Merge branch 'main' into fix_redis_connection_leak

Author: aidbutlr

.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 1.0.5
+current_version = 1.0.6
 commit = False
 tag = False
 sign-tags = True

.dockerignore

@@ -13,7 +13,6 @@ agent_runtimes/
 charts/
 deployment/
 docs/
-deployment/k8s/
 mcp-servers/
 !mcp-servers/
 !mcp-servers/rust/
@@ -24,13 +23,10 @@ mcp-servers/
 tests/
 test/
 attic/
-*.md
 .benchmarks/
 .claude
 
 # Rust MCP servers built from the root Cargo workspace.
-!mcp-servers/
-!mcp-servers/rust/
 !mcp-servers/rust/fast-time-server/
 !mcp-servers/rust/fast-time-server/Cargo.toml
 !mcp-servers/rust/fast-time-server/src/
@@ -48,8 +44,6 @@ attic/
 # Development environment directories
 .devcontainer/
 .github/
-.vscode/
-.idea/
 
 #----------------------------------------------------------------------
 # 2. Version control
@@ -65,7 +59,6 @@ attic/
 # Byte-compiled files
 __pycache__/
 *.py[cod]
-*.pyc
 *$py.class
 
 # C extensions
@@ -130,11 +123,8 @@ cython_debug/
 #----------------------------------------------------------------------
 # 4. Virtual environments
 #----------------------------------------------------------------------
-.env
 .venv
-.venv/
 **/.venv
-**/.venv/
 env/
 venv/
 ENV/
@@ -199,7 +189,6 @@ podman-compose*.yaml
 *~
 
 # Emacs
-*~
 \#*\#
 .\#*
 
@@ -237,7 +226,6 @@ MANIFEST.in
 .travis.*
 .gitlab-ci.yml
 .circleci/
-.github/
 azure-pipelines.yml
 Jenkinsfile
 
@@ -260,8 +248,6 @@ mypy.ini
 *.db
 *.sqlite
 *.sqlite3
-mcp.db
-db.sqlite3
 # Explicit database file patterns in application directories
 mcpgateway/*.db
 mcpgateway/*.sqlite
@@ -313,14 +299,9 @@ local_settings.py
 # 10. Framework-specific files
 #----------------------------------------------------------------------
 # Django
-*.log
-local_settings.py
-db.sqlite3
 db.sqlite3-journal
-media/
 
 # Flask
-instance/
 .webassets-cache
 
 # Scrapy
@@ -333,7 +314,6 @@ docs/build/
 # PyBuilder
 target/
 **/target/
-**/target/**
 
 # Jupyter Notebook
 .ipynb_checkpoints
@@ -371,25 +351,17 @@ celerybeat.pid
 *.rej
 .backup/
 backup/
-tmp/
 temp/
 
 #----------------------------------------------------------------------
 # 12. Documentation and miscellaneous
 #----------------------------------------------------------------------
 *.md
 !README.md
-
-# Application configuration files (explicitly include)
-!mcp-catalog.yml
-LICENSE
-CHANGELOG
-AUTHORS
-CONTRIBUTORS
-TODO
-TODO.md
-DEVELOPING.md
-CONTRIBUTING.md
+!CHANGELOG.md
+!AUTHORS.md
+!DEVELOPING.md
+!CONTRIBUTING.md
 
 # Spelling
 .spellcheck-en.txt
@@ -410,7 +382,6 @@ Desktop.ini
 $RECYCLE.BIN/
 
 # Linux
-*~
 .fuse_hidden*
 .directory
 .Trash-*

.env.example

@@ -9,22 +9,68 @@
 # in modules (not part of Settings). Those sections are labeled explicitly.
 
 # =============================================================================
-# Required: change before use
+# REQUIRED SECRETS - Application will NOT start without these
+# =============================================================================
+#
+# ⚠️  SECURITY WARNING: JWT_SECRET_KEY and AUTH_ENCRYPTION_SECRET are REQUIRED
+#     in EVERY environment — including local development.
+#     The application will refuse to start if either value is a placeholder
+#     (__REPLACE_ME__) or a known-weak default.
+#
+# Quickstart (fresh checkout):
+#   1. make install-dev          # installs Python deps — does NOT touch .env
+#   2. make init-secrets         # generates .env.secrets (prompts before overwrite)
+#   3. Copy values from .env.secrets into this file, OR:
+#      make init-secrets-patch-env  # patches secrets directly into .env (no copy needed)
+#
+# Docker Compose / CI (non-interactive):
+#   python3 -m mcpgateway.scripts.init_secrets --patch-env .env
+#   # or: python3 -m mcpgateway.scripts.init_secrets --force && \
+#   #     grep -E '^(JWT_SECRET_KEY|AUTH_ENCRYPTION_SECRET|BASIC_AUTH_PASSWORD)=' .env.secrets >> .env
+#
+# What each path writes:
+#   make init-secrets / --stdout / --force (writes .env.secrets):
+#     - JWT_SECRET_KEY          (REQUIRED — all environments)
+#     - AUTH_ENCRYPTION_SECRET  (REQUIRED — all environments)
+#     - BASIC_AUTH_PASSWORD     (for UI/API Basic Auth)
+#     - PLATFORM_ADMIN_PASSWORD (for bootstrap admin account)
+#
+#   make setup / make init-secrets-patch-env / --patch-env (in-place patch):
+#     - JWT_SECRET_KEY          (patched when placeholder or weak)
+#     - AUTH_ENCRYPTION_SECRET  (patched when placeholder or weak)
+#     - BASIC_AUTH_PASSWORD     (patched when "changeme" or placeholder)
+#     NOTE: PLATFORM_ADMIN_PASSWORD is NOT patched by this path — set it manually
+#           or via helm/k8s secrets before production deployment.
+#
 # =============================================================================
 
-# Admin UI HTTP Basic Auth credentials
-# PRODUCTION: Change these values
-BASIC_AUTH_USER=admin
-BASIC_AUTH_PASSWORD=changeme
-
-# JWT secret used to sign tokens
-# Generate with: python -m mcpgateway.scripts.init_secrets --stdout
+# JWT secret used to sign tokens (REQUIRED — all environments, including development)
+# Generate with: python3 -m mcpgateway.scripts.init_secrets
 JWT_SECRET_KEY=__REPLACE_ME__run_init-secrets_before_starting
 
-# Passphrase used to encrypt stored auth secrets
-# Generate with: python -m mcpgateway.scripts.init_secrets --stdout
+# Passphrase used to encrypt stored auth secrets (REQUIRED — all environments, including development)
+# Generate with: python3 -m mcpgateway.scripts.init_secrets
 AUTH_ENCRYPTION_SECRET=__REPLACE_ME__run_init-secrets_before_starting
 
+# =============================================================================
+# Environment Mode
+# =============================================================================
+# Controls CORS, cookie security, and operational defaults — but NOT secret
+# enforcement. Placeholder/weak secrets are rejected in every environment.
+# - development: Relaxed CORS (localhost:3000/8080), insecure cookies, dev info
+# - staging: Production-like CORS and cookie defaults, staging domain
+# - production: Strict CORS (APP_DOMAIN only), secure cookies, no debug info
+# Default: development (if not set)
+ENVIRONMENT=development
+
+# =============================================================================
+# Admin UI HTTP Basic Auth credentials
+# =============================================================================
+# BASIC_AUTH_PASSWORD is patched to a strong value by make setup / make init-secrets-patch-env.
+# PLATFORM_ADMIN_PASSWORD must be set manually — it is not patched by the automated path.
+BASIC_AUTH_USER=admin
+BASIC_AUTH_PASSWORD=changeme  # pragma: allowlist secret
+
 # -----------------------------------------------------------------------------
 # CSRF Protection Configuration
 # -----------------------------------------------------------------------------
@@ -588,7 +634,7 @@ DATAPLANE_PUBLISHER_INTERVAL_SECONDS = 60
 
 # Health checks
 # HEALTH_CHECK_INTERVAL=60
-# HEALTH_CHECK_TIMEOUT=5
+# HEALTH_CHECK_TIMEOUT=30
 # UNHEALTHY_THRESHOLD=3
 # GATEWAY_VALIDATION_TIMEOUT=5
 # MAX_CONCURRENT_HEALTH_CHECKS=10
@@ -988,11 +1034,12 @@ MCPGATEWAY_SKIP_MIGRATIONS=false
 #   ECDSA (Asymmetric): ES256, ES384, ES512 - High performance, modern crypto
 # JWT_ALGORITHM=HS256
 
-# === HMAC (Symmetric) Configuration - Default for Development ===
+# === HMAC (Symmetric) Configuration ===
 # Secret used to sign JWTs (required for HMAC algorithms: HS256, HS384, HS512)
-# PRODUCTION: Use a strong, random secret (minimum 32 characters)
-# Generate with: openssl rand -base64 32
-# JWT_SECRET_KEY=my-test-key-but-now-longer-than-32-bytes
+# REQUIRED in all environments — see "REQUIRED SECRETS" section at the top of this file.
+# Use a strong, random secret (minimum 32 characters). Generate with:
+#   python3 -m mcpgateway.scripts.init_secrets
+# JWT_SECRET_KEY=
 
 # === RSA/ECDSA (Asymmetric) Configuration - Recommended for Production ===
 # Public and private key paths (required for asymmetric algorithms: RS*, ES*)
@@ -1163,9 +1210,9 @@ VALIDATE_TOKEN_ENVIRONMENT=true
 # SECURITY: Keep this false in production unless you explicitly need public sign-up
 # PUBLIC_REGISTRATION_ENABLED=false
 
-# Admin protection mode
-# When true (default), no admin can be demoted, deactivated, or locked out via API/UI
-# When false, only the last remaining active admin is protected
+# Admin login-lockout protection
+# When true (default), active admin accounts can bypass login lockout
+# Admin self-demotion and last-active-admin protection are always enforced independently
 # PROTECT_ALL_ADMINS=true
 
 # Platform admin user (bootstrap from environment)
@@ -1286,7 +1333,8 @@ VALIDATE_TOKEN_ENVIRONMENT=true
 
 # Used to derive an AES encryption key for secure auth storage
 # Must be a non-empty string (e.g. passphrase or random secret)
-# AUTH_ENCRYPTION_SECRET=my-test-salt
+# Generate with: python3 -m mcpgateway.scripts.init_secrets
+# AUTH_ENCRYPTION_SECRET=
 
 # Identity Propagation - forward end-user identity to upstream MCP servers
 # IDENTITY_PROPAGATION_ENABLED=false
@@ -1571,6 +1619,11 @@ VALIDATE_TOKEN_ENVIRONMENT=true
 # MAX_TEAMS_PER_USER=50
 # MAX_MEMBERS_PER_TEAM=100
 
+# Hard ceiling on how many members can be seeded in a single POST /teams request
+# (the `members` array). Validated at the request boundary before any write; the
+# per-team MAX_MEMBERS_PER_TEAM limit still applies underneath.
+# MAX_TEAM_MEMBER_SEEDS=500
+
 # Team Invitation Settings
 # INVITATION_EXPIRY_DAYS=7
 # REQUIRE_EMAIL_VERIFICATION_FOR_INVITES=true
@@ -2474,11 +2527,11 @@ VALIDATE_TOKEN_ENVIRONMENT=true
 # Project defaults block sets HEALTH_CHECK_INTERVAL=300 for local dev
 # HEALTH_CHECK_INTERVAL=60
 
-# Health check timeout in seconds (default: 5)
-# HEALTH_CHECK_TIMEOUT=5
+# Health check timeout in seconds (default: 30)
+# HEALTH_CHECK_TIMEOUT=30
 
-# Per-check timeout (seconds) to bound total time of one gateway health check (default: 5.0)
-# GATEWAY_HEALTH_CHECK_TIMEOUT=5.0
+# Per-check timeout (seconds) to bound total time of one gateway health check (default: 30.0)
+# GATEWAY_HEALTH_CHECK_TIMEOUT=30.0
 
 # Consecutive failures before marking gateway offline (default: 3)
 # UNHEALTHY_THRESHOLD=3
@@ -3053,11 +3106,6 @@ PLUGINS_CLI_MARKUP_MODE=rich
 
 # --- Runtime / launcher envs --------------------------------------------------
 
-# Runtime/launcher env (docker-entrypoint.sh)
-# HTTP server to use (for containers)
-# Options: gunicorn (default, stable), granian (alternative, Rust-based)
-# HTTP_SERVER=gunicorn
-
 # Disable access logging for performance
 # Options: true, false (default)
 # When true: Disables both gunicorn and uvicorn access logs
@@ -3068,7 +3116,7 @@ PLUGINS_CLI_MARKUP_MODE=rich
 
 # Force start even if another instance is running
 # Options: true, false (default)
-# Bypasses the lock file check at /tmp/mcpgateway-gunicorn.lock or /tmp/mcpgateway-granian.lock
+# Bypasses the lock file check at /tmp/mcpgateway-gunicorn.lock
 # FORCE_START=false
 
 # --- Gunicorn Production Server Configuration --------------------------------
@@ -3108,30 +3156,9 @@ PLUGINS_CLI_MARKUP_MODE=rich
 # WARNING: Disables preload_app. Not for production!
 # GUNICORN_DEV_MODE=false
 
-# --- Granian Runtime Configuration -------------------------------------------
-
-# These settings are used by run-granian.sh for production deployments.
-# They control the Granian server behavior.
-# GRANIAN_WORKERS=auto
-# GRANIAN_RUNTIME_MODE=auto
-# GRANIAN_RUNTIME_THREADS=1
-# GRANIAN_BLOCKING_THREADS=1
-# GRANIAN_HTTP=auto
-# GRANIAN_LOOP=uvloop
-# GRANIAN_TASK_IMPL=auto
-# GRANIAN_HTTP1_PIPELINE_FLUSH=true
-# GRANIAN_HTTP1_BUFFER_SIZE=524288
-# GRANIAN_BACKLOG=2048
-# GRANIAN_BACKPRESSURE=512
-# GRANIAN_RESPAWN_FAILED=true
-# GRANIAN_WORKERS_LIFETIME=
-# GRANIAN_WORKERS_MAX_RSS=
-# GRANIAN_DEV_MODE=false
-# GRANIAN_LOG_LEVEL=info
-
 # --- SSL/TLS Configuration (launcher) ----------------------------------------
 
-# Enable HTTPS for production deployments (run-gunicorn.sh / run-granian.sh)
+# Enable HTTPS for production deployments (run-gunicorn.sh)
 
 # Enable TLS/SSL
 # Options: true, false (default)

.gitattributes

@@ -4,3 +4,4 @@
 # Explicitly ensure shell scripts and other Unix files use LF
 *.sh text eol=lf
 *.py text eol=lf
+.secrets.baseline merge=secrets-baseline

.github/workflows/compose-prod-smoke-required.yml

@@ -0,0 +1,34 @@
+# ===============================================================
+# Compose Production Smoke — Skip Reporter
+# ===============================================================
+#
+# This workflow is the complement of compose-prod-smoke.yml.
+# It runs on every PR and immediately reports success for the
+# "Compose Production Smoke Complete" required status check so
+# that PRs are not blocked waiting for a check that only runs
+# in the merge queue.
+#
+# Together with the compose-prod-smoke-complete gate job in
+# compose-prod-smoke.yml, the required check always has a result:
+#   - Pull request  → this workflow reports success (skipped)
+#   - Merge queue   → compose-prod-smoke.yml runs the real check
+#
+# ===============================================================
+
+name: Compose Production Smoke Skip Reporter
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review]
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  compose-prod-smoke-complete:
+    name: Compose Production Smoke Complete
+    runs-on: ubuntu-latest
+    steps:
+      - name: Compose production smoke skipped on PR — runs in merge queue
+        run: echo "Compose production smoke skipped — the real check runs in the merge queue via compose-prod-smoke.yml"