Harden API security and fix integration bugs from senior code review

- Fix billing: unknown Stripe price IDs now default to free (was silently granting builder)
- Fix MCP server: add 500-session cap with 30-min TTL to prevent memory exhaustion; add try/catch to GET/DELETE handlers
- Fix billing portal: validate return_url against allowed hostnames (open redirect prevention)
- Fix server: cache OpenAPI spec at startup instead of sync read per request
- Fix Gemini integration: add encodeURIComponent to memory ID path; add missing browse filter
- Fix n8n node: add encodeURIComponent to memory ID path; add missing browse filter; change credential test to /whoami
- Fix stale plan enum in v1-migration-plan.md

Made-with: Cursor

Author: van-reflect

docs/v1-migration-plan.md

@@ -23,7 +23,7 @@
 - `clerk_id TEXT UNIQUE` -- Clerk user ID, populated when Clerk is integrated
 - `role TEXT NOT NULL DEFAULT 'user'` -- `'admin'`, `'private-alpha'`, or `'user'`
 - `stripe_customer_id TEXT UNIQUE` -- Stripe customer ID, populated on subscription
-- `plan TEXT NOT NULL DEFAULT 'free'` -- `'free'`, `'pro'`, or `'enterprise'`
+- `plan TEXT NOT NULL DEFAULT 'free'` -- `'free'` or `'builder'`
 - `updated_at TEXT NOT NULL` -- backfilled from `created_at` for existing rows
 
 ### Backward Compatibility

integrations/gemini/function-calling-example.ts

@@ -168,14 +168,15 @@ async function executeFunction(call: FunctionCall): Promise<unknown> {
     }
 
     case "get_memory_by_id":
-      return fetchApi(`/agent/memories/${args.id}`);
+      return fetchApi(`/agent/memories/${encodeURIComponent(args.id as string)}`);
 
     case "browse_memories":
       return fetchApi("/agent/memories/browse", {
         method: "POST",
         body: JSON.stringify({
           limit: args.limit ?? 50,
           offset: args.offset ?? 0,
+          filter: { by: "all" },
         }),
       });
 

integrations/n8n/n8n-nodes-reflect-memory/credentials/ReflectMemoryApi.credentials.ts

@@ -42,7 +42,7 @@ export class ReflectMemoryApi implements ICredentialType {
   test: ICredentialTestRequest = {
     request: {
       baseURL: "={{$credentials.baseUrl}}",
-      url: "/agent/memories/latest",
+      url: "/whoami",
       method: "GET",
     },
   };

integrations/n8n/n8n-nodes-reflect-memory/nodes/ReflectMemory/ReflectMemory.node.ts

@@ -228,7 +228,7 @@ export class ReflectMemory implements INodeType {
               "reflectMemoryApi",
               {
                 method: "GET",
-                url: `${baseUrl}/agent/memories/${memoryId}`,
+                url: `${baseUrl}/agent/memories/${encodeURIComponent(memoryId)}`,
                 json: true,
               },
             ) as IDataObject;
@@ -244,7 +244,7 @@ export class ReflectMemory implements INodeType {
               {
                 method: "POST",
                 url: `${baseUrl}/agent/memories/browse`,
-                body: { limit, offset },
+                body: { limit, offset, filter: { by: "all" } },
                 json: true,
               },
             ) as IDataObject;

src/billing-service.ts

@@ -149,7 +149,7 @@ export function handleStripeWebhook(
 function determinePlanFromPrice(priceId: string | undefined): string {
   if (!priceId) return "free";
   if (priceId === process.env.STRIPE_PRICE_BUILDER) return "builder";
-  return "builder";
+  return "free";
 }
 
 export async function constructStripeEvent(

src/mcp-server.ts

@@ -200,20 +200,45 @@ export function startMcpServer(config: McpServerConfig, port: number): void {
     next();
   });
 
-  // Track transports by session ID, and which vendor owns each session
+  const MAX_SESSIONS = 500;
+  const SESSION_TTL_MS = 30 * 60 * 1000;
+
   const transports: Record<string, StreamableHTTPServerTransport> = {};
   const sessionVendors: Record<string, string> = {};
+  const sessionLastSeen: Record<string, number> = {};
+
+  setInterval(() => {
+    const now = Date.now();
+    for (const sid of Object.keys(sessionLastSeen)) {
+      if (now - sessionLastSeen[sid] > SESSION_TTL_MS) {
+        transports[sid]?.close?.();
+        delete transports[sid];
+        delete sessionVendors[sid];
+        delete sessionLastSeen[sid];
+      }
+    }
+  }, 60_000);
 
   app.post("/mcp", async (req, res) => {
     try {
       const sessionId = req.headers["mcp-session-id"] as string | undefined;
 
       if (sessionId && transports[sessionId]) {
+        sessionLastSeen[sessionId] = Date.now();
         await transports[sessionId].handleRequest(req, res, req.body);
         return;
       }
 
       if (!sessionId && isInitializeRequest(req.body)) {
+        if (Object.keys(transports).length >= MAX_SESSIONS) {
+          res.status(503).json({
+            jsonrpc: "2.0",
+            error: { code: -32000, message: "Too many active sessions" },
+            id: null,
+          });
+          return;
+        }
+
         const vendor = (req as any).vendor as string;
 
         const transport = new StreamableHTTPServerTransport({
@@ -222,6 +247,7 @@ export function startMcpServer(config: McpServerConfig, port: number): void {
           onsessioninitialized: (sid) => {
             transports[sid] = transport;
             sessionVendors[sid] = vendor;
+            sessionLastSeen[sid] = Date.now();
           },
         });
 
@@ -230,6 +256,7 @@ export function startMcpServer(config: McpServerConfig, port: number): void {
           if (sid) {
             delete transports[sid];
             delete sessionVendors[sid];
+            delete sessionLastSeen[sid];
           }
         };
 
@@ -257,21 +284,44 @@ export function startMcpServer(config: McpServerConfig, port: number): void {
   });
 
   app.get("/mcp", async (req, res) => {
-    const sessionId = req.headers["mcp-session-id"] as string | undefined;
-    if (!sessionId || !transports[sessionId]) {
-      res.status(400).send("Invalid or missing session ID");
-      return;
+    try {
+      const sessionId = req.headers["mcp-session-id"] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+      }
+      sessionLastSeen[sessionId] = Date.now();
+      await transports[sessionId].handleRequest(req, res);
+    } catch (error) {
+      console.error("[mcp] GET error:", error);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: "Internal server error" },
+          id: null,
+        });
+      }
     }
-    await transports[sessionId].handleRequest(req, res);
   });
 
   app.delete("/mcp", async (req, res) => {
-    const sessionId = req.headers["mcp-session-id"] as string | undefined;
-    if (!sessionId || !transports[sessionId]) {
-      res.status(400).send("Invalid or missing session ID");
-      return;
+    try {
+      const sessionId = req.headers["mcp-session-id"] as string | undefined;
+      if (!sessionId || !transports[sessionId]) {
+        res.status(400).send("Invalid or missing session ID");
+        return;
+      }
+      await transports[sessionId].handleRequest(req, res);
+    } catch (error) {
+      console.error("[mcp] DELETE error:", error);
+      if (!res.headersSent) {
+        res.status(500).json({
+          jsonrpc: "2.0",
+          error: { code: -32603, message: "Internal server error" },
+          id: null,
+        });
+      }
     }
-    await transports[sessionId].handleRequest(req, res);
   });
 
   app.get("/health", (_req, res) => {

src/server.ts

@@ -635,13 +635,24 @@ export async function createServer(config: ServerConfig): Promise<FastifyInstanc
     "openapi-agent.yaml",
   );
 
+  let cachedOpenApiSpec: unknown = null;
+  try {
+    const yaml = require("js-yaml");
+    cachedOpenApiSpec = yaml.load(readFileSync(openapiSpecPath, "utf-8"));
+  } catch {
+    console.warn("Could not pre-load OpenAPI spec; will attempt on first request");
+  }
+
   server.get("/openapi.json", async (_request, reply) => {
+    if (cachedOpenApiSpec) {
+      reply.type("application/json");
+      return cachedOpenApiSpec;
+    }
     try {
       const yaml = await import("js-yaml");
-      const raw = readFileSync(openapiSpecPath, "utf-8");
-      const spec = yaml.load(raw);
+      cachedOpenApiSpec = yaml.load(readFileSync(openapiSpecPath, "utf-8"));
       reply.type("application/json");
-      return spec;
+      return cachedOpenApiSpec;
     } catch {
       reply.code(500);
       return { error: "Failed to load OpenAPI spec" };
@@ -1782,10 +1793,18 @@ export async function createServer(config: ServerConfig): Promise<FastifyInstanc
       }
 
       const body = (request.body ?? {}) as { return_url?: string };
+      let returnUrl = "https://www.reflectmemory.com/dashboard";
+      if (body.return_url) {
+        try {
+          const parsed = new URL(body.return_url);
+          const allowed = new Set(["www.reflectmemory.com", "reflectmemory.com", "localhost"]);
+          if (allowed.has(parsed.hostname)) returnUrl = body.return_url;
+        } catch { /* invalid URL, use default */ }
+      }
       const url = await createBillingPortalSession(
         db,
         request.userId,
-        body.return_url ?? "https://www.reflectmemory.com/dashboard",
+        returnUrl,
       );
 
       if (!url) {