feat: add admin edit endpoint for server moderation (#315)

## Summary Implements `PUT /v0/servers/{id}` admin edit endpoint to address part of issue #182, providing an API-based solution for server moderation without requiring direct database access. - **New endpoint**: `PUT /v0/servers/{id}` for editing existing servers - **Security**: Uses existing JWT auth with `PermissionActionEdit` permissions - **Anti-undelete protection**: Added `ServerStatusDeleted` status that cannot be reverted - **Full implementation**: Database, service, API, and comprehensive test coverage ## Key Use Cases - Mark malicious servers as `deleted` for takedown - Update server metadata for moderation actions Related to: https://github.com/modelcontextprotocol/registry/issues/182 (but that is not _done_ yet because we need admins to be able to login (probably with #283), and need to add docs on how to do the takedown, and probably guidelines on what we will/won't takedown)
2025-08-27 21:28:04 +01:00 · 2025-08-27 21:28:04 +01:00 · 6431f23107
commit 6431f23107
parent 36fcdff044
3 changed files with 681 additions and 23 deletions
--- a/internal/api/handlers/v0/edit.go
+++ b/internal/api/handlers/v0/edit.go
@ -0,0 +1,110 @@
+package v0
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+
+	"github.com/danielgtaylor/huma/v2"
+	"github.com/modelcontextprotocol/registry/internal/auth"
+	"github.com/modelcontextprotocol/registry/internal/config"
+	"github.com/modelcontextprotocol/registry/internal/database"
+	"github.com/modelcontextprotocol/registry/internal/model"
+	"github.com/modelcontextprotocol/registry/internal/service"
+	"github.com/modelcontextprotocol/registry/internal/validators"
+)
+
+// EditServerInput represents the input for editing a server
+type EditServerInput struct {
+	Authorization string `header:"Authorization" doc:"Registry JWT token with edit permissions" required:"true"`
+	ID            string `path:"id" doc:"Server ID (UUID)" format:"uuid"`
+	RawBody       []byte `body:"raw"`
+}
+
+// RegisterEditEndpoints registers the edit endpoint
+func RegisterEditEndpoints(api huma.API, registry service.RegistryService, cfg *config.Config) {
+	jwtManager := auth.NewJWTManager(cfg)
+
+	// Edit server endpoint
+	huma.Register(api, huma.Operation{
+		OperationID: "edit-server",
+		Method:      http.MethodPut,
+		Path:        "/v0/servers/{id}",
+		Summary:     "Edit MCP server",
+		Description: "Update an existing MCP server (admin only)",
+		Tags:        []string{"admin"},
+		Security: []map[string][]string{
+			{"bearer": {}},
+		},
+	}, func(ctx context.Context, input *EditServerInput) (*Response[model.ServerResponse], error) {
+		// Extract bearer token
+		const bearerPrefix = "Bearer "
+		authHeader := input.Authorization
+		if len(authHeader) < len(bearerPrefix) || !strings.EqualFold(authHeader[:len(bearerPrefix)], bearerPrefix) {
+			return nil, huma.Error401Unauthorized("Invalid Authorization header format. Expected 'Bearer <token>'")
+		}
+		token := authHeader[len(bearerPrefix):]
+
+		// Validate Registry JWT token
+		claims, err := jwtManager.ValidateToken(ctx, token)
+		if err != nil {
+			return nil, huma.Error401Unauthorized("Invalid or expired Registry JWT token", err)
+		}
+
+		// Validate that only allowed extension fields are present
+		if err := model.ValidatePublishRequestExtensions(input.RawBody); err != nil {
+			return nil, huma.Error400BadRequest("Invalid request format", err)
+		}
+
+		// Get current server to check permissions against existing name
+		currentServer, err := registry.GetByID(input.ID)
+		if err != nil {
+			if errors.Is(err, database.ErrNotFound) {
+				return nil, huma.Error404NotFound("Server not found")
+			}
+			return nil, huma.Error500InternalServerError("Failed to get current server", err)
+		}
+
+		// Verify edit permissions for this server using the existing server name
+		if !jwtManager.HasPermission(currentServer.Server.Name, auth.PermissionActionEdit, claims.Permissions) {
+			return nil, huma.Error403Forbidden("You do not have edit permissions for this server")
+		}
+
+		// Parse the validated request body
+		var editRequest model.PublishRequest
+		if err := json.Unmarshal(input.RawBody, &editRequest); err != nil {
+			return nil, huma.Error400BadRequest("Invalid JSON format", err)
+		}
+
+		// Validate the server detail
+		validator := validators.NewObjectValidator()
+		if err := validator.Validate(&editRequest.Server); err != nil {
+			return nil, huma.Error400BadRequest(err.Error())
+		}
+
+		// Prevent renaming servers
+		if currentServer.Server.Name != editRequest.Server.Name {
+			return nil, huma.Error400BadRequest("Cannot rename server")
+		}
+
+		// Prevent undeleting servers - once deleted, they stay deleted
+		if currentServer.Server.Status == model.ServerStatusDeleted && editRequest.Server.Status != model.ServerStatusDeleted {
+			return nil, huma.Error400BadRequest("Cannot change status of deleted server. Deleted servers cannot be undeleted.")
+		}
+
+		// Edit the server
+		updatedServer, err := registry.EditServer(input.ID, editRequest)
+		if err != nil {
+			if errors.Is(err, database.ErrNotFound) {
+				return nil, huma.Error404NotFound("Server not found")
+			}
+			return nil, huma.Error400BadRequest("Failed to edit server", err)
+		}
+
+		return &Response[model.ServerResponse]{
+			Body: *updatedServer,
+		}, nil
+	})
+}
--- a/internal/api/handlers/v0/edit_test.go
+++ b/internal/api/handlers/v0/edit_test.go
@ -0,0 +1,348 @@
+package v0_test
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/danielgtaylor/huma/v2"
+	"github.com/danielgtaylor/huma/v2/adapters/humago"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+
+	v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0"
+	"github.com/modelcontextprotocol/registry/internal/auth"
+	"github.com/modelcontextprotocol/registry/internal/config"
+	"github.com/modelcontextprotocol/registry/internal/database"
+	"github.com/modelcontextprotocol/registry/internal/model"
+)
+
+func TestEditServerEndpoint(t *testing.T) {
+	testCases := []struct {
+		name           string
+		serverID       string
+		authHeader     string
+		requestBody    interface{}
+		setupMocks     func(*MockRegistryService)
+		expectedStatus int
+		expectedError  string
+	}{
+		{
+			name:     "successful edit with valid token and permissions",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionEdit, ResourcePattern: "io.github.domdomegg/*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody: model.PublishRequest{
+				Server: model.ServerDetail{
+					Name:        "io.github.domdomegg/test-server",
+					Description: "Updated test server",
+					Status:      model.ServerStatusDeprecated,
+					Repository: model.Repository{
+						URL:    "https://github.com/domdomegg/test-server",
+						Source: "github",
+						ID:     "domdomegg/test-server",
+					},
+					VersionDetail: model.VersionDetail{
+						Version: "1.0.1",
+					},
+				},
+			},
+			setupMocks: func(registry *MockRegistryService) {
+				// Current server (not deleted)
+				currentServer := &model.ServerResponse{
+					Server: model.ServerDetail{
+						Name:        "io.github.domdomegg/test-server",
+						Description: "Original server",
+						Status:      model.ServerStatusActive,
+					},
+				}
+				registry.On("GetByID", "550e8400-e29b-41d4-a716-446655440001").Return(currentServer, nil)
+				
+				expectedResponse := &model.ServerResponse{
+					Server: model.ServerDetail{
+						Name:        "io.github.domdomegg/test-server",
+						Description: "Updated test server",
+						Status:      model.ServerStatusDeprecated,
+					},
+				}
+				registry.On("EditServer", "550e8400-e29b-41d4-a716-446655440001", mock.AnythingOfType("model.PublishRequest")).Return(expectedResponse, nil)
+			},
+			expectedStatus: http.StatusOK,
+		},
+		{
+			name:           "missing authorization header",
+			serverID:       "550e8400-e29b-41d4-a716-446655440001",
+			authHeader:     "",
+			requestBody:    model.PublishRequest{},
+			setupMocks:     func(_ *MockRegistryService) {},
+			expectedStatus: 422,
+			expectedError:  "required header parameter is missing",
+		},
+		{
+			name:           "invalid authorization header format",
+			serverID:       "550e8400-e29b-41d4-a716-446655440001",
+			authHeader:     "InvalidFormat token123",
+			requestBody:    model.PublishRequest{},
+			setupMocks:     func(_ *MockRegistryService) {},
+			expectedStatus: http.StatusUnauthorized,
+			expectedError:  "Unauthorized",
+		},
+		{
+			name:           "invalid token",
+			serverID:       "550e8400-e29b-41d4-a716-446655440001",
+			authHeader:     "Bearer invalid-token",
+			requestBody:    model.PublishRequest{},
+			setupMocks:     func(_ *MockRegistryService) {},
+			expectedStatus: http.StatusUnauthorized,
+			expectedError:  "Unauthorized",
+		},
+		{
+			name:     "permission denied - no edit permissions",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionPublish, ResourcePattern: "io.github.domdomegg/*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody: model.PublishRequest{
+				Server: model.ServerDetail{
+					Name:        "io.github.domdomegg/test-server",
+					Description: "Updated test server",
+				},
+			},
+			setupMocks: func(registry *MockRegistryService) {
+				// Need to mock GetByID since we check permissions against existing server name
+				currentServer := &model.ServerResponse{
+					Server: model.ServerDetail{
+						Name:        "io.github.domdomegg/test-server",
+						Description: "Original server",
+						Status:      model.ServerStatusActive,
+					},
+				}
+				registry.On("GetByID", "550e8400-e29b-41d4-a716-446655440001").Return(currentServer, nil)
+			},
+			expectedStatus: http.StatusForbidden,
+			expectedError:  "Forbidden",
+		},
+		{
+			name:     "permission denied - wrong resource",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionEdit, ResourcePattern: "io.github.domdomegg/*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody: model.PublishRequest{
+				Server: model.ServerDetail{
+					Name:        "io.github.other/test-server",
+					Description: "Updated test server",
+				},
+			},
+			setupMocks: func(registry *MockRegistryService) {
+				// Need to mock GetByID since we check permissions against existing server name
+				// This test case shows a different scenario: existing server is "other" but user only has perms for "domdomegg"
+				currentServer := &model.ServerResponse{
+					Server: model.ServerDetail{
+						Name:        "io.github.other/test-server",
+						Description: "Original server",
+						Status:      model.ServerStatusActive,
+					},
+				}
+				registry.On("GetByID", "550e8400-e29b-41d4-a716-446655440001").Return(currentServer, nil)
+			},
+			expectedStatus: http.StatusForbidden,
+			expectedError:  "Forbidden",
+		},
+		{
+			name:     "server not found",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionEdit, ResourcePattern: "io.github.domdomegg/*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody: model.PublishRequest{
+				Server: model.ServerDetail{
+					Name:        "io.github.domdomegg/test-server",
+					Description: "Updated test server",
+				},
+			},
+			setupMocks: func(registry *MockRegistryService) {
+				registry.On("GetByID", "550e8400-e29b-41d4-a716-446655440001").Return(nil, database.ErrNotFound)
+			},
+			expectedStatus: http.StatusNotFound,
+			expectedError:  "Not Found",
+		},
+		{
+			name:     "service error",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionEdit, ResourcePattern: "*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody: model.PublishRequest{
+				Server: model.ServerDetail{
+					Name:        "io.github.domdomegg/test-server",
+					Description: "Updated test server",
+				},
+			},
+			setupMocks: func(registry *MockRegistryService) {
+				// Current server (not deleted)
+				currentServer := &model.ServerResponse{
+					Server: model.ServerDetail{
+						Name:        "io.github.domdomegg/test-server",
+						Description: "Original server",
+						Status:      model.ServerStatusActive,
+					},
+				}
+				registry.On("GetByID", "550e8400-e29b-41d4-a716-446655440001").Return(currentServer, nil)
+				registry.On("EditServer", "550e8400-e29b-41d4-a716-446655440001", mock.AnythingOfType("model.PublishRequest")).Return(nil, errors.New("database error"))
+			},
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Bad Request",
+		},
+		{
+			name:     "invalid request body",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionEdit, ResourcePattern: "*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody:    "invalid json",
+			setupMocks:     func(_ *MockRegistryService) {},
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Bad Request",
+		},
+		{
+			name:     "cannot undelete server",
+			serverID: "550e8400-e29b-41d4-a716-446655440001",
+			authHeader: func() string {
+				cfg := &config.Config{JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c"}
+				token, _ := generateTestJWTToken(cfg, auth.JWTClaims{
+					AuthMethod:        model.AuthMethodGitHubAT,
+					AuthMethodSubject: "domdomegg",
+					Permissions: []auth.Permission{
+						{Action: auth.PermissionActionEdit, ResourcePattern: "*"},
+					},
+				})
+				return "Bearer " + token
+			}(),
+			requestBody: model.PublishRequest{
+				Server: model.ServerDetail{
+					Name:        "io.github.domdomegg/test-server",
+					Description: "Trying to undelete server",
+					Status:      model.ServerStatusActive,
+				},
+			},
+			setupMocks: func(registry *MockRegistryService) {
+				// Current server is deleted
+				currentServer := &model.ServerResponse{
+					Server: model.ServerDetail{
+						Name:        "io.github.domdomegg/test-server",
+						Description: "Original server",
+						Status:      model.ServerStatusDeleted,
+					},
+				}
+				registry.On("GetByID", "550e8400-e29b-41d4-a716-446655440001").Return(currentServer, nil)
+			},
+			expectedStatus: http.StatusBadRequest,
+			expectedError:  "Cannot change status of deleted server",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			// Create mock registry
+			mockRegistry := new(MockRegistryService)
+			tc.setupMocks(mockRegistry)
+
+			// Create Huma API
+			mux := http.NewServeMux()
+			humaConfig := huma.DefaultConfig("Test API", "1.0.0")
+			api := humago.New(mux, humaConfig)
+
+			// Register edit endpoints
+			cfg := &config.Config{
+				JWTPrivateKey: "bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb825b23f7ef47c",
+			}
+			v0.RegisterEditEndpoints(api, mockRegistry, cfg)
+
+			// Create request body
+			var requestBody []byte
+			var err error
+			if str, ok := tc.requestBody.(string); ok {
+				requestBody = []byte(str)
+			} else {
+				requestBody, err = json.Marshal(tc.requestBody)
+				assert.NoError(t, err)
+			}
+
+			// Create request
+			req := httptest.NewRequest(http.MethodPut, "/v0/servers/"+tc.serverID, bytes.NewReader(requestBody))
+			req.Header.Set("Content-Type", "application/json")
+			if tc.authHeader != "" {
+				req.Header.Set("Authorization", tc.authHeader)
+			}
+
+			// Create response recorder
+			w := httptest.NewRecorder()
+
+			// Call the endpoint
+			mux.ServeHTTP(w, req)
+
+			// Check status code
+			assert.Equal(t, tc.expectedStatus, w.Code)
+
+			// Check error message if expected
+			if tc.expectedError != "" {
+				assert.Contains(t, w.Body.String(), tc.expectedError)
+			}
+
+			mockRegistry.AssertExpectations(t)
+		})
+	}
+}
--- a/internal/api/handlers/v0/publish_test.go
+++ b/internal/api/handlers/v0/publish_test.go
@ -49,6 +49,14 @@ func (m *MockRegistryService) Publish(request model.PublishRequest) (*model.Serv
 	return args.Get(0).(*model.ServerResponse), args.Error(1)
 }

+func (m *MockRegistryService) EditServer(id string, request model.PublishRequest) (*model.ServerResponse, error) {
+	args := m.Called(id, request)
+	if args.Get(0) == nil {
+		return nil, args.Error(1)
+	}
+	return args.Get(0).(*model.ServerResponse), args.Error(1)
+}
+
 // Helper function to generate a valid JWT token for testing
 func generateTestJWTToken(cfg *config.Config, claims auth.JWTClaims) (string, error) {
 	jwtManager := auth.NewJWTManager(cfg)