timothy/ersatztv

feat(mcp): add read-only API server foundation #76

Closed

timothy wants to merge 5 commits from issue58-mcp into main

Author	SHA1	Message	Date
timothy	65d88b5167	test(#289 ): pin BoundedLineReader cap/CRLF boundaries + document per-segment path assumption Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 4m29s Details Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 4m42s Details Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped Details Non-blocking polish from the fix-commit re-review (verdict MERGEABLE): - BuildPath: comment the assumption that each {param} is its own path segment (revalidate the whole path if a template ever concatenates adjacent params). - Two additive BoundedLineReader tests: exactly-at-cap line returned intact (inclusive max), and \r\n carriage-return stripping. No logic change. 36 tests (was 34). Refs #289 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 01:24:35 +02:00
timothy	4f68805d9a	security(#289 ): review fixes — body-read timeout, transport-error response, bounded stdin, env clamps Folds in findings from the independent reviews of the initial hardening diff (a cold adversarial pass + a Codex pass — complementary catches). Fork (HIGH/MED): - Body-read timeout regression: ResponseHeadersRead moved the body read outside HttpClient.Timeout and it used CancellationToken.None, so a slow-drip upstream hung the single-threaded session. Now a per-request linked CTS (options .EffectiveRequestTimeout) covers headers + body; HttpClient.Timeout set to Infinite so one timer owns it. Verified live against a black-hole upstream: 1s timeout → -32603 in ~1s, no hang. - Transport/timeout exceptions escaped HandleAsync's catch filter → no response for the id → client hangs. Added a broad final catch → -32603 when hasId. Codex (env/input robustness): - ERSATZTV_REQUEST_TIMEOUT_SECONDS / ERSATZTV_MAX_RESPONSE_BYTES at int.MaxValue crashed at startup / overflowed `cap+1` to a negative alloc. ParseInt now clamps to [min,max]; the client also hard-ceils the cap (MaxAllowedResponseBytes). - A ".."/"." path param collapsed the URL onto another route under Uri canonicalization — rejected in BuildPath. Both reviewers (stdin OOM): ReadLineAsync buffered an unbounded line before any guard. New BoundedLineReader drains+drops oversized lines (memory-bounded), keeping subsequent lines aligned. Nits: case-insensitive ParseBool fallback; UTF-8 boundary backoff so a mid- codepoint truncation doesn't emit U+FFFD; renamed a misleading test. 34 tests (was 26); +8 covering the transport-error path, dot-segment rejection, cap-overflow fallback, UTF-8 seam, and the bounded reader. Refs #289 #197 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 01:20:10 +02:00
timothyandClaude Opus 4.8	55fc210385	security(#289 ): harden MCP server (read-only posture, JSON-DoS, response cap, arg validation) From the #197 cold review's MCP-consumer pass. Hardens `ErsatzTV.Mcp` (PR #76) before it can go live against a soon-remote-exposed API. - HIGH verb-guard: runtime read-only posture (ERSATZTV_ALLOW_WRITES, default false) enforced in the executor — a wrong catalog entry can't mutate/delete, and future write tools (#58) slot in behind the opt-in. Not a hardcoded GET-only clamp, so the non-read-only final design stays reachable. - HIGH JSON-crash DoS: guard JsonDocument.Parse in HandleAsync (-32700, id null), handle missing/non-string method (-32600) instead of throwing, and wrap the Program.Main read loop so one bad stdin line can never kill the session. - MED unbounded response / LOW no-timeout: cap the buffered body (ERSATZTV_MAX_RESPONSE_BYTES, truncation marker) + explicit HttpClient.Timeout. - MED args unvalidated: ToolArgumentValidator checks caller args against each tool's InputSchema (required present, no unknown args, basic types) before a request is built. - MED prompt injection: documented untrusted-data posture in docs/mcp.md. - LOW base-URL prefix: preserve a reverse-proxy path prefix in the URL join. Also documents that ERSATZTV_API_KEY is now effectively required (Bundle A gates all /api reads behind X-Api-Key). 14 new tests (26 total); live stdin smoke confirms malformed/no-method/non-object lines no longer crash the loop. Refs #289 #197 #58 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-12 01:08:07 +02:00
timothy	d1c04030af	chore: retrigger CI (MySQL service port collision with concurrent run) Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 4m0s Details Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 4m29s Details Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped Details	2026-07-07 11:58:29 +02:00
timothy	945d108334	feat(mcp): add read-only API server foundation refs #58 Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 4m13s Details Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Failing after 0s Details Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped Details	2026-07-07 11:44:44 +02:00