fix(security): Phase 1 P0 hardening from cross-project audit

Close open uploads, image-proxy SSRF, fail-open AI quotas in production,
auth gaps on app routes, and MCP tenant isolation issues.

Co-authored-by: Cursor <cursoragent@cursor.com>

mcp-server/index-sse.js

@@ -32,7 +32,7 @@ import { randomBytes } from 'crypto';
 import express from 'express';
 import cors from 'cors';
 import { registerTools } from './tools.js';
-import { validateApiKey, resolveUser } from './auth.js';
+import { validateApiKey } from './auth.js';
 import { requestContext } from './request-context.js';
 import config, { validateConfig, printConfig } from './config.js';
 import {
@@ -278,21 +278,25 @@ if (config.enableMetrics) {
 app.use(
   withErrorHandling(async (req, res, next) => {
     if (!config.requireAuth) {
-      req.userSession = { id: 'dev-user', name: 'Development User', isAuth: false };
+      req.userSession = {
+        id: 'dev-user',
+        name: 'Development User',
+        isAuth: false,
+        userId: config.userId || null,
+      };
       recordAuth(true, 'dev-mode');
       return next();
     }
 
     const apiKey = req.headers['x-api-key'];
-    const headerUserId = req.headers['x-user-id'];
 
-    if (!apiKey && !headerUserId) {
+    if (!apiKey) {
       recordAuth(false, 'missing-credentials');
       return res
         .status(401)
         .json(
           mcpError(McpErrors.AUTH_FAILED.code, {
-            detail: 'Provide x-api-key or x-user-id header',
+            detail: 'Provide x-api-key header',
           })
         );
     }
@@ -328,24 +332,6 @@ app.use(
       return res.status(401).json(mcpError(McpErrors.AUTH_FAILED.code, { detail: 'Invalid API key' }));
     }
 
-    if (headerUserId) {
-      const user = await resolveUser(prisma, headerUserId);
-      if (!user) {
-        recordAuth(false, 'user-not-found');
-        return res.status(401).json(mcpError(McpErrors.AUTH_FAILED.code, { detail: 'User not found' }));
-      }
-      req.userSession = getOrCreateSession(`user:${user.id}`, {
-        name: user.name,
-        userId: user.id,
-        userName: user.name,
-        userEmail: user.email,
-        userRole: user.role,
-        authMethod: 'user-id',
-      });
-      recordAuth(true, 'user-id');
-      return next();
-    }
-
     recordAuth(false, 'auth-failed');
     return res.status(401).json(mcpError(McpErrors.AUTH_FAILED.code, { detail: 'Authentication failed' }));
   })

mcp-server/tools.js

@@ -12,6 +12,7 @@ import {
   McpError,
 } from '@modelcontextprotocol/sdk/types.js';
 import { requestContext } from './request-context.js';
+import { mcpErrorContent, McpErrors } from './errors.js';
 
 const DEFAULT_SEARCH_LIMIT = 50;
 const DEFAULT_NOTES_LIMIT = 100;
@@ -473,26 +474,9 @@ export function registerTools(server, prisma) {
     return store?.userId || null;
   };
 
-  let fallbackUserId = null;
-  let fallbackPromise = null;
-
-  const ensureUserId = async () => {
-    const fromContext = getResolvedUserId();
-    if (fromContext) return fromContext;
-    if (fallbackUserId) return fallbackUserId;
-    if (fallbackPromise) return fallbackPromise;
-
-    fallbackPromise = prisma.user.findFirst({ select: { id: true } }).then(u => {
-      if (u) fallbackUserId = u.id;
-      return fallbackUserId;
-    });
-
-    return fallbackPromise;
-  };
-
   const noteWhere = (resolvedUserId, extra = {}) => ({
     trashedAt: null,
-    ...(resolvedUserId ? { userId: resolvedUserId } : {}),
+    userId: resolvedUserId,
     ...extra,
   });
 
@@ -503,6 +487,11 @@ export function registerTools(server, prisma) {
   server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const { name, arguments: args } = request.params;
     const uid = getResolvedUserId();
+    if (!uid) {
+      return mcpErrorContent(McpErrors.AUTH_FAILED.code, {
+        detail: 'Authentication required: missing user context',
+      });
+    }
 
     try {
       switch (name) {
@@ -527,7 +516,7 @@ export function registerTools(server, prisma) {
             isMarkdown: args.isMarkdown || false,
             size: args.size || 'small',
             notebookId: args.notebookId || null,
-            userId: uid || await ensureUserId(),
+            userId: uid,
           };
 
           const note = await prisma.note.create({ data });
@@ -560,7 +549,7 @@ export function registerTools(server, prisma) {
 
         case 'get_note': {
           const note = await prisma.note.findUnique({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: args.id, userId: uid, trashedAt: null },
           });
           if (!note) throw new McpError(ErrorCode.InvalidRequest, 'Note not found');
           return textResult(parseNote(note));
@@ -581,7 +570,7 @@ export function registerTools(server, prisma) {
           d.updatedAt = new Date();
 
           const note = await prisma.note.update({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: args.id, userId: uid, trashedAt: null },
             data: d,
           });
           return textResult(parseNote(note));
@@ -589,7 +578,7 @@ export function registerTools(server, prisma) {
 
         case 'delete_note': {
           await prisma.note.delete({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: args.id, userId: uid, trashedAt: null },
           });
           return textResult({ success: true, deleted: args.id });
         }
@@ -599,8 +588,8 @@ export function registerTools(server, prisma) {
           const params = [query]
           let paramIdx = 1
 
-          const userClause = uid ? `AND "userId" = $${++paramIdx}` : ''
-          if (uid) params.push(uid)
+          const userClause = `AND "userId" = $${++paramIdx}`
+          params.push(uid)
 
           const notebookClause = args.notebookId ? `AND "notebookId" = $${++paramIdx}` : ''
           if (args.notebookId) params.push(args.notebookId)
@@ -628,7 +617,7 @@ export function registerTools(server, prisma) {
 
           const [note, notebook] = await Promise.all([
             prisma.note.update({
-              where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+              where: { id: args.id, userId: uid, trashedAt: null },
               data: { notebookId: targetId, updatedAt: new Date() },
             }),
             targetId
@@ -649,7 +638,7 @@ export function registerTools(server, prisma) {
           const ids = args.ids || [];
 
           await prisma.note.updateMany({
-            where: { id: { in: ids }, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: { in: ids }, userId: uid, trashedAt: null },
             data: { notebookId: targetId, updatedAt: new Date() },
           });
 
@@ -659,14 +648,14 @@ export function registerTools(server, prisma) {
         case 'batch_delete_notes': {
           const ids = args.ids || [];
           await prisma.note.deleteMany({
-            where: { id: { in: ids }, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: { in: ids }, userId: uid, trashedAt: null },
           });
           return textResult({ success: true, count: ids.length });
         }
 
         case 'toggle_pin': {
           const note = await prisma.note.findUnique({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: args.id, userId: uid, trashedAt: null },
           });
           if (!note) throw new McpError(ErrorCode.InvalidRequest, 'Note not found');
           const updated = await prisma.note.update({
@@ -678,7 +667,7 @@ export function registerTools(server, prisma) {
 
         case 'toggle_archive': {
           const note = await prisma.note.findUnique({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: args.id, userId: uid, trashedAt: null },
           });
           if (!note) throw new McpError(ErrorCode.InvalidRequest, 'Note not found');
           const updated = await prisma.note.update({
@@ -689,7 +678,7 @@ export function registerTools(server, prisma) {
         }
 
         case 'export_notes': {
-          const nbWhere = uid ? { userId: uid } : {};
+          const nbWhere = { userId: uid };
 
           const [notes, notebooks, labels] = await Promise.all([
             prisma.note.findMany({
@@ -741,7 +730,7 @@ export function registerTools(server, prisma) {
 
           if (importData.data?.notebooks?.length > 0) {
             const existing = await prisma.notebook.findMany({
-              where: uid ? { userId: uid } : {},
+              where: { userId: uid },
               select: { name: true },
             });
             const existingNames = new Set(existing.map(nb => nb.name));
@@ -752,7 +741,7 @@ export function registerTools(server, prisma) {
                 name: nb.name,
                 icon: nb.icon || '📁',
                 color: nb.color || '#3B82F6',
-                ...(uid ? { userId: uid } : {}),
+                userId: uid,
               }));
 
             if (toCreate.length > 0) {
@@ -763,7 +752,7 @@ export function registerTools(server, prisma) {
 
           if (importData.data?.labels?.length > 0) {
             const notebooks = await prisma.notebook.findMany({
-              where: uid ? { userId: uid } : {},
+              where: { userId: uid },
               select: { id: true },
             });
             const nbIds = new Set(notebooks.map(nb => nb.id));
@@ -796,7 +785,7 @@ export function registerTools(server, prisma) {
               size: note.size || 'small',
               labels: note.labels ?? null,
               notebookId: note.notebookId || null,
-              ...(uid ? { userId: uid } : {}),
+              userId: uid,
             }));
 
             try {
@@ -817,7 +806,7 @@ export function registerTools(server, prisma) {
         // ═══ NOTEBOOKS ═══
         case 'create_notebook': {
           const highest = await prisma.notebook.findFirst({
-            where: uid ? { userId: uid } : {},
+            where: { userId: uid },
             orderBy: { order: 'desc' },
             select: { order: true },
           });
@@ -830,7 +819,7 @@ export function registerTools(server, prisma) {
               color: args.color || '#3B82F6',
               order: nextOrder,
               parentId: args.parentId || null,
-              userId: uid || await ensureUserId(),
+              userId: uid,
             },
             include: { labels: true, _count: { select: { notes: true } } },
           });
@@ -839,7 +828,7 @@ export function registerTools(server, prisma) {
         }
 
         case 'get_notebooks': {
-          const where = uid ? { userId: uid } : {};
+          const where = { userId: uid };
           const notebooks = await prisma.notebook.findMany({
             where,
             include: {
@@ -853,7 +842,7 @@ export function registerTools(server, prisma) {
         }
 
         case 'get_notebook': {
-          const where = { id: args.id, ...(uid ? { userId: uid } : {}) };
+          const where = { id: args.id, userId: uid };
           const notebook = await prisma.notebook.findUnique({
             where,
             include: { labels: true, notes: { where: { trashedAt: null } }, _count: { select: { notes: true } } },
@@ -875,7 +864,7 @@ export function registerTools(server, prisma) {
           if ('order' in args) d.order = args.order;
           if ('parentId' in args) d.parentId = args.parentId;
 
-          const where = { id: args.id, ...(uid ? { userId: uid } : {}) };
+          const where = { id: args.id, userId: uid };
           const notebook = await prisma.notebook.update({
             where,
             data: d,
@@ -888,11 +877,11 @@ export function registerTools(server, prisma) {
         case 'delete_notebook': {
           await prisma.$transaction([
             prisma.note.updateMany({
-              where: { notebookId: args.id, ...(uid ? { userId: uid } : {}) },
+              where: { notebookId: args.id, userId: uid },
               data: { notebookId: null },
             }),
             prisma.notebook.delete({
-              where: { id: args.id, ...(uid ? { userId: uid } : {}) },
+              where: { id: args.id, userId: uid },
             }),
           ]);
 
@@ -901,7 +890,7 @@ export function registerTools(server, prisma) {
 
         case 'reorder_notebooks': {
           const ids = args.notebookIds;
-          const where = { id: { in: ids }, ...(uid ? { userId: uid } : {}) };
+          const where = { id: { in: ids }, userId: uid };
 
           const existing = await prisma.notebook.findMany({ where, select: { id: true } });
           const existingIds = new Set(existing.map(nb => nb.id));
@@ -920,7 +909,7 @@ export function registerTools(server, prisma) {
         }
 
         case 'get_notebook_hierarchy': {
-          const where = uid ? { userId: uid } : {};
+          const where = { userId: uid };
           const notebooks = await prisma.notebook.findMany({
             where,
             include: {
@@ -972,7 +961,7 @@ export function registerTools(server, prisma) {
             orderBy: { name: 'asc' },
           });
 
-          const filtered = uid ? labels.filter(l => l.notebook?.userId === uid) : labels;
+          const filtered = labels.filter(l => l.notebook?.userId === uid);
           return textResult(filtered);
         }
 
@@ -1017,7 +1006,7 @@ export function registerTools(server, prisma) {
         // ═══ TRASH ═══
         case 'trash_note': {
           const note = await prisma.note.update({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}) },
+            where: { id: args.id, userId: uid },
             data: { trashedAt: new Date() },
           });
           return textResult({ success: true, id: note.id, trashedAt: note.trashedAt });
@@ -1025,7 +1014,7 @@ export function registerTools(server, prisma) {
 
         case 'restore_note': {
           const note = await prisma.note.findUnique({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}) },
+            where: { id: args.id, userId: uid },
           });
           if (!note) throw new McpError(ErrorCode.InvalidRequest, 'Note not found');
           if (!note.trashedAt) return textResult({ success: true, message: 'Note was not in trash' });
@@ -1037,7 +1026,7 @@ export function registerTools(server, prisma) {
         }
 
         case 'get_trash': {
-          const where = { trashedAt: { not: null }, ...(uid ? { userId: uid } : {}) };
+          const where = { trashedAt: { not: null }, userId: uid };
           const trashed = await prisma.note.findMany({
             where,
             select: { id: true, title: true, content: true, color: true, trashedAt: true, notebookId: true },
@@ -1052,7 +1041,7 @@ export function registerTools(server, prisma) {
         // ═══ ADVANCED NOTE OPERATIONS ═══
         case 'append_to_note': {
           const note = await prisma.note.findUnique({
-            where: { id: args.id, ...(uid ? { userId: uid } : {}), trashedAt: null },
+            where: { id: args.id, userId: uid, trashedAt: null },
             select: { content: true },
           });
           if (!note) throw new McpError(ErrorCode.InvalidRequest, 'Note not found');
@@ -1072,8 +1061,8 @@ export function registerTools(server, prisma) {
           const params = [query]
           let paramIdx = 1
 
-          const userClause = uid ? `AND "userId" = $${++paramIdx}` : ''
-          if (uid) params.push(uid)
+          const userClause = `AND "userId" = $${++paramIdx}`
+          params.push(uid)
 
           const results = await prisma.$queryRawUnsafe(
             `SELECT id, title, content
@@ -1095,7 +1084,7 @@ export function registerTools(server, prisma) {
               where: {
                 trashedAt: null,
                 isArchived: false,
-                ...(uid ? { userId: uid } : {}),
+                userId: uid,
                 OR: [
                   { title: { contains: query, mode: 'insensitive' } },
                   { content: { contains: query, mode: 'insensitive' } },