r002: API-Key-Auth + Einstellungs-Maske (API-Key generieren, Tool-Checkboxen)

- src/auth.ts: Config-Management (API-Key + Tool-Filter), timing-safe Auth
- src/index.ts: Auth-Check auf /mcp, Tool-Filter in tools/list + tools/call,
  Config-Server auf 127.0.0.1:3003 (nur localhost)
- scripts/mua.page: Einstellungs-UI (API-Key generieren + Tool-Checkboxen)
- scripts/rc.mua: Config-Dir sicherstellen
- Version: 2026.08.18.r002

src/index.ts

@@ -19,6 +19,8 @@ import {
   MUA_PROTOCOL_VERSION,
 } from "./helpers";
 import { TOOLS, toolByName } from "./tools";
+import { checkAuth, isToolEnabled, getApiKey, getEnabledTools, setApiKey, setEnabledTools } from "./auth";
+import { randomBytes } from "node:crypto";
 
 const PORT = Number(process.env["MUA_PORT"] ?? 3002);
 const HOST = process.env["MUA_HOST"] ?? "0.0.0.0";
@@ -81,9 +83,11 @@ async function handleMcpRequest(
   // ── tools/list ────────────────────────────────────────────────────────
   if (method === "tools/list") {
     if (sessionId) touchSession(sessionId);
+    // Tool-Filter: nur aktive Tools anzeigen
+    const activeTools = TOOLS.filter((t) => isToolEnabled(t.name));
     return {
       response: rpcResult(id, {
-        tools: TOOLS.map((t) => ({
+        tools: activeTools.map((t) => ({
           name: t.name,
           description: t.description,
           inputSchema: t.inputSchema,
@@ -108,6 +112,16 @@ async function handleMcpRequest(
         sessionId: sessionId ?? "",
       };
     }
+    // Tool-Filter: deaktivierte Tools ablehnen
+    if (!isToolEnabled(toolName)) {
+      return {
+        response: rpcResult(id, {
+          content: [{ type: "text", text: `ERROR: Tool disabled: ${toolName}` }],
+          isError: true,
+        }),
+        sessionId: sessionId ?? "",
+      };
+    }
     try {
       const text = await tool.handler(args);
       const result: Record<string, unknown> = {
@@ -179,7 +193,7 @@ const server = Bun.serve({
       return new Response(null, { status: 204, headers: corsHeaders });
     }
 
-    // ── Health-Check ────────────────────────────────────────────────────
+    // ── Health-Check (ohne Auth) ────────────────────────────────────────
     if (path === "/health") {
       return Response.json(
         {
@@ -187,12 +201,33 @@ const server = Bun.serve({
           server: MUA_SERVER_NAME,
           version: MUA_VERSION,
           port: PORT,
+          auth: "required",
           time: new Date().toISOString(),
         },
         { headers: corsHeaders },
       );
     }
 
+    // ── Auth-Check für /mcp (POST + DELETE) — Bearer-Token ─────────────
+    if (path === "/mcp" || path === "/") {
+      if (!checkAuth(req)) {
+        return Response.json(
+          {
+            jsonrpc: "2.0",
+            id: null,
+            error: { code: -32001, message: "Unauthorized: missing or invalid API key" },
+          },
+          {
+            status: 401,
+            headers: {
+              ...corsHeaders,
+              "Mcp-Session-Id": "00000000-0000-0000-0000-000000000000",
+            },
+          },
+        );
+      }
+    }
+
     // ── MCP-Endpunkt ────────────────────────────────────────────────────
     if (path === "/mcp" || path === "/") {
       // POST: JSON-RPC Request
@@ -261,8 +296,66 @@ const server = Bun.serve({
   },
 });
 
+// ── Config-Server (nur localhost:127.0.0.1:3003) ───────────────────────
+// Separater Server, nur von localhost erreichbar (WebGUI auf demselben Host).
+// Kein Header-Spoofing, kein File-Permission-Problem.
+const CONFIG_PORT = Number(process.env["MUA_CONFIG_PORT"] ?? 3003);
+const configServer = Bun.serve({
+  port: CONFIG_PORT,
+  hostname: "127.0.0.1", // nur localhost
+  idleTimeout: 30,
+  async fetch(req) {
+    const url = new URL(req.url);
+    const path = url.pathname;
+    const method = req.method;
+
+    if (path !== "/config") {
+      return Response.json({ error: "Not found" }, { status: 404 });
+    }
+
+    // GET: Config lesen
+    if (method === "GET") {
+      return Response.json({
+        apiKey: getApiKey(),
+        enabledTools: getEnabledTools(),
+        allTools: TOOLS.map((t) => t.name),
+      });
+    }
+
+    // POST: Config schreiben
+    if (method === "POST") {
+      let body: Record<string, unknown>;
+      try {
+        body = JSON.parse(await req.text());
+      } catch {
+        return Response.json({ error: "Invalid JSON" }, { status: 400 });
+      }
+
+      // "generate": neuen API-Key generieren
+      if (body["generate"] === true) {
+        setApiKey(randomBytes(32).toString("hex"));
+      } else if (typeof body["apiKey"] === "string" && (body["apiKey"] as string).length > 0) {
+        setApiKey(body["apiKey"] as string);
+      }
+      if (Array.isArray(body["enabledTools"])) {
+        const tools = (body["enabledTools"] as unknown[])
+          .filter((t): t is string => typeof t === "string");
+        setEnabledTools(tools);
+      }
+
+      return Response.json({
+        ok: true,
+        apiKey: getApiKey(),
+        enabledTools: getEnabledTools(),
+      });
+    }
+
+    return Response.json({ error: "Method not allowed" }, { status: 405 });
+  },
+});
+
 console.log(
-  `[MUA] ${MUA_SERVER_NAME} v${MUA_VERSION} listening on ${HOST}:${PORT} (MCP Streamable HTTP)`,
+  `[MUA] ${MUA_SERVER_NAME} v${MUA_VERSION} listening on ${HOST}:${PORT} (MCP) + 127.0.0.1:${CONFIG_PORT} (config)`,
 );
 
 // Graceful shutdown