From ab338e80a76dc7aa08c4a057e3550145df72a048 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Sat, 27 Dec 2025 16:16:50 +0800
Subject: [PATCH] Add custom access type for bearer keys to support combined
 group and server scoping (#530)

Co-authored-by: samanhappy <samanhappy@gmail.com>
---
 frontend/src/pages/SettingsPage.tsx    | 247 ++++++++++++++++++-------
 frontend/src/types/index.ts            |   2 +-
 locales/en.json                        |   1 +
 locales/fr.json                        |   1 +
 locales/tr.json                        |   1 +
 locales/zh.json                        |   1 +
 src/controllers/bearerKeyController.ts |   4 +-
 src/db/entities/BearerKey.ts           |   2 +-
 src/services/sseService.ts             |  27 ++-
 src/types/index.ts                     |   6 +-
 10 files changed, 216 insertions(+), 76 deletions(-)

diff --git a/frontend/src/pages/SettingsPage.tsx b/frontend/src/pages/SettingsPage.tsx
index f431039..bec2369 100644
--- a/frontend/src/pages/SettingsPage.tsx
+++ b/frontend/src/pages/SettingsPage.tsx
@@ -25,7 +25,7 @@ interface BearerKeyRowProps {
       name: string;
       token: string;
       enabled: boolean;
-      accessType: 'all' | 'groups' | 'servers';
+      accessType: 'all' | 'groups' | 'servers' | 'custom';
       allowedGroups: string;
       allowedServers: string;
     },
@@ -47,7 +47,7 @@ const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
   const [name, setName] = useState(keyData.name);
   const [token, setToken] = useState(keyData.token);
   const [enabled, setEnabled] = useState<boolean>(keyData.enabled);
-  const [accessType, setAccessType] = useState<'all' | 'groups' | 'servers'>(
+  const [accessType, setAccessType] = useState<'all' | 'groups' | 'servers' | 'custom'>(
     keyData.accessType || 'all',
   );
   const [selectedGroups, setSelectedGroups] = useState<string[]>(keyData.allowedGroups || []);
@@ -105,6 +105,13 @@ const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
       );
       return;
     }
+    if (accessType === 'custom' && selectedGroups.length === 0 && selectedServers.length === 0) {
+      showToast(
+        t('settings.selectAtLeastOneGroupOrServer') || 'Please select at least one group or server',
+        'error',
+      );
+      return;
+    }
 
     setSaving(true);
     try {
@@ -135,6 +142,31 @@ const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
   };
 
   const isGroupsMode = accessType === 'groups';
+  const isCustomMode = accessType === 'custom';
+
+  // Helper function to format access type display text
+  const formatAccessTypeDisplay = (key: BearerKey): string => {
+    if (key.accessType === 'all') {
+      return t('settings.bearerKeyAccessAll') || 'All Resources';
+    }
+    if (key.accessType === 'groups') {
+      return `${t('settings.bearerKeyAccessGroups') || 'Groups'}: ${key.allowedGroups}`;
+    }
+    if (key.accessType === 'servers') {
+      return `${t('settings.bearerKeyAccessServers') || 'Servers'}: ${key.allowedServers}`;
+    }
+    if (key.accessType === 'custom') {
+      const parts: string[] = [];
+      if (key.allowedGroups && key.allowedGroups.length > 0) {
+        parts.push(`${t('settings.bearerKeyAccessGroups') || 'Groups'}: ${key.allowedGroups}`);
+      }
+      if (key.allowedServers && key.allowedServers.length > 0) {
+        parts.push(`${t('settings.bearerKeyAccessServers') || 'Servers'}: ${key.allowedServers}`);
+      }
+      return `${t('settings.bearerKeyAccessCustom') || 'Custom'}: ${parts.join('; ')}`;
+    }
+    return '';
+  };
 
   if (isEditing) {
     return (
@@ -194,7 +226,9 @@ const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
                 <select
                   className="block w-full py-2 px-3 border border-gray-300 bg-white rounded-md shadow-sm focus:outline-none focus:ring-blue-500 focus:border-blue-500 sm:text-sm form-select transition-shadow duration-200"
                   value={accessType}
-                  onChange={(e) => setAccessType(e.target.value as 'all' | 'groups' | 'servers')}
+                  onChange={(e) =>
+                    setAccessType(e.target.value as 'all' | 'groups' | 'servers' | 'custom')
+                  }
                   disabled={loading}
                 >
                   <option value="all">{t('settings.bearerKeyAccessAll') || 'All Resources'}</option>
@@ -204,29 +238,65 @@ const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
                   <option value="servers">
                     {t('settings.bearerKeyAccessServers') || 'Specific Servers'}
                   </option>
+                  <option value="custom">
+                    {t('settings.bearerKeyAccessCustom') || 'Custom (Groups & Servers)'}
+                  </option>
                 </select>
               </div>
 
-              <div className="flex-1 min-w-[200px]">
-                <label
-                  className={`block text-sm font-medium mb-1 ${accessType === 'all' ? 'text-gray-400' : 'text-gray-700'}`}
-                >
-                  {isGroupsMode
-                    ? t('settings.bearerKeyAllowedGroups') || 'Allowed groups'
-                    : t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
-                </label>
-                <MultiSelect
-                  options={isGroupsMode ? availableGroups : availableServers}
-                  selected={isGroupsMode ? selectedGroups : selectedServers}
-                  onChange={isGroupsMode ? setSelectedGroups : setSelectedServers}
-                  placeholder={
-                    isGroupsMode
-                      ? t('settings.selectGroups') || 'Select groups...'
-                      : t('settings.selectServers') || 'Select servers...'
-                  }
-                  disabled={loading || accessType === 'all'}
-                />
-              </div>
+              {/* Show single selector for groups or servers mode */}
+              {!isCustomMode && (
+                <div className="flex-1 min-w-[200px]">
+                  <label
+                    className={`block text-sm font-medium mb-1 ${accessType === 'all' ? 'text-gray-400' : 'text-gray-700'}`}
+                  >
+                    {isGroupsMode
+                      ? t('settings.bearerKeyAllowedGroups') || 'Allowed groups'
+                      : t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
+                  </label>
+                  <MultiSelect
+                    options={isGroupsMode ? availableGroups : availableServers}
+                    selected={isGroupsMode ? selectedGroups : selectedServers}
+                    onChange={isGroupsMode ? setSelectedGroups : setSelectedServers}
+                    placeholder={
+                      isGroupsMode
+                        ? t('settings.selectGroups') || 'Select groups...'
+                        : t('settings.selectServers') || 'Select servers...'
+                    }
+                    disabled={loading || accessType === 'all'}
+                  />
+                </div>
+              )}
+
+              {/* Show both selectors for custom mode */}
+              {isCustomMode && (
+                <>
+                  <div className="flex-1 min-w-[200px]">
+                    <label className="block text-sm font-medium text-gray-700 mb-1">
+                      {t('settings.bearerKeyAllowedGroups') || 'Allowed groups'}
+                    </label>
+                    <MultiSelect
+                      options={availableGroups}
+                      selected={selectedGroups}
+                      onChange={setSelectedGroups}
+                      placeholder={t('settings.selectGroups') || 'Select groups...'}
+                      disabled={loading}
+                    />
+                  </div>
+                  <div className="flex-1 min-w-[200px]">
+                    <label className="block text-sm font-medium text-gray-700 mb-1">
+                      {t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
+                    </label>
+                    <MultiSelect
+                      options={availableServers}
+                      selected={selectedServers}
+                      onChange={setSelectedServers}
+                      placeholder={t('settings.selectServers') || 'Select servers...'}
+                      disabled={loading}
+                    />
+                  </div>
+                </>
+              )}
 
               <div className="flex justify-end gap-2">
                 <button
@@ -281,11 +351,7 @@ const BearerKeyRow: React.FC<BearerKeyRowProps> = ({
         </span>
       </td>
       <td className="px-6 py-4 whitespace-nowrap text-sm text-gray-500">
-        {keyData.accessType === 'all'
-          ? t('settings.bearerKeyAccessAll') || 'All Resources'
-          : keyData.accessType === 'groups'
-            ? `${t('settings.bearerKeyAccessGroups') || 'Groups'}: ${keyData.allowedGroups}`
-            : `${t('settings.bearerKeyAccessServers') || 'Servers'}: ${keyData.allowedServers}`}
+        {formatAccessTypeDisplay(keyData)}
       </td>
       <td className="px-6 py-4 whitespace-nowrap text-right text-sm font-medium">
         <button
@@ -737,7 +803,7 @@ const SettingsPage: React.FC = () => {
     name: string;
     token: string;
     enabled: boolean;
-    accessType: 'all' | 'groups' | 'servers';
+    accessType: 'all' | 'groups' | 'servers' | 'custom';
     allowedGroups: string;
     allowedServers: string;
   }>({
@@ -765,10 +831,10 @@ const SettingsPage: React.FC = () => {
 
   // Reset selected arrays when accessType changes
   useEffect(() => {
-    if (newBearerKey.accessType !== 'groups') {
+    if (newBearerKey.accessType !== 'groups' && newBearerKey.accessType !== 'custom') {
       setNewSelectedGroups([]);
     }
-    if (newBearerKey.accessType !== 'servers') {
+    if (newBearerKey.accessType !== 'servers' && newBearerKey.accessType !== 'custom') {
       setNewSelectedServers([]);
     }
   }, [newBearerKey.accessType]);
@@ -866,6 +932,17 @@ const SettingsPage: React.FC = () => {
       );
       return;
     }
+    if (
+      newBearerKey.accessType === 'custom' &&
+      newSelectedGroups.length === 0 &&
+      newSelectedServers.length === 0
+    ) {
+      showToast(
+        t('settings.selectAtLeastOneGroupOrServer') || 'Please select at least one group or server',
+        'error',
+      );
+      return;
+    }
 
     await createBearerKey({
       name: newBearerKey.name,
@@ -873,11 +950,13 @@ const SettingsPage: React.FC = () => {
       enabled: newBearerKey.enabled,
       accessType: newBearerKey.accessType,
       allowedGroups:
-        newBearerKey.accessType === 'groups' && newSelectedGroups.length > 0
+        (newBearerKey.accessType === 'groups' || newBearerKey.accessType === 'custom') &&
+        newSelectedGroups.length > 0
           ? newSelectedGroups
           : undefined,
       allowedServers:
-        newBearerKey.accessType === 'servers' && newSelectedServers.length > 0
+        (newBearerKey.accessType === 'servers' || newBearerKey.accessType === 'custom') &&
+        newSelectedServers.length > 0
           ? newSelectedServers
           : undefined,
     } as any);
@@ -901,7 +980,7 @@ const SettingsPage: React.FC = () => {
       name: string;
       token: string;
       enabled: boolean;
-      accessType: 'all' | 'groups' | 'servers';
+      accessType: 'all' | 'groups' | 'servers' | 'custom';
       allowedGroups: string;
       allowedServers: string;
     },
@@ -1128,7 +1207,7 @@ const SettingsPage: React.FC = () => {
                           onChange={(e) =>
                             setNewBearerKey((prev) => ({
                               ...prev,
-                              accessType: e.target.value as 'all' | 'groups' | 'servers',
+                              accessType: e.target.value as 'all' | 'groups' | 'servers' | 'custom',
                             }))
                           }
                           disabled={loading}
@@ -1142,41 +1221,75 @@ const SettingsPage: React.FC = () => {
                           <option value="servers">
                             {t('settings.bearerKeyAccessServers') || 'Specific Servers'}
                           </option>
+                          <option value="custom">
+                            {t('settings.bearerKeyAccessCustom') || 'Custom (Groups & Servers)'}
+                          </option>
                         </select>
                       </div>
 
-                      <div className="flex-1 min-w-[200px]">
-                        <label
-                          className={`block text-sm font-medium mb-1 ${newBearerKey.accessType === 'all' ? 'text-gray-400' : 'text-gray-700'}`}
-                        >
-                          {newBearerKey.accessType === 'groups'
-                            ? t('settings.bearerKeyAllowedGroups') || 'Allowed groups'
-                            : t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
-                        </label>
-                        <MultiSelect
-                          options={
-                            newBearerKey.accessType === 'groups'
-                              ? availableGroups
-                              : availableServers
-                          }
-                          selected={
-                            newBearerKey.accessType === 'groups'
-                              ? newSelectedGroups
-                              : newSelectedServers
-                          }
-                          onChange={
-                            newBearerKey.accessType === 'groups'
-                              ? setNewSelectedGroups
-                              : setNewSelectedServers
-                          }
-                          placeholder={
-                            newBearerKey.accessType === 'groups'
-                              ? t('settings.selectGroups') || 'Select groups...'
-                              : t('settings.selectServers') || 'Select servers...'
-                          }
-                          disabled={loading || newBearerKey.accessType === 'all'}
-                        />
-                      </div>
+                      {newBearerKey.accessType !== 'custom' && (
+                        <div className="flex-1 min-w-[200px]">
+                          <label
+                            className={`block text-sm font-medium mb-1 ${newBearerKey.accessType === 'all' ? 'text-gray-400' : 'text-gray-700'}`}
+                          >
+                            {newBearerKey.accessType === 'groups'
+                              ? t('settings.bearerKeyAllowedGroups') || 'Allowed groups'
+                              : t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
+                          </label>
+                          <MultiSelect
+                            options={
+                              newBearerKey.accessType === 'groups'
+                                ? availableGroups
+                                : availableServers
+                            }
+                            selected={
+                              newBearerKey.accessType === 'groups'
+                                ? newSelectedGroups
+                                : newSelectedServers
+                            }
+                            onChange={
+                              newBearerKey.accessType === 'groups'
+                                ? setNewSelectedGroups
+                                : setNewSelectedServers
+                            }
+                            placeholder={
+                              newBearerKey.accessType === 'groups'
+                                ? t('settings.selectGroups') || 'Select groups...'
+                                : t('settings.selectServers') || 'Select servers...'
+                            }
+                            disabled={loading || newBearerKey.accessType === 'all'}
+                          />
+                        </div>
+                      )}
+
+                      {newBearerKey.accessType === 'custom' && (
+                        <>
+                          <div className="flex-1 min-w-[200px]">
+                            <label className="block text-sm font-medium text-gray-700 mb-1">
+                              {t('settings.bearerKeyAllowedGroups') || 'Allowed groups'}
+                            </label>
+                            <MultiSelect
+                              options={availableGroups}
+                              selected={newSelectedGroups}
+                              onChange={setNewSelectedGroups}
+                              placeholder={t('settings.selectGroups') || 'Select groups...'}
+                              disabled={loading}
+                            />
+                          </div>
+                          <div className="flex-1 min-w-[200px]">
+                            <label className="block text-sm font-medium text-gray-700 mb-1">
+                              {t('settings.bearerKeyAllowedServers') || 'Allowed servers'}
+                            </label>
+                            <MultiSelect
+                              options={availableServers}
+                              selected={newSelectedServers}
+                              onChange={setNewSelectedServers}
+                              placeholder={t('settings.selectServers') || 'Select servers...'}
+                              disabled={loading}
+                            />
+                          </div>
+                        </>
+                      )}
 
                       <div className="flex justify-end gap-2">
                         <button
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index 1373489..cfef4c8 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -310,7 +310,7 @@ export interface ApiResponse<T = any> {
 }
 
 // Bearer authentication key configuration (frontend view model)
-export type BearerKeyAccessType = 'all' | 'groups' | 'servers';
+export type BearerKeyAccessType = 'all' | 'groups' | 'servers' | 'custom';
 
 export interface BearerKey {
   id: string;
diff --git a/locales/en.json b/locales/en.json
index 8f55788..8c58c00 100644
--- a/locales/en.json
+++ b/locales/en.json
@@ -568,6 +568,7 @@
     "bearerKeyAccessAll": "All",
     "bearerKeyAccessGroups": "Groups",
     "bearerKeyAccessServers": "Servers",
+    "bearerKeyAccessCustom": "Custom",
     "bearerKeyAllowedGroups": "Allowed groups",
     "bearerKeyAllowedServers": "Allowed servers",
     "addBearerKey": "Add key",
diff --git a/locales/fr.json b/locales/fr.json
index e592c1e..29906f3 100644
--- a/locales/fr.json
+++ b/locales/fr.json
@@ -569,6 +569,7 @@
     "bearerKeyAccessAll": "Toutes",
     "bearerKeyAccessGroups": "Groupes",
     "bearerKeyAccessServers": "Serveurs",
+    "bearerKeyAccessCustom": "Personnalisée",
     "bearerKeyAllowedGroups": "Groupes autorisés",
     "bearerKeyAllowedServers": "Serveurs autorisés",
     "addBearerKey": "Ajouter une clé",
diff --git a/locales/tr.json b/locales/tr.json
index aa074d3..2576485 100644
--- a/locales/tr.json
+++ b/locales/tr.json
@@ -569,6 +569,7 @@
     "bearerKeyAccessAll": "Tümü",
     "bearerKeyAccessGroups": "Gruplar",
     "bearerKeyAccessServers": "Sunucular",
+    "bearerKeyAccessCustom": "Özel",
     "bearerKeyAllowedGroups": "İzin verilen gruplar",
     "bearerKeyAllowedServers": "İzin verilen sunucular",
     "addBearerKey": "Anahtar ekle",
diff --git a/locales/zh.json b/locales/zh.json
index 49ec5f9..c5848d5 100644
--- a/locales/zh.json
+++ b/locales/zh.json
@@ -570,6 +570,7 @@
     "bearerKeyAccessAll": "全部",
     "bearerKeyAccessGroups": "指定分组",
     "bearerKeyAccessServers": "指定服务器",
+    "bearerKeyAccessCustom": "自定义",
     "bearerKeyAllowedGroups": "允许访问的分组",
     "bearerKeyAllowedServers": "允许访问的服务器",
     "addBearerKey": "新增密钥",
diff --git a/src/controllers/bearerKeyController.ts b/src/controllers/bearerKeyController.ts
index 9b78b7f..675770d 100644
--- a/src/controllers/bearerKeyController.ts
+++ b/src/controllers/bearerKeyController.ts
@@ -57,7 +57,7 @@ export const createBearerKey = async (req: Request, res: Response): Promise<void
       return;
     }
 
-    if (!accessType || !['all', 'groups', 'servers'].includes(accessType)) {
+    if (!accessType || !['all', 'groups', 'servers', 'custom'].includes(accessType)) {
       res.status(400).json({ success: false, message: 'Invalid accessType' });
       return;
     }
@@ -104,7 +104,7 @@ export const updateBearerKey = async (req: Request, res: Response): Promise<void
     if (token !== undefined) updates.token = token;
     if (enabled !== undefined) updates.enabled = enabled;
     if (accessType !== undefined) {
-      if (!['all', 'groups', 'servers'].includes(accessType)) {
+      if (!['all', 'groups', 'servers', 'custom'].includes(accessType)) {
         res.status(400).json({ success: false, message: 'Invalid accessType' });
         return;
       }
diff --git a/src/db/entities/BearerKey.ts b/src/db/entities/BearerKey.ts
index ef09c3a..cefb1a1 100644
--- a/src/db/entities/BearerKey.ts
+++ b/src/db/entities/BearerKey.ts
@@ -25,7 +25,7 @@ export class BearerKey {
   enabled: boolean;
 
   @Column({ type: 'varchar', length: 20, default: 'all' })
-  accessType: 'all' | 'groups' | 'servers';
+  accessType: 'all' | 'groups' | 'servers' | 'custom';
 
   @Column({ type: 'simple-json', nullable: true })
   allowedGroups?: string[];
diff --git a/src/services/sseService.ts b/src/services/sseService.ts
index 14b00d4..800d0b9 100644
--- a/src/services/sseService.ts
+++ b/src/services/sseService.ts
@@ -88,6 +88,29 @@ const isBearerKeyAllowedForRequest = async (req: Request, key: BearerKey): Promi
         return groupServerNames.some((name) => allowedServers.includes(name));
       }
 
+      if (key.accessType === 'custom') {
+        // For custom-scoped keys, check if the group is allowed OR if any server in the group is allowed
+        const allowedGroups = key.allowedGroups || [];
+        const allowedServers = key.allowedServers || [];
+
+        // Check if the group itself is allowed
+        const groupAllowed =
+          allowedGroups.includes(matchedGroup.name) || allowedGroups.includes(matchedGroup.id);
+        if (groupAllowed) {
+          return true;
+        }
+
+        // Check if any server in the group is allowed
+        if (allowedServers.length > 0 && Array.isArray(matchedGroup.servers)) {
+          const groupServerNames = matchedGroup.servers.map((server) =>
+            typeof server === 'string' ? server : server.name,
+          );
+          return groupServerNames.some((name) => allowedServers.includes(name));
+        }
+
+        return false;
+      }
+
       // Unknown accessType with matched group
       return false;
     }
@@ -102,8 +125,8 @@ const isBearerKeyAllowedForRequest = async (req: Request, key: BearerKey): Promi
         return false;
       }
 
-      if (key.accessType === 'servers') {
-        // For server-scoped keys, check if the server is in allowedServers
+      if (key.accessType === 'servers' || key.accessType === 'custom') {
+        // For server-scoped or custom-scoped keys, check if the server is in allowedServers
         const allowedServers = key.allowedServers || [];
         return allowedServers.includes(matchedServer.name);
       }
diff --git a/src/types/index.ts b/src/types/index.ts
index 495d34a..e5e8186 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -244,7 +244,7 @@ export interface OAuthServerConfig {
 }
 
 // Bearer authentication key configuration
-export type BearerKeyAccessType = 'all' | 'groups' | 'servers';
+export type BearerKeyAccessType = 'all' | 'groups' | 'servers' | 'custom';
 
 export interface BearerKey {
   id: string; // Unique identifier for the key
@@ -252,8 +252,8 @@ export interface BearerKey {
   token: string; // Bearer token value
   enabled: boolean; // Whether this key is enabled
   accessType: BearerKeyAccessType; // Access scope type
-  allowedGroups?: string[]; // Allowed group names when accessType === 'groups'
-  allowedServers?: string[]; // Allowed server names when accessType === 'servers'
+  allowedGroups?: string[]; // Allowed group names when accessType === 'groups' or 'custom'
+  allowedServers?: string[]; // Allowed server names when accessType === 'servers' or 'custom'
 }
 
 // Represents the settings for MCP servers