feat: configure network access policies through environment

apps/api/test/mcp-hosts.test.ts

@@ -0,0 +1,30 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { isAllowedMcpHost } from '../src/mcp/hosts';
+
+const resource = new URL('https://worthpath.example/mcp');
+
+test('default Host protection preserves canonical and development hosts', () => {
+  assert.equal(isAllowedMcpHost('worthpath.example', resource, undefined, true), true);
+  const local = new URL('http://localhost:3100/mcp');
+  assert.equal(isAllowedMcpHost('127.0.0.1:3100', local, undefined, false), true);
+  assert.equal(isAllowedMcpHost('localhost:3100', local, '', false), true);
+  assert.equal(isAllowedMcpHost('127.0.0.1:3100', local, '', true), false);
+  assert.equal(isAllowedMcpHost('198.18.0.1:3100', resource, undefined, false), false);
+});
+
+test('explicit Host list replaces defaults and matches exact ports', () => {
+  const configured = ' 198.18.0.1:3100, HOST.example:3100, [::1]:3100 ';
+  for (const host of ['198.18.0.1:3100', 'host.example:3100', '[::1]:3100'])
+    assert.equal(isAllowedMcpHost(host, resource, configured, true), true);
+  for (const host of ['198.18.0.1:3101', 'worthpath.example', 'host.example:3100.evil'])
+    assert.equal(isAllowedMcpHost(host, resource, configured, true), false);
+});
+
+test('wildcard allows all hosts but still rejects a missing Host', () => {
+  for (const host of ['198.18.0.1:3100', '192.168.1.2:3100', '[2001:db8::1]:3100', 'example.com'])
+    assert.equal(isAllowedMcpHost(host, resource, '*', false), true);
+  assert.equal(isAllowedMcpHost(undefined, resource, '*', false), false);
+  assert.equal(isAllowedMcpHost('', resource, '*', false), false);
+  assert.equal(isAllowedMcpHost('example.com', resource, '*.example.com', false), false);
+});