Release v1.0.0 - Initial Release

🎉 Initial release of Obsidian MCP Server plugin

Core Features:
- MCP server implementation with HTTP transport
- JSON-RPC 2.0 message handling
- Protocol version 2024-11-05 support

MCP Tools:
- read_note, create_note, update_note, delete_note
- search_notes, list_notes, get_vault_info

Server Features:
- Configurable HTTP server (default port: 3000)
- Health check and MCP endpoints
- Auto-start option

Security:
- Origin header validation (DNS rebinding protection)
- Optional Bearer token authentication
- CORS configuration

UI:
- Settings panel with full configuration
- Status bar indicator and ribbon icon
- Start/Stop/Restart commands

Documentation:
- Comprehensive README with examples
- Quick Start Guide and Implementation Summary
- Test client script

src/server/middleware.ts

@@ -0,0 +1,54 @@
+import { Express, Request, Response } from 'express';
+import express from 'express';
+import cors from 'cors';
+import { MCPServerSettings } from '../types/settings-types';
+import { ErrorCodes } from '../types/mcp-types';
+
+export function setupMiddleware(app: Express, settings: MCPServerSettings, createErrorResponse: (id: any, code: number, message: string) => any): void {
+	// Parse JSON bodies
+	app.use(express.json());
+
+	// CORS configuration
+	if (settings.enableCORS) {
+		const corsOptions = {
+			origin: (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
+				// Allow requests with no origin (like mobile apps or curl requests)
+				if (!origin) return callback(null, true);
+				
+				if (settings.allowedOrigins.includes('*') || 
+					settings.allowedOrigins.includes(origin)) {
+					callback(null, true);
+				} else {
+					callback(new Error('Not allowed by CORS'));
+				}
+			},
+			credentials: true
+		};
+		app.use(cors(corsOptions));
+	}
+
+	// Authentication middleware
+	if (settings.enableAuth && settings.apiKey) {
+		app.use((req: Request, res: Response, next: any) => {
+			const authHeader = req.headers.authorization;
+			const apiKey = authHeader?.replace('Bearer ', '');
+			
+			if (apiKey !== settings.apiKey) {
+				return res.status(401).json(createErrorResponse(null, ErrorCodes.InvalidRequest, 'Unauthorized'));
+			}
+			next();
+		});
+	}
+
+	// Origin validation for security (DNS rebinding protection)
+	app.use((req: Request, res: Response, next: any) => {
+		const host = req.headers.host;
+		
+		// Only allow localhost connections
+		if (host && !host.startsWith('localhost') && !host.startsWith('127.0.0.1')) {
+			return res.status(403).json(createErrorResponse(null, ErrorCodes.InvalidRequest, 'Only localhost connections allowed'));
+		}
+		
+		next();
+	});
+}