feat: per-session token isolation, X-Allure-Token header support, security hardening

- Each SSE session stores its own Allure token (map[sessionID]token)
- X-Allure-Token header read on SSE connect, stored per-session automatically
- JWT cache keyed by API token — concurrent users never share JWTs
- sync.Mutex added to allure client JWT fields (fixes data race)
- internal/session package for context-based session ID propagation
- registry.go split into domain files (launches, results, testcases, etc.)
- GetSessionToken callback now context-aware
- resultToJSON error path fixed (was producing invalid JSON)
- crypto/rand failure now panics instead of falling back to predictable ID
- Dockerfile: alpine:3.21 pinned, Linux binary renamed from .exe
- HTTP server ReadTimeout and IdleTimeout added
- Build-time version via ldflags
- Docs: remote server config corrected to url+headers, Authorization marked optional

Author: MimoJanra

.github/workflows/build-release.yml

@@ -55,7 +55,7 @@ jobs:
           GOARCH: ${{ matrix.arch }}
         run: |
           mkdir -p build/releases
-          go build -o build/releases/${{ matrix.output }} ./cmd/server/main.go
+          go build -ldflags "-X github.com/MimoJanra/TestOpsMCP/internal/mcp.Version=${{ github.ref_name }}" -o build/releases/${{ matrix.output }} ./cmd/server/main.go
 
       - name: Upload artifact
         uses: actions/upload-artifact@v4

CHANGELOG.md

@@ -7,6 +7,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0] - Security & Architecture Hardening
+
+### Added
+- **Per-session Allure token isolation** — Each SSE session stores its own token; concurrent users on a shared server never mix credentials
+- **`X-Allure-Token` header support** — Users pass their personal Allure token from Claude Desktop config via HTTP header; no need to call `configure_allure_token` manually
+- **Token-keyed JWT cache** — JWT tokens cached per API key, not globally; separate users get separate JWTs
+- **`internal/session` package** — Shared context helpers for session ID propagation across packages
+- **Server startup warning** — Logged when HTTP mode runs without `MCP_AUTH_TOKEN`
+- **Build-time version injection** — Server version set via `-ldflags` instead of hardcoded `"1.0.0"`
+
+### Changed
+- **`registry.go` split into domain files** — `tools_launches.go`, `tools_results.go`, `tools_testcases.go`, `tools_projects.go`, `tools_analytics.go`, `tools_bulk.go`, `tools_relations.go`
+- **`GetSessionToken` callback now context-aware** — Receives `context.Context` to resolve the correct per-session token
+- **Dockerfile** — Pinned `alpine:3.21`, removed `.exe` suffix from Linux binary
+- **HTTP server timeouts** — Added `ReadTimeout` and `IdleTimeout`; `WriteTimeout` disabled for SSE long-lived streams
+- **Documentation** — All Claude Desktop config examples corrected to use `url` + `headers` for remote servers; `Authorization` marked optional
+
+### Fixed
+- **Data race on JWT cache** — Added `sync.Mutex` protecting `jwtToken`/`jwtExpiresAt` fields
+- **Cross-user token contamination** — Global `sessionToken` field replaced with per-session map
+- **Invalid JSON on marshal error** — `resultToJSON` error path now uses `json.Marshal` instead of `fmt.Sprintf`
+- **Predictable session ID fallback** — `crypto/rand` failure now panics instead of using `time.Now().UnixNano()`
+- **`SetSessionTokenFunc` visibility** — Exported function field replaced with proper setter method
+
 ## [1.4.0] - Token Priority & Shared Server Auth
 
 ### Added

Dockerfile

@@ -9,19 +9,19 @@ RUN apk add --no-cache git make
 # Copy source code
 COPY . .
 
-# Build the binary
-RUN make build
+# Build the binary (explicit output name without .exe for Linux)
+RUN go build -o bin/server ./cmd/server
 
 # Runtime stage - minimal image
-FROM alpine:latest
+FROM alpine:3.21
 
 # Install ca-certificates for HTTPS connections to Allure
 RUN apk add --no-cache ca-certificates
 
 WORKDIR /app
 
 # Copy binary from builder
-COPY --from=builder /build/bin/server.exe /app/server.exe
+COPY --from=builder /build/bin/server /app/server
 
 # Create non-root user
 RUN addgroup -g 1000 mcp && \
@@ -35,5 +35,5 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
     CMD wget -qO /dev/null http://localhost:3000/sse || exit 1
 
-ENTRYPOINT ["/app/server.exe"]
+ENTRYPOINT ["/app/server"]
 CMD ["--http"]

Makefile

@@ -1,10 +1,13 @@
 .PHONY: build run run-http test clean lint help
 
 # Build the server binary
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
+LDFLAGS := -ldflags "-X github.com/MimoJanra/TestOpsMCP/internal/mcp.Version=$(VERSION)"
+
 build:
-	@echo "Building Allure MCP server..."
+	@echo "Building Allure MCP server ($(VERSION))..."
 	mkdir -p bin
-	go build -o bin/server.exe ./cmd/server
+	go build $(LDFLAGS) -o bin/server.exe ./cmd/server
 	@echo "✓ Server built successfully at bin/server.exe"
 
 # Run server in stdio mode (default)

README.md

@@ -46,16 +46,19 @@ Add this to the `mcpServers` section:
 {
   "mcpServers": {
     "testops": {
-      "command": "http://your-server.com:3000",
-      "env": {
-        "ALLURE_TOKEN": "your-personal-token-here"
+      "url": "http://your-server.com:3000/sse",
+      "headers": {
+        "Authorization": "Bearer your-mcp-auth-token", // optional
+        "X-Allure-Token": "your-personal-allure-token"
       }
     }
   }
 }
 ```
 
-Replace `your-server.com:3000` with the server address and `your-personal-token-here` with your personal Allure API token (so your actions are done from your account).
+- **`url`** — address of the shared MCP server (ask your team lead).
+- **`Authorization`** *(optional)* — the `MCP_AUTH_TOKEN` set on the server. Omit if the server has no `MCP_AUTH_TOKEN` configured.
+- **`X-Allure-Token`** — your personal Allure API token. All actions in Allure will be done under your account.
 
 ### 3. Restart Claude Desktop
 Close and reopen Claude.
@@ -186,21 +189,25 @@ Each team member adds to their Claude Desktop config (**Settings → Developer 
 {
   "mcpServers": {
     "testops": {
-      "command": "http://your-server.com:3000",
-      "env": {
-        "ALLURE_TOKEN": "their-personal-token-here"
+      "url": "http://your-server.com:3000/sse",
+      "headers": {
+        "Authorization": "Bearer your-mcp-auth-token", // optional
+        "X-Allure-Token": "your-personal-allure-token"
       }
     }
   }
 }
 ```
 
+- **`Authorization`** *(optional)* — the `MCP_AUTH_TOKEN` set on the server. Omit if the server has no `MCP_AUTH_TOKEN` configured.
+- **`X-Allure-Token`** — each person's own Allure API token. Actions in Allure are performed under that account.
+
 Each person needs to:
 1. Get their personal Allure API token (Settings → API tokens in Allure TestOps)
-2. Add it to their Claude Desktop config
+2. Add it to their Claude Desktop config as `X-Allure-Token`
 3. Restart Claude Desktop
 
-All actions will be done from their personal account! ✅
+All actions will be done from their personal Allure account! ✅
 
 ### Binary Setup (Alternative)
 

cmd/server/main.go

@@ -56,6 +56,9 @@ func runHTTP(mcpServer *mcp.Server, cfg *config.Config, logger *core.Logger) {
 		"auth":      cfg.AuthToken != "",
 		"cors":      cfg.CORSAllowOrigin,
 	})
+	if cfg.AuthToken == "" {
+		logger.Warn("MCP_AUTH_TOKEN is not set — HTTP server accepts unauthenticated requests", nil)
+	}
 
 	mux := http.NewServeMux()
 	mux.HandleFunc("/sse", mcpServer.HandleSSE)
@@ -65,6 +68,9 @@ func runHTTP(mcpServer *mcp.Server, cfg *config.Config, logger *core.Logger) {
 		Addr:              cfg.Port,
 		Handler:           mux,
 		ReadHeaderTimeout: 10 * time.Second,
+		ReadTimeout:       15 * time.Second,
+		WriteTimeout:      0, // SSE streams are long-lived; rely on client disconnect
+		IdleTimeout:       120 * time.Second,
 	}
 
 	sigChan := make(chan os.Signal, 1)

docs/DEPLOYMENT.md

@@ -61,12 +61,19 @@ Add to Claude Desktop config:
 {
   "mcpServers": {
     "testops": {
-      "command": "http://your-server.com:3000"
+      "url": "http://your-server.com:3000/sse",
+      "headers": {
+        "Authorization": "Bearer your-mcp-auth-token", // optional
+        "X-Allure-Token": "your-personal-allure-token"
+      }
     }
   }
 }
 ```
 
+- **`Authorization`** *(optional)* — the `MCP_AUTH_TOKEN` set on the server. Omit if no `MCP_AUTH_TOKEN` is configured.
+- **`X-Allure-Token`** — each user's personal Allure API token. Actions in Allure are performed under that account.
+
 ---
 
 ## Docker Deployment

docs/QUICKSTART.md

@@ -70,9 +70,10 @@ curl -H "Authorization: Bearer your_shared_secret" \
 {
   "mcpServers": {
     "allure": {
-      "url": "http://localhost:3000",
-      "env": {
-        "MCP_AUTH_TOKEN": "your_shared_secret"
+      "url": "http://localhost:3000/sse",
+      "headers": {
+        "Authorization": "Bearer your_shared_secret", // optional
+        "X-Allure-Token": "your-personal-allure-token"
       }
     }
   }
@@ -107,9 +108,10 @@ docker-compose down
 {
   "mcpServers": {
     "allure": {
-      "url": "http://your-server:3000",
-      "env": {
-        "MCP_AUTH_TOKEN": "your_shared_secret_from_.env"
+      "url": "http://your-server:3000/sse",
+      "headers": {
+        "Authorization": "Bearer your_shared_secret_from_.env", // optional
+        "X-Allure-Token": "your-personal-allure-token"
       }
     }
   }
@@ -146,9 +148,10 @@ kubectl get svc -n allure-mcp
 {
   "mcpServers": {
     "allure": {
-      "url": "http://your-k8s-service:3000",
-      "env": {
-        "MCP_AUTH_TOKEN": "your_shared_secret"
+      "url": "http://your-k8s-service:3000/sse",
+      "headers": {
+        "Authorization": "Bearer your_shared_secret", // optional
+        "X-Allure-Token": "your-personal-allure-token"
       }
     }
   }

internal/adapters/allure/client.go

@@ -10,86 +10,119 @@ import (
 	"net/http/cookiejar"
 	"net/url"
 	"strings"
+	"sync"
 	"time"
 )
 
+type jwtEntry struct {
+	jwt       string
+	expiresAt time.Time
+}
+
 type Client struct {
-	baseURL        string
-	userToken      string
-	jwtToken       string
-	jwtExpiresAt   time.Time
-	httpClient     *http.Client
-	GetSessionToken func() string // optional callback to get session token
+	baseURL    string
+	userToken  string
+	httpClient *http.Client
+
+	mu              sync.Mutex
+	jwtCache        map[string]jwtEntry    // keyed by API token — each user's JWT is stored separately
+	getSessionToken func(ctx context.Context) string
 }
 
 func NewClient(baseURL, token string, timeout time.Duration) *Client {
 	jar, _ := cookiejar.New(nil)
 	return &Client{
 		baseURL:   strings.TrimRight(baseURL, "/"),
 		userToken: token,
+		jwtCache:  make(map[string]jwtEntry),
 		httpClient: &http.Client{
 			Timeout: timeout,
 			Jar:     jar,
 		},
 	}
 }
 
+func (c *Client) SetSessionTokenFunc(fn func(ctx context.Context) string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.getSessionToken = fn
+}
+
+// resolveAPIToken returns the API token to use for this request: the per-session
+// token (if set by the user via configure_allure_token) or the server-wide token.
+func (c *Client) resolveAPIToken(ctx context.Context) string {
+	if c.getSessionToken != nil {
+		if t := c.getSessionToken(ctx); t != "" {
+			return t
+		}
+	}
+	return c.userToken
+}
+
 func (c *Client) getJWTToken(ctx context.Context) (string, error) {
-	if c.jwtToken != "" && time.Now().Before(c.jwtExpiresAt) {
-		return c.jwtToken, nil
+	apiToken := c.resolveAPIToken(ctx)
+	if apiToken == "" {
+		return "", fmt.Errorf("no token configured - set ALLURE_TOKEN env var or use configure_allure_token tool")
 	}
 
-	// Session token has priority (user-provided in chat), fallback to configured token
-	token := ""
-	if c.GetSessionToken != nil {
-		token = c.GetSessionToken()
+	// Check cache without holding the lock during the HTTP call.
+	c.mu.Lock()
+	if entry, ok := c.jwtCache[apiToken]; ok && time.Now().Before(entry.expiresAt) {
+		c.mu.Unlock()
+		return entry.jwt, nil
 	}
-	if token == "" {
-		token = c.userToken
+	c.mu.Unlock()
+
+	jwt, expiresIn, err := c.fetchJWT(ctx, apiToken)
+	if err != nil {
+		return "", err
 	}
-	if token == "" {
-		return "", fmt.Errorf("no token configured - set ALLURE_TOKEN env var or use configure_allure_token tool")
+
+	expiresAt := time.Now().Add(time.Duration(expiresIn) * time.Second)
+	if expiresIn <= 0 {
+		expiresAt = time.Now().Add(1 * time.Hour)
 	}
 
+	c.mu.Lock()
+	c.jwtCache[apiToken] = jwtEntry{jwt: jwt, expiresAt: expiresAt}
+	c.mu.Unlock()
+
+	return jwt, nil
+}
+
+func (c *Client) fetchJWT(ctx context.Context, apiToken string) (string, int, error) {
 	values := url.Values{}
 	values.Set("grant_type", "apitoken")
 	values.Set("scope", "openid")
-	values.Set("token", token)
+	values.Set("token", apiToken)
 
-	body := strings.NewReader(values.Encode())
-	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, c.url("/api/uaa/oauth/token"), body)
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, c.url("/api/uaa/oauth/token"), strings.NewReader(values.Encode()))
 	if err != nil {
-		return "", fmt.Errorf("create request: %w", err)
+		return "", 0, fmt.Errorf("create request: %w", err)
 	}
 	httpReq.Header.Set("Expect", "")
 	httpReq.Header.Set("Accept", "application/json")
 	httpReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
 	resp, err := c.httpClient.Do(httpReq)
 	if err != nil {
-		return "", fmt.Errorf("http request: %w", err)
+		return "", 0, fmt.Errorf("http request: %w", err)
 	}
 	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
-		return "", errFromResponse(resp)
+		return "", 0, errFromResponse(resp)
 	}
 
 	var result struct {
 		AccessToken string `json:"access_token"`
 		ExpiresIn   int    `json:"expires_in"`
 	}
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
-		return "", fmt.Errorf("decode response: %w", err)
+		return "", 0, fmt.Errorf("decode response: %w", err)
 	}
 
-	c.jwtToken = result.AccessToken
-	if result.ExpiresIn > 0 {
-		c.jwtExpiresAt = time.Now().Add(time.Duration(result.ExpiresIn) * time.Second)
-	} else {
-		c.jwtExpiresAt = time.Now().Add(1 * time.Hour)
-	}
-	return c.jwtToken, nil
+	return result.AccessToken, result.ExpiresIn, nil
 }
 
 func (c *Client) CreateLaunch(ctx context.Context, projectID int64, launchName string) (*LaunchResponse, error) {