asepharyana
b621923868
- apps/mcp/src/http.ts: serve MCP over Streamable HTTP (MCP 2025-03-26) on :4021, stateless mode (sessionIdGenerator undefined), CORS on /mcp. Remote clients can now call the 6 tools + 4 resources without a stdio subprocess. - deploy/mcpedia-mcp.service: supervised systemd unit (MCP_PORT=4021). - Caddy: mcp.asepharyana.my.id -> 4021; wiki. domain now also routes /trpc/* to the API (was swallowed by web -> tRPC was unreachable on the domain). - apps/api: restoreRevision tRPC mutation now requires x-webhook-secret (the Web UI calls @mcpedia/core directly, so this only gates the open network endpoint). Threads the header into tRPC Context. Secures a state-changing action that was anonymously callable. Verified live: https://mcp.asepharyana.my.id/mcp initialize/tools/list/ resources/list all 200; restoreRevision no-secret -> unauthorized, with-secret -> handler; read-only tRPC reachable via domain.
16 lines
481 B
TypeScript
16 lines
481 B
TypeScript
import { initTRPC } from "@trpc/server";
|
|
import { db } from "@mcpedia/db";
|
|
|
|
export interface Context {
|
|
db: typeof db;
|
|
// Raw `x-webhook-secret` header from the incoming request, if present.
|
|
// State-changing tRPC mutations (restoreRevision) require it to match
|
|
// WEBHOOK_SECRET; read-only procedures ignore it.
|
|
webhookSecret?: string;
|
|
}
|
|
|
|
export const t = initTRPC.context<Context>().create();
|
|
|
|
export const router = t.router;
|
|
export const publicProcedure = t.procedure;
|