-user locks for token refresh operations (prevents race conditions)
self._user_refresh_locks: dict[str, anyio.Lock] = {}
self._locks_lock = anyio.Lock() # Protects the locks dict itself
self._http_client = None
async def _get_http_client(self) -> httpx.AsyncClient:
@@ -137,6 +141,24 @@ class TokenBrokerService:
)
return self._http_client
async def _get_user_refresh_lock(self, user_id: str) -> anyio.Lock:
"""
Get or create a lock for a specific user's refresh operations.
This prevents race conditions when multiple concurrent requests
attempt to refresh the same user's token simultaneously.
Args:
user_id: User ID to get lock for
Returns:
anyio.Lock for this user's refresh operations
"""
async with self._locks_lock:
if user_id not in self._user_refresh_locks:
self._user_refresh_locks[user_id] = anyio.Lock()
return self._user_refresh_locks[user_id]
async def _get_oidc_config(self) -> dict:
"""Get OIDC configuration from discovery endpoint."""
if self._oidc_config is None:
@@ -303,38 +325,50 @@ class TokenBrokerService:
if cached_token:
return cached_token
# Get stored refresh token
refresh_data = await self.storage.get_refresh_token(user_id)
if not refresh_data:
logger.info(f"No refresh token found for user {user_id}")
return None
# Acquire per-user lock BEFORE refresh operation to prevent race conditions
refresh_lock = await self._get_user_refresh_lock(user_id)
async with refresh_lock:
# Double-check cache after acquiring lock
# (another thread may have refreshed while we waited)
cached_token = await self.cache.get(cache_key)
if cached_token:
logger.debug(
f"Token found in cache after lock acquisition for user {user_id}"
)
return cached_token
try:
# storage.get_refresh_token() returns already-decrypted token
refresh_token = refresh_data["refresh_token"]
# Get stored refresh token
refresh_data = await self.storage.get_refresh_token(user_id)
if not refresh_data:
logger.info(f"No refresh token found for user {user_id}")
return None
# Get token with specific scopes for background operation
# Pass user_id to enable refresh token rotation storage
access_token, expires_in = await self._refresh_access_token_with_scopes(
refresh_token, required_scopes, user_id=user_id
)
try:
# storage.get_refresh_token() returns already-decrypted token
refresh_token = refresh_data["refresh_token"]
# Cache the background token
await self.cache.set(cache_key, access_token, expires_in)
# Get token with specific scopes for background operation
# Pass user_id to enable refresh token rotation storage
access_token, expires_in = await self._refresh_access_token_with_scopes(
refresh_token, required_scopes, user_id=user_id
)
logger.info(
f"Generated background token for user {user_id} with scopes: {required_scopes}"
)
# Cache the background token
await self.cache.set(cache_key, access_token, expires_in)
return access_token
logger.info(
f"Generated background token for user {user_id} with scopes: {required_scopes}"
)
except Exception as e:
logger.error(
f"Failed to get background token for user {user_id}: {e}",
exc_info=True,
)
await self.cache.invalidate(cache_key)
return None
return access_token
except Exception as e:
logger.error(
f"Failed to get background token for user {user_id}: {e}",
exc_info=True,
)
await self.cache.invalidate(cache_key)
return None
async def _refresh_access_token(
self, refresh_token: str, user_id: str | None = None