DIARCHERS-1396: MCP-dedicated API layer with rate limiting, auth, and audit#610
Open
sap-yuan wants to merge 7 commits into
Open
DIARCHERS-1396: MCP-dedicated API layer with rate limiting, auth, and audit#610sap-yuan wants to merge 7 commits into
sap-yuan wants to merge 7 commits into
Conversation
added 6 commits
May 25, 2026 14:30
The global_token table (migration 00045) defines expires_at as NOT NULL, but the test was inserting rows without providing this column, causing NotNullViolation errors that cascaded into all 14 test failures. Add expires_at = NOW() + INTERVAL '30 days' to the three direct INSERT statements in global_tokens_test.py.
The package.json engines field requires node>=20.0.0 and npm>=10.0.0, but the CI Dockerfile was still using node:8.9-alpine. The build.js version check rejects the old runtime, causing the build to fail.
The cp -r of ~50,000 small files in node_modules was causing the CI job to timeout (1 hour). Using tar pipe for sequential bulk I/O reduces the copy time from minutes to seconds.
The real bottleneck was not cp -r in build.sh but job.py's post-build step that compresses and uploads /infrabox/cache via snappy+tar to the API server. With node:20's much larger node_modules (~200MB+), this compression/upload exceeds the 1-hour job timeout. Solution: stop writing node_modules back to /infrabox/cache. Instead, use mv to restore cached node_modules at the start (fast), and don't write it back (npm install with warm cache only takes ~20s anyway). This eliminates the expensive cache upload entirely.
…hang webpack 3.12.0 leaves open handles (internal timers/fs watchers) under Node.js 20, causing the process to never exit naturally after a successful build. The container hangs, docker run waits forever, and the InfraBox job hits the 1-hour timeout. The failure path already calls process.exit(1) explicitly; mirror that for the success path with process.exit(0). Root cause introduced by 34ade8f (node:8.9 -> node:20-alpine upgrade).
… and audit - DB migration 00046: mcp_token and mcp_access_log tables - api/handlers/mcp/auth.py: ib_mcp_* bearer token validation, project/trigger access checks - api/handlers/mcp/rate_limit.py: Redis sliding-window per-user per-endpoint rate limiter (fail-open) - api/handlers/mcp/audit.py: fire-and-forget audit logging to mcp_access_log - api/handlers/mcp/token_routes.py: token CRUD at /api/v1/mcp/tokens/* - api/handlers/mcp/routes/: /api/v1/mcp/* endpoints for projects, builds, jobs, artifacts, trigger - infrabox/test/api/mcp_test.py: 21 unit tests covering hash, access checks, rate limiter
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements DIARCHERS-1396: isolates all MCP/AI-agent API calls under a dedicated
/api/v1/mcp/*namespace, with independent rate limiting, scoped bearer tokens, and audit logging — mirroring the dhaas-control-center pattern.00046.sql):mcp_tokenandmcp_access_logtablessrc/api/handlers/mcp/auth.py:ib_mcp_*bearer token validation;check_project_access_mcpandcheck_trigger_access_mcphelperssrc/api/handlers/mcp/rate_limit.py: Redis sliding-window rate limiter (per-user per-endpoint, fail-open on Redis outage)src/api/handlers/mcp/audit.py: fire-and-forget audit logging intomcp_access_logsrc/api/handlers/mcp/token_routes.py: token CRUD atPOST/GET/PATCH/DELETE /api/v1/mcp/tokens/*(session auth)src/api/handlers/mcp/routes/:/api/v1/mcp/*endpoints for projects, builds, jobs, logs, artifacts, triggerinfrabox/test/api/mcp_test.py: 21 unit tests covering token hash, access checks, rate limiter (allow/deny/fail-open)Changes
/api/v1/*endpoints — MCP tokens are blocked from all non-MCP pathsallow_trigger=trueTesting
JIRA
DIARCHERS-1396