@ainote/mcp 1.3.4 → 1.3.6

package/lib/auth/mcp-key.js

@@ -1,41 +1,41 @@
-import { getConfig } from '../core/config.js';
-
-/**
- * Synchronous variant: only consults env var. Kept for callers that cannot
- * await (e.g. the stdio bootstrap path that hasn't loaded the async config).
- */
-export function authenticateWithMcpKey() {
-  const config = getConfig();
-
-  if (!config.api.key) {
-    throw new Error('AINOTE_API_KEY is required to authenticate MCP requests. Run `ainote-mcp login` or set AINOTE_API_KEY.');
-  }
-
-  return {
-    type: 'mcpKey',
-    apiKey: config.api.key
-  };
-}
-
-/**
- * Async variant: falls back to the local CLI token store (populated by
- * `ainote-mcp login`) when no env var is set.
- */
-export async function authenticateWithMcpKeyAsync() {
-  const envKey = process.env.AINOTE_API_KEY;
-  if (envKey) {
-    return { type: 'mcpKey', apiKey: envKey };
-  }
-
-  try {
-    const { getCredentials } = await import('./token-store.js');
-    const { resolveApiUrl } = await import('../core/config-manager.js');
-    const baseUrl = resolveApiUrl();
-    const creds = await getCredentials(baseUrl);
-    if (creds && creds.mcpKey) {
-      return { type: 'mcpKey', apiKey: creds.mcpKey };
-    }
-  } catch { /* fall through */ }
-
-  throw new Error('AINOTE_API_KEY is required to authenticate MCP requests. Run `ainote-mcp login` or set AINOTE_API_KEY.');
-}
+import { getConfig } from '../core/config.js';
+
+/**
+ * Synchronous variant: only consults env var. Kept for callers that cannot
+ * await (e.g. the stdio bootstrap path that hasn't loaded the async config).
+ */
+export function authenticateWithMcpKey() {
+  const config = getConfig();
+
+  if (!config.api.key) {
+    throw new Error('AINOTE_API_KEY is required to authenticate MCP requests. Run `ainote-mcp login` or set AINOTE_API_KEY.');
+  }
+
+  return {
+    type: 'mcpKey',
+    apiKey: config.api.key
+  };
+}
+
+/**
+ * Async variant: falls back to the local CLI token store (populated by
+ * `ainote-mcp login`) when no env var is set.
+ */
+export async function authenticateWithMcpKeyAsync() {
+  const envKey = process.env.AINOTE_API_KEY;
+  if (envKey) {
+    return { type: 'mcpKey', apiKey: envKey };
+  }
+
+  try {
+    const { getCredentials } = await import('./token-store.js');
+    const { resolveApiUrl } = await import('../core/config-manager.js');
+    const baseUrl = resolveApiUrl();
+    const creds = await getCredentials(baseUrl);
+    if (creds && creds.mcpKey) {
+      return { type: 'mcpKey', apiKey: creds.mcpKey };
+    }
+  } catch { /* fall through */ }
+
+  throw new Error('AINOTE_API_KEY is required to authenticate MCP requests. Run `ainote-mcp login` or set AINOTE_API_KEY.');
+}

package/lib/auth/oauth.js

@@ -1,18 +1,18 @@
-export function authenticateWithOAuth(headers = {}) {
-  const authHeader = headers['authorization'] || headers['Authorization'];
-
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    throw new Error('Missing or invalid Bearer token for OAuth authentication');
-  }
-
-  const token = authHeader.substring('Bearer '.length).trim();
-
-  if (!token) {
-    throw new Error('Bearer token is empty');
-  }
-
-  return {
-    type: 'oauth',
-    token
-  };
-}
+export function authenticateWithOAuth(headers = {}) {
+  const authHeader = headers['authorization'] || headers['Authorization'];
+
+  if (!authHeader || !authHeader.startsWith('Bearer ')) {
+    throw new Error('Missing or invalid Bearer token for OAuth authentication');
+  }
+
+  const token = authHeader.substring('Bearer '.length).trim();
+
+  if (!token) {
+    throw new Error('Bearer token is empty');
+  }
+
+  return {
+    type: 'oauth',
+    token
+  };
+}

package/lib/auth/refresh.js

@@ -1,78 +1,85 @@
-/**
- * Access token rotation against the ainote backend.
- *
- * Endpoint: POST /api/auth/token/refresh
- * Body:     { refresh_token: "rt_..." }
- * Response: { access_token, refresh_token, expires_in }
- *
- * Concurrency: an in-process mutex (module-level Promise) ensures that
- * parallel callers wait on a single in-flight refresh instead of issuing
- * duplicate requests (which would otherwise burn through refresh-token
- * rotation and invalidate the family).
- */
-import axios from 'axios';
-
-let inFlight = null;
-
-export class RefreshError extends Error {
-  constructor(message, { status, body } = {}) {
-    super(message);
-    this.name = 'RefreshError';
-    this.status = status;
-    this.body = body;
-  }
-}
-
-async function performRefresh({ apiUrl, refreshToken }) {
-  let response;
-  try {
-    response = await axios.post(
-      `${apiUrl}/api/auth/token/refresh`,
-      { refresh_token: refreshToken },
-      {
-        headers: { 'Content-Type': 'application/json' },
-        timeout: 30000,
-        validateStatus: (s) => s >= 200 && s < 500
-      }
-    );
-  } catch (err) {
-    throw new RefreshError(`Refresh request failed: ${err.message}`);
-  }
-
-  if (response.status < 200 || response.status >= 300) {
-    const body = response.data || {};
-    const msg = body.error_description || body.error || body.message ||
-      `Refresh failed with HTTP ${response.status}`;
-    throw new RefreshError(msg, { status: response.status, body });
-  }
-
-  const body = response.data || {};
-  if (!body.access_token) {
-    throw new RefreshError('Refresh response missing access_token', { body });
-  }
-  return {
-    access_token: body.access_token,
-    refresh_token: body.refresh_token || refreshToken,
-    expires_in: Number(body.expires_in) || undefined
-  };
-}
-
-/**
- * Rotate the access token. Concurrent callers share one in-flight request.
- *
- * @param {Object} args
- * @param {string} args.apiUrl
- * @param {string} args.refreshToken
- * @returns {Promise<{access_token: string, refresh_token: string, expires_in?: number}>}
- */
-export async function refreshAccessToken({ apiUrl, refreshToken }) {
-  if (!refreshToken) {
-    throw new RefreshError('No refresh token available — login required.');
-  }
-  if (inFlight) return inFlight;
-  inFlight = performRefresh({ apiUrl, refreshToken })
-    .finally(() => {
-      inFlight = null;
-    });
-  return inFlight;
-}
+/**
+ * Access token rotation against the ainote backend.
+ *
+ * Endpoint: POST /api/auth/token/refresh
+ * Body:     { refresh_token: "rt_..." }
+ * Response: { success, data: { access_token, refresh_token, expires_in } }
+ *           (legacy: same fields at the top level)
+ *
+ * Concurrency: an in-process mutex (module-level Promise) ensures that
+ * parallel callers wait on a single in-flight refresh instead of issuing
+ * duplicate requests (which would otherwise burn through refresh-token
+ * rotation and invalidate the family).
+ */
+import axios from 'axios';
+import { errorMessage } from './error-message.js';
+
+let inFlight = null;
+
+export class RefreshError extends Error {
+  constructor(message, { status, body } = {}) {
+    super(message);
+    this.name = 'RefreshError';
+    this.status = status;
+    this.body = body;
+  }
+}
+
+async function performRefresh({ apiUrl, refreshToken }) {
+  let response;
+  try {
+    response = await axios.post(
+      `${apiUrl}/api/auth/token/refresh`,
+      { refresh_token: refreshToken },
+      {
+        headers: { 'Content-Type': 'application/json' },
+        timeout: 30000,
+        validateStatus: (s) => s >= 200 && s < 500
+      }
+    );
+  } catch (err) {
+    throw new RefreshError(`Refresh request failed: ${err.message}`);
+  }
+
+  if (response.status < 200 || response.status >= 300) {
+    const body = response.data || {};
+    const msg = errorMessage(body) ||
+      `Refresh failed with HTTP ${response.status}`;
+    throw new RefreshError(msg, { status: response.status, body });
+  }
+
+  const body = response.data || {};
+  // Server wraps the payload as { success, data: { access_token, ... } };
+  // older servers returned the fields at the top level.
+  const accessToken = body.data?.access_token ?? body.access_token;
+  const nextRefreshToken = body.data?.refresh_token ?? body.refresh_token;
+  const expiresIn = body.data?.expires_in ?? body.expires_in;
+  if (!accessToken) {
+    throw new RefreshError('Refresh response missing access_token', { body });
+  }
+  return {
+    access_token: accessToken,
+    refresh_token: nextRefreshToken || refreshToken,
+    expires_in: Number(expiresIn) || undefined
+  };
+}
+
+/**
+ * Rotate the access token. Concurrent callers share one in-flight request.
+ *
+ * @param {Object} args
+ * @param {string} args.apiUrl
+ * @param {string} args.refreshToken
+ * @returns {Promise<{access_token: string, refresh_token: string, expires_in?: number}>}
+ */
+export async function refreshAccessToken({ apiUrl, refreshToken }) {
+  if (!refreshToken) {
+    throw new RefreshError('No refresh token available — login required.');
+  }
+  if (inFlight) return inFlight;
+  inFlight = performRefresh({ apiUrl, refreshToken })
+    .finally(() => {
+      inFlight = null;
+    });
+  return inFlight;
+}

package/lib/auth/strategy-factory.js

@@ -1,31 +1,31 @@
-import { authenticateWithMcpKey } from './mcp-key.js';
-import { authenticateWithOAuth } from './oauth.js';
-import { getFeatureFlags } from '../core/config.js';
-
-export function resolveAuthContext(transportType, headers = {}) {
-  if (transportType === 'stdio') {
-    try {
-      return authenticateWithMcpKey();
-    } catch {
-      // No API key configured — allow anonymous mode for onboarding tools
-      return { type: 'anonymous' };
-    }
-  }
-
-  const features = getFeatureFlags();
-
-  if (transportType === 'sse' && features.oauthAuth) {
-    try {
-      return authenticateWithOAuth(headers);
-    } catch {
-      // Fall through to MCP key or anonymous
-    }
-  }
-
-  // Default fallback to MCP key, then anonymous for onboarding
-  try {
-    return authenticateWithMcpKey();
-  } catch {
-    return { type: 'anonymous' };
-  }
-}
+import { authenticateWithMcpKey } from './mcp-key.js';
+import { authenticateWithOAuth } from './oauth.js';
+import { getFeatureFlags } from '../core/config.js';
+
+export function resolveAuthContext(transportType, headers = {}) {
+  if (transportType === 'stdio') {
+    try {
+      return authenticateWithMcpKey();
+    } catch {
+      // No API key configured — allow anonymous mode for onboarding tools
+      return { type: 'anonymous' };
+    }
+  }
+
+  const features = getFeatureFlags();
+
+  if (transportType === 'sse' && features.oauthAuth) {
+    try {
+      return authenticateWithOAuth(headers);
+    } catch {
+      // Fall through to MCP key or anonymous
+    }
+  }
+
+  // Default fallback to MCP key, then anonymous for onboarding
+  try {
+    return authenticateWithMcpKey();
+  } catch {
+    return { type: 'anonymous' };
+  }
+}