feat(auth): add PAT auth, scoped REST/MCP access, CSRF, and tenant isolation

Introduce Personal Access Tokens (nzp_*) as a stateless auth path alongside
JWT, gated per-endpoint by a scope middleware (nezha:{resource}:{verb}) with
fail-closed empty-scope defaults and a server-id whitelist. Self-management
endpoints (profile, api-tokens, oauth2 bind, refresh-token) explicitly reject
PATs to block privilege-escalation chains. A revoke registry tears down active
long-lived connections (terminal, fm, ws, transfer, mcp) the moment a PAT is
deleted, with a tombstone closing the revoke->register race.

Add an MCP endpoint that proxies tool calls (exec, fs read/write/delete,
transfer) to agents over gRPC, guarded by origin/DNS-rebinding checks, a
per-token rate limiter, audit logging, and a kill switch. Serialize all
sends through the IOStream wrapper to honour grpc-go's concurrency contract.

Add CSRF double-submit protection on unsafe cookie-authenticated methods,
exempting authenticated PAT requests by context identity (not a forgeable
Authorization header). Apply visibility/whitelist filtering consistently
across list, get-by-id, and mutate paths to enforce tenant isolation.

Migrate legacy mcp:* scopes: rewrite read/exec to nezha:* equivalents and
drop dangerous write/delete/wildcard grants.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

service/singleton/crontask.go

@@ -264,13 +264,12 @@ func CronTrigger(cr *model.Cron, triggerServer ...uint64) func() {
 				if !cronCanSendToServer(cr, s) {
 					return
 				}
-				stream := s.GetTaskStream()
-				if stream != nil {
+				if s.GetTaskStream() != nil {
 					cronShared := CronShared
 					if cronShared != nil {
 						cronShared.reserveAlertTriggerCronResult(cr.ID, s.ID)
 					}
-					if err := stream.Send(&pb.Task{
+					if err := s.SendTask(&pb.Task{
 						Id:   cr.ID,
 						Data: cr.Command,
 						Type: model.TaskTypeCommand,
@@ -287,7 +286,13 @@ func CronTrigger(cr *model.Cron, triggerServer ...uint64) func() {
 			return
 		}
 
-		for _, s := range ServerShared.Range {
+		// 先在锁内快照 server 列表再逐个 SendTask：ServerShared.Range 会在整个
+		// 回调期间持 listMu.RLock，而 SendTask 走阻塞 gRPC，一个卡死的 agent
+		// 会让需要写锁的 server 编辑/删除被拖死。GetList 克隆后即释放锁。
+		for _, s := range ServerShared.GetList() {
+			if s == nil {
+				continue
+			}
 			if !cronCanSendToServer(cr, s) {
 				continue
 			}
@@ -297,8 +302,8 @@ func CronTrigger(cr *model.Cron, triggerServer ...uint64) func() {
 			if cr.Cover == model.CronCoverIgnoreAll && !crIgnoreMap[s.ID] {
 				continue
 			}
-			if stream := s.GetTaskStream(); stream != nil {
-				stream.Send(&pb.Task{
+			if s.GetTaskStream() != nil {
+				_ = s.SendTask(&pb.Task{
 					Id:   cr.ID,
 					Data: cr.Command,
 					Type: model.TaskTypeCommand,

service/singleton/server.go

@@ -38,9 +38,39 @@ func NewServerClass() *ServerClass {
 	}
 	sc.sortList()
 
+	model.OwnerServerIDsLookup = sc.ownerServerIDs
+	model.AllServerIDsLookup = sc.allServerIDs
+	model.OwnerIsAdminLookup = ownerIsAdmin
+
 	return sc
 }
 
+func (c *ServerClass) ownerServerIDs(ownerUID uint64) []uint64 {
+	var ids []uint64
+	c.Range(func(id uint64, s *model.Server) bool {
+		if s != nil && s.GetUserID() == ownerUID {
+			ids = append(ids, id)
+		}
+		return true
+	})
+	return ids
+}
+
+func (c *ServerClass) allServerIDs() []uint64 {
+	var ids []uint64
+	c.Range(func(id uint64, s *model.Server) bool {
+		if s != nil {
+			ids = append(ids, id)
+		}
+		return true
+	})
+	return ids
+}
+
+func ownerIsAdmin(ownerUID uint64) bool {
+	return userIsAdmin(ownerUID)
+}
+
 func (c *ServerClass) Update(s *model.Server, uuid string) {
 	c.listMu.Lock()
 
@@ -64,8 +94,11 @@ func (c *ServerClass) Delete(idList []uint64) {
 	c.listMu.Lock()
 
 	for _, id := range idList {
-		serverUUID := c.list[id].UUID
-		delete(c.uuidToID, serverUUID)
+		s, ok := c.list[id]
+		if !ok {
+			continue
+		}
+		delete(c.uuidToID, s.UUID)
 		delete(c.list, id)
 	}
 

service/singleton/server_delete_missing_test.go

@@ -0,0 +1,32 @@
+package singleton
+
+import (
+	"testing"
+
+	"github.com/nezhahq/nezha/model"
+)
+
+func TestServerClassDeleteMissingIDNoPanic(t *testing.T) {
+	c := &ServerClass{
+		class: class[uint64, *model.Server]{
+			list: map[uint64]*model.Server{
+				1: {Common: model.Common{ID: 1}, UUID: "uuid-1"},
+			},
+		},
+		uuidToID: map[string]uint64{"uuid-1": 1},
+	}
+
+	c.Delete([]uint64{999999})
+
+	if _, ok := c.list[1]; !ok {
+		t.Fatalf("existing server 1 must remain after deleting a non-existent id")
+	}
+
+	c.Delete([]uint64{1, 424242})
+	if _, ok := c.list[1]; ok {
+		t.Fatalf("server 1 should be removed")
+	}
+	if _, ok := c.uuidToID["uuid-1"]; ok {
+		t.Fatalf("uuid mapping for server 1 should be removed")
+	}
+}

service/singleton/server_transfer.go

@@ -232,20 +232,6 @@ func NewServerTransferClass() *ServerTransferClass {
 		}
 		c.pending[t.ServerID] = &t
 	}
-	for i := range pending {
-		t := pending[i]
-		// Skip ghost rows whose server has been deleted out from under
-		// the transfer (e.g. before OnServersDeleted existed, or because
-		// the row predates this branch). Loading them would resurrect a
-		// HasPending state that no longer corresponds to a real server
-		// and the timeout sweeper would log errors every 30s without
-		// being able to settle the row.
-		if s, ok := ServerShared.Get(t.ServerID); !ok || s == nil {
-			log.Printf("NEZHA>> ServerTransferClass: ignoring pending transfer %d for missing server %d (likely a leftover from before OnServersDeleted was wired)", t.ID, t.ServerID)
-			continue
-		}
-		c.pending[t.ServerID] = &t
-	}
 
 	var reverted []model.ServerTransfer
 	// acked_at IS NULL is non-negotiable: MarkRevertDelivered persists
@@ -927,7 +913,14 @@ func (c *ServerTransferClass) sendApplyConfigTask(s *model.Server, stream pb.Nez
 	// Keep Send synchronous under the per-server lock. A goroutine+timeout cannot
 	// cancel grpc.ServerStream.Send; returning early would let a stale new-secret
 	// ApplyConfig complete after a cancel/fail revert and overwrite the rollback.
-	if err := stream.Send(task); err != nil {
+	//
+	// Route through Server.SendTask so the holder-scoped send mutex is
+	// honoured: cron / MCP CallAgent / MCP fs.transfer dispatch on the same
+	// gRPC stream and would otherwise race grpc-go's one-SendMsg-per-stream
+	// invariant. The captured stream argument is still passed to
+	// ClearTaskStreamIfCurrent so a reconnect mid-Send cannot wipe a newer
+	// published stream when Send fails on the stale one.
+	if err := s.SendTask(task); err != nil {
 		log.Printf("NEZHA>> ServerTransfer ApplyConfig send failed: serverID=%d transferID=%d: %v", s.ID, task.Id, err)
 		s.ClearTaskStreamIfCurrent(stream)
 		return err

service/singleton/singleton.go

@@ -94,11 +94,21 @@ func InitDBFromPath(path string) error {
 		model.Notification{}, model.AlertRule{}, model.Service{}, model.NotificationGroupNotification{},
 		model.Cron{}, model.Transfer{}, model.ServerGroupServer{},
 		model.NAT{}, model.DDNSProfile{}, model.NotificationGroupNotification{},
-		model.WAF{}, model.Oauth2Bind{}, model.ServerTransfer{}, model.JWTSession{})
+		model.WAF{}, model.Oauth2Bind{}, model.ServerTransfer{}, model.JWTSession{},
+		model.APIToken{}, model.MCPAuditLog{})
 	if err != nil {
 		return err
 	}
 
+	// 旧 mcp:* scope 与 nezha:* 并行了一段时间，HasScope 通过别名让 mcp:fs:write
+	// 静默扩到 REST nezha:server:write。统一命名后这里把残留旧 scope 一次性
+	// 归一化（或在仅剩危险旧 scope 时整张 PAT 删除），保证运行时不再依赖别名。
+	if rewritten, deleted, mErr := model.MigrateLegacyMCPScopes(DB); mErr != nil {
+		log.Printf("NEZHA>> MigrateLegacyMCPScopes failed: %v", mErr)
+	} else if rewritten > 0 || deleted > 0 {
+		log.Printf("NEZHA>> Migrated legacy mcp:* api token scopes: rewritten=%d deleted=%d", rewritten, deleted)
+	}
+
 	return nil
 }
 

service/singleton/testhelpers.go

@@ -0,0 +1,65 @@
+package singleton
+
+import "github.com/nezhahq/nezha/model"
+
+// NewEmptyServerClassForTest 构造一个不依赖 DB 的空 ServerClass，仅用于单测。
+// 生产路径请用 NewServerClass。
+func NewEmptyServerClassForTest() *ServerClass {
+	sc := &ServerClass{
+		class: class[uint64, *model.Server]{
+			list: make(map[uint64]*model.Server),
+		},
+		uuidToID: make(map[string]uint64),
+	}
+	model.OwnerServerIDsLookup = sc.ownerServerIDs
+	model.AllServerIDsLookup = sc.allServerIDs
+	model.OwnerIsAdminLookup = ownerIsAdmin
+	return sc
+}
+
+// InsertForTest 把一个 server 直接塞进内存表与排序快照，跳过 DB & InitServer 逻辑。
+// 调用方需保证 server.ID 已经设置。
+func (c *ServerClass) InsertForTest(s *model.Server) {
+	c.listMu.Lock()
+	c.list[s.ID] = s
+	if s.UUID != "" {
+		c.uuidToID[s.UUID] = s.ID
+	}
+	c.listMu.Unlock()
+	c.sortList()
+}
+
+// NewEmptyDDNSClassForTest 构造一个不依赖 DB 的空 DDNSClass，仅用于单测。
+func NewEmptyDDNSClassForTest() *DDNSClass {
+	return &DDNSClass{
+		class: class[uint64, *model.DDNSProfile]{
+			list: make(map[uint64]*model.DDNSProfile),
+		},
+	}
+}
+
+// InsertForTest 把一个 DDNS profile 直接塞进内存表，跳过 DB。
+func (c *DDNSClass) InsertForTest(p *model.DDNSProfile) {
+	c.listMu.Lock()
+	c.list[p.ID] = p
+	c.listMu.Unlock()
+}
+
+// NewEmptyNotificationClassForTest 构造空 NotificationClass。
+func NewEmptyNotificationClassForTest() *NotificationClass {
+	return &NotificationClass{
+		class: class[uint64, *model.Notification]{
+			list: make(map[uint64]*model.Notification),
+		},
+		groupToIDList: make(map[uint64]map[uint64]*model.Notification),
+		idToGroupList: make(map[uint64]map[uint64]struct{}),
+		groupList:     make(map[uint64]string),
+	}
+}
+
+// InsertForTest 把一个 Notification 直接塞进内存表。
+func (c *NotificationClass) InsertForTest(n *model.Notification) {
+	c.listMu.Lock()
+	c.list[n.ID] = n
+	c.listMu.Unlock()
+}