@app-connect/core 1.7.21 → 1.7.22

package/index.js

@@ -35,6 +35,7 @@ const s3ErrorLogReport = require('./lib/s3ErrorLogReport');
 const pluginCore = require('./handlers/plugin');
 const { handleDatabaseError } = require('./lib/errorHandler');
 const { updateAuthSession } = require('./lib/authSession');
+const managedAuthCore = require('./handlers/managedAuth');
 
 let packageJson = null;
 try {
@@ -108,9 +109,79 @@ function getAnalyticsVariablesInReqHeaders({ headers }) {
     }
 }
 
+const JWT_REFRESH_THRESHOLD_SECONDS = 7 * 24 * 60 * 60; // 1 week
+const JWT_LEGACY_LONG_LIVED_THRESHOLD_SECONDS = 365 * 24 * 60 * 60; // 1 year
+
+function getBearerTokenFromRequest(req) {
+    const authHeader = req.headers?.authorization || req.headers?.Authorization;
+    if (!authHeader || typeof authHeader !== 'string') {
+        return null;
+    }
+    const [scheme, token] = authHeader.split(' ');
+    if (!scheme || scheme.toLowerCase() !== 'bearer' || !token) {
+        return null;
+    }
+    return token;
+}
+
+function normalizeJwtFromRequest(req, res, next) {
+    if (req.path?.startsWith('/mcp')) {
+        return next();
+    }
+    const originalBearerToken = getBearerTokenFromRequest(req);
+    const queryToken = req.query?.jwtToken;
+    let bearerToken = originalBearerToken;
+
+    // Backward compatibility: promote query jwtToken to Authorization Bearer.
+    if (!bearerToken && queryToken) {
+        req.headers.authorization = `Bearer ${queryToken}`;
+        bearerToken = queryToken;
+        // Don't refresh JWT because old version cannot update its local token storage to support refreshed token.
+        return next();
+    }
+
+    const token = bearerToken;
+
+    if (!token) {
+        return next();
+    }
+
+    const decodedToken = jwt.decodeJwt(token);
+    if (!decodedToken?.id) {
+        req.invalidJwtToken = true;
+        if (req.query?.jwtToken) {
+            delete req.query.jwtToken;
+        }
+        return next();
+    }
+
+    req.jwtToken = token;
+    req.jwtAuth = decodedToken;
+
+    if (typeof decodedToken.exp === 'number') {
+        const now = Math.floor(Date.now() / 1000);
+        const timeLeft = decodedToken.exp - now;
+        const isBearerAuth = !!originalBearerToken;
+        const shouldRefreshNearExpiry = timeLeft <= JWT_REFRESH_THRESHOLD_SECONDS;
+        // Rotate legacy 120y tokens only for Bearer auth clients (they can persist refreshed headers).
+        const shouldRefreshLegacyLongLivedBearer = isBearerAuth && timeLeft > JWT_LEGACY_LONG_LIVED_THRESHOLD_SECONDS;
+        if (shouldRefreshNearExpiry || shouldRefreshLegacyLongLivedBearer) {
+            const refreshedToken = jwt.generateJwt({
+                id: decodedToken.id.toString(),
+                platform: decodedToken.platform
+            });
+            res.setHeader('x-refreshed-jwt-token', refreshedToken);
+            req.jwtToken = refreshedToken;
+            req.jwtAuth = jwt.decodeJwt(refreshedToken) || decodedToken;
+        }
+    }
+    return next();
+}
+
 // Create a router with all core routes
 function createCoreRouter() {
     const router = express.Router();
+    router.use(normalizeJwtFromRequest);
 
     // Move all app.get, app.post, etc. to router.get, router.post, etc.
     router.get('/releaseNotes', async function (req, res) {
@@ -219,9 +290,16 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
-                const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+                const decodedToken = jwt.decodeJwt(jwtToken);
+                if (!decodedToken) {
+                    tracer?.trace('licenseStatus:invalidJwtToken', {});
+                    res.status(400).send(tracer ? tracer.wrapResponse('Invalid JWT token') : 'Invalid JWT token');
+                    success = false;
+                    return;
+                }
+                const { id: userId, platform } = decodedToken;
                 platformName = platform;
                 if (!userId) {
                     tracer?.trace('licenseStatus:noUserId', {});
@@ -286,7 +364,7 @@ function createCoreRouter() {
         let statusCode = 200;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -336,6 +414,36 @@ function createCoreRouter() {
             eventAddedVia
         });
     });
+    router.get('/apiKeyManagedAuthState', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('apiKeyManagedAuthState:start', { query: req.query });
+        try {
+            const platform = req.query.platform;
+            const rcAccessToken = req.query.rcAccessToken;
+            if (!platform) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Missing platform name') : 'Missing platform name');
+                return;
+            }
+            if (!rcAccessToken) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Missing RingCentral access token') : 'Missing RingCentral access token');
+                return;
+            }
+            const { rcAccountId, rcExtensionId } = await adminCore.validateRcUserToken({ rcAccessToken });
+            const managedAuthState = await managedAuthCore.getManagedAuthState({
+                platform,
+                rcAccountId,
+                rcExtensionId,
+                connectorId: req.query.connectorId,
+                isPrivate: req.query.isPrivate === 'true'
+            });
+            res.status(200).send(tracer ? tracer.wrapResponse(managedAuthState) : managedAuthState);
+        }
+        catch (e) {
+            logger.error('Get API key managed auth state failed', { stack: e.stack });
+            tracer?.traceError('apiKeyManagedAuthState:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
     // Obsolete
     router.get('/serverVersionInfo', (req, res) => {
         const defaultCrmManifest = connectorRegistry.getManifest('default');
@@ -389,7 +497,7 @@ function createCoreRouter() {
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 platformName = unAuthData?.platform ?? 'Unknown';
@@ -449,6 +557,86 @@ function createCoreRouter() {
             eventAddedVia
         });
     });
+    router.get('/admin/managedAuth', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('getAdminManagedAuth:start', { query: req.query });
+        try {
+            const jwtToken = req.jwtToken || req.query.jwtToken;
+            if (!jwtToken) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
+                return;
+            }
+            const unAuthData = jwt.decodeJwt(jwtToken);
+            const user = await UserModel.findByPk(unAuthData?.id);
+            if (!user) {
+                res.status(400).send(tracer ? tracer.wrapResponse('User not found') : 'User not found');
+                return;
+            }
+            const { isValidated, rcAccountId } = await adminCore.validateAdminRole({ rcAccessToken: req.query.rcAccessToken });
+            if (!isValidated) {
+                res.status(403).send(tracer ? tracer.wrapResponse('Admin validation failed') : 'Admin validation failed');
+                return;
+            }
+            const managedAuthSettings = await managedAuthCore.getManagedAuthAdminSettings({
+                platform: user.platform,
+                rcAccountId,
+                connectorId: req.query.connectorId,
+                isPrivate: req.query.isPrivate === 'true'
+            });
+            res.status(200).send(tracer ? tracer.wrapResponse(managedAuthSettings) : managedAuthSettings);
+        }
+        catch (e) {
+            logger.error('Get managed auth settings failed', { stack: e.stack });
+            tracer?.traceError('getAdminManagedAuth:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
+    router.post('/admin/managedAuth', async function (req, res) {
+        const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
+        tracer?.trace('setAdminManagedAuth:start', { body: { scope: req.body?.scope, rcExtensionId: req.body?.rcExtensionId } });
+        try {
+            const jwtToken = req.jwtToken || req.query.jwtToken;
+            if (!jwtToken) {
+                res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
+                return;
+            }
+            const unAuthData = jwt.decodeJwt(jwtToken);
+            const user = await UserModel.findByPk(unAuthData?.id);
+            if (!user) {
+                res.status(400).send(tracer ? tracer.wrapResponse('User not found') : 'User not found');
+                return;
+            }
+            const { isValidated, rcAccountId } = await adminCore.validateAdminRole({ rcAccessToken: req.query.rcAccessToken });
+            if (!isValidated) {
+                res.status(403).send(tracer ? tracer.wrapResponse('Admin validation failed') : 'Admin validation failed');
+                return;
+            }
+            if (req.body?.scope === 'user') {
+                await managedAuthCore.upsertUserManagedAuthValues({
+                    rcAccountId,
+                    platform: user.platform,
+                    rcExtensionId: req.body?.rcExtensionId,
+                    rcUserName: req.body?.rcUserName,
+                    values: req.body?.values ?? {},
+                    fieldsToRemove: req.body?.fieldsToRemove ?? []
+                });
+            }
+            else {
+                await managedAuthCore.upsertOrgManagedAuthValues({
+                    rcAccountId,
+                    platform: user.platform,
+                    values: req.body?.values ?? {},
+                    fieldsToRemove: req.body?.fieldsToRemove ?? []
+                });
+            }
+            res.status(200).send(tracer ? tracer.wrapResponse('Shared authentication updated') : 'Shared authentication updated');
+        }
+        catch (e) {
+            logger.error('Set managed auth settings failed', { stack: e.stack });
+            tracer?.traceError('setAdminManagedAuth:error', e);
+            res.status(400).send(tracer ? tracer.wrapResponse({ error: e.message || e }) : { error: e.message || e });
+        }
+    });
     router.post('/admin/userMapping', async function (req, res) {
         const requestStartTime = new Date().getTime();
         const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
@@ -457,7 +645,7 @@ function createCoreRouter() {
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 platformName = unAuthData?.platform ?? 'Unknown';
@@ -520,7 +708,7 @@ function createCoreRouter() {
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 platformName = unAuthData?.platform ?? 'Unknown';
@@ -581,7 +769,7 @@ function createCoreRouter() {
         tracer?.trace('getServerLoggingSettings:start', { query: req.query });
         let platformName = null;
         let success = false;
-        const jwtToken = req.query.jwtToken;
+        const jwtToken = req.jwtToken || req.query.jwtToken;
         if (!jwtToken) {
             tracer?.trace('getServerLoggingSettings:noToken', {});
             res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
@@ -632,7 +820,7 @@ function createCoreRouter() {
         tracer?.trace('setServerLoggingSettings:start', { body: req.body });
         let platformName = null;
         let success = false;
-        const jwtToken = req.query.jwtToken;
+        const jwtToken = req.jwtToken || req.query.jwtToken;
         if (!jwtToken) {
             tracer?.trace('setServerLoggingSettings:noToken', {});
             res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
@@ -713,7 +901,7 @@ function createCoreRouter() {
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 platformName = unAuthData?.platform ?? 'Unknown';
@@ -765,7 +953,7 @@ function createCoreRouter() {
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 platformName = unAuthData?.platform;
@@ -814,7 +1002,7 @@ function createCoreRouter() {
         const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
         tracer?.trace('hostname:start', { query: req.query });
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 const user = await UserModel.findByPk(unAuthData?.id);
@@ -951,7 +1139,14 @@ function createCoreRouter() {
     router.post('/apiKeyLogin', async function (req, res) {
         const requestStartTime = new Date().getTime();
         const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
-        tracer?.trace('apiKeyLogin:start', { body: req.body });
+        tracer?.trace('apiKeyLogin:start', {
+            body: {
+                platform: req.body?.platform,
+                hostname: req.body?.hostname,
+                proxyId: req.body?.proxyId,
+                hasAdditionalInfo: !!req.body?.additionalInfo
+            }
+        });
         let platformName = null;
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
@@ -962,12 +1157,33 @@ function createCoreRouter() {
             const hostname = req.body.hostname;
             const proxyId = req.body.proxyId;
             const additionalInfo = req.body.additionalInfo;
+            const rcAccessToken = req.body.rcAccessToken;
+            const connectorId = req.body.connectorId;
+            const isPrivate = !!req.body.isPrivate;
             if (!platform) {
                 tracer?.trace('apiKeyLogin:missingPlatform', {});
                 res.status(400).send(tracer ? tracer.wrapResponse('Missing platform name') : 'Missing platform name');
                 return;
             }
-            const { userInfo, returnMessage } = await authCore.onApiKeyLogin({ platform, hostname, apiKey, proxyId, rcAccountId: req.body.rcAccountId, hashedRcExtensionId: hashedExtensionId, additionalInfo });
+            let rcAccountId = null;
+            let rcExtensionId = null;
+            if (rcAccessToken) {
+                const rcUserTokenResult = await adminCore.validateRcUserToken({ rcAccessToken });
+                rcAccountId = rcUserTokenResult.rcAccountId;
+                rcExtensionId = rcUserTokenResult.rcExtensionId;
+            }
+            const { userInfo, returnMessage } = await authCore.onApiKeyLogin({
+                platform,
+                hostname,
+                apiKey,
+                proxyId,
+                rcAccountId,
+                rcExtensionId,
+                connectorId,
+                isPrivate,
+                hashedRcExtensionId: hashedExtensionId,
+                additionalInfo
+            });
             if (userInfo) {
                 const jwtToken = jwt.generateJwt({
                     id: userInfo.id.toString(),
@@ -1010,7 +1226,7 @@ function createCoreRouter() {
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
                 platformName = unAuthData?.platform ?? 'Unknown';
@@ -1077,7 +1293,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 tracer?.trace('findContact:jwtDecoded', { decodedToken });
@@ -1155,7 +1371,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -1218,7 +1434,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -1269,7 +1485,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -1333,7 +1549,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -1396,7 +1612,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -1453,9 +1669,15 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
-                const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+                const decodedToken = jwt.decodeJwt(jwtToken);
+                if (!decodedToken) {
+                    tracer?.trace('upsertCallDisposition:invalidJwtToken', {});
+                    res.status(400).send(tracer ? tracer.wrapResponse('Invalid JWT token') : 'Invalid JWT token');
+                    return;
+                }
+                const { id: userId, platform } = decodedToken;
                 platformName = platform;
                 if (!userId) {
                     tracer?.trace('upsertCallDisposition:invalidToken', {});
@@ -1522,7 +1744,7 @@ function createCoreRouter() {
         let extraData = {};
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
                 const decodedToken = jwt.decodeJwt(jwtToken);
                 if (!decodedToken) {
@@ -1586,7 +1808,7 @@ function createCoreRouter() {
         let statusCode = 200;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (!jwtToken) {
                 tracer?.trace('scheduleCallDown:noToken', {});
                 res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
@@ -1634,7 +1856,7 @@ function createCoreRouter() {
         let statusCode = 200;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (!jwtToken) {
                 tracer?.trace('getCallDownList:noToken', {});
                 res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
@@ -1675,7 +1897,7 @@ function createCoreRouter() {
         let statusCode = 200;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             const id = req.query.id;
             if (!jwtToken) {
                 tracer?.trace('deleteCallDownItem:noToken', {});
@@ -1723,7 +1945,7 @@ function createCoreRouter() {
         let statusCode = 200;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (!jwtToken) {
                 tracer?.trace('markCallDownCalled:noToken', {});
                 res.status(400).send(tracer ? tracer.wrapResponse('Please go to Settings and authorize CRM platform') : 'Please go to Settings and authorize CRM platform');
@@ -1770,9 +1992,16 @@ function createCoreRouter() {
         let statusCode = 200;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
         try {
-            const jwtToken = req.query.jwtToken;
+            const jwtToken = req.jwtToken || req.query.jwtToken;
             if (jwtToken) {
-                const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+                const decodedToken = jwt.decodeJwt(jwtToken);
+                if (!decodedToken) {
+                    tracer?.trace('findContactWithName:invalidJwtToken', {});
+                    res.status(400).send(tracer ? tracer.wrapResponse('Invalid JWT token') : 'Invalid JWT token');
+                    success = false;
+                    return;
+                }
+                const { id: userId, platform } = decodedToken;
                 platformName = platform;
                 const { successful, returnMessage, contact, isRevokeUserSession } = await contactCore.findContactWithName({ platform, userId, name: req.query.name });
                 if (isRevokeUserSession) {
@@ -1822,7 +2051,7 @@ function createCoreRouter() {
         let platformName = null;
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
-        const jwtToken = req.query.jwtToken;
+        const jwtToken = req.jwtToken || req.query.jwtToken;
         try {
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
@@ -1868,7 +2097,7 @@ function createCoreRouter() {
         let platformName = null;
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
-        const jwtToken = req.query.jwtToken;
+        const jwtToken = req.jwtToken || req.query.jwtToken;
         try {
             if (jwtToken) {
                 const unAuthData = jwt.decodeJwt(jwtToken);
@@ -1909,7 +2138,7 @@ function createCoreRouter() {
     router.get('/ringcentral/oauth/callback', async function (req, res) {
         const tracer = req.headers['is-debug'] === 'true' ? DebugTracer.fromRequest(req) : null;
         tracer?.trace('onRingcentralOAuthCallback:start', { query: req.query });
-        const jwtToken = req.query.jwtToken;
+        const jwtToken = req.jwtToken || req.query.jwtToken;
         if (jwtToken) {
             const unAuthData = jwt.decodeJwt(jwtToken);
             const { code } = req.query;
@@ -1933,7 +2162,7 @@ function createCoreRouter() {
         let platformName = null;
         let success = false;
         const { hashedExtensionId, hashedAccountId, userAgent, ip, author, eventAddedVia } = getAnalyticsVariablesInReqHeaders({ headers: req.headers })
-        const jwtToken = req.query.jwtToken;
+        const jwtToken = req.jwtToken || req.query.jwtToken;
         if (jwtToken) {
             const unAuthData = jwt.decodeJwt(jwtToken);
             const uploadUrl = await s3ErrorLogReport.getUploadUrl({ userId: unAuthData?.id, platform: unAuthData?.platform });
@@ -2214,7 +2443,8 @@ function createCoreMiddleware() {
             }
         }),
         cors({
-            methods: ['GET', 'POST', 'PATCH', 'PUT', 'DELETE']
+            methods: ['GET', 'POST', 'PATCH', 'PUT', 'DELETE'],
+            exposedHeaders: ['x-refreshed-jwt-token']
         })
     ];
 }

package/lib/jwt.js

@@ -2,7 +2,7 @@ const { sign, verify } = require('jsonwebtoken');
 const logger = require('./logger');
 
 function generateJwt(data) {
-  return sign(data, process.env.APP_SERVER_SECRET_KEY, { expiresIn: '120y' })
+  return sign(data, process.env.APP_SERVER_SECRET_KEY, { expiresIn: '2w' })
 }
 
 function decodeJwt(token) {

package/mcp/tools/createCallLog.js

@@ -220,7 +220,11 @@ async function execute(args) {
         }
 
         // Decode JWT to get userId and platform
-        const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId, platform } = decodedToken;
 
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');

package/mcp/tools/createContact.js

@@ -57,7 +57,11 @@ async function execute(args) {
         }
 
         // Decode JWT to get userId and platform
-        const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId, platform } = decodedToken;
 
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');

package/mcp/tools/createMessageLog.js

@@ -228,7 +228,11 @@ async function execute(args) {
         }
 
         // Decode JWT to get userId and platform
-        const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId, platform } = decodedToken;
         
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');

package/mcp/tools/findContactByName.js

@@ -42,7 +42,11 @@ async function execute(args) {
             throw new Error('Not authenticated. Please connect to your CRM first.');
         }
         // Decode JWT to get userId and platform
-        const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId, platform } = decodedToken;
         
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');

package/mcp/tools/findContactByPhone.js

@@ -51,7 +51,11 @@ async function execute(args) {
         const { jwtToken, phoneNumber, overridingFormat, isExtension } = args;
 
         // Decode JWT to get userId and platform
-        const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId, platform } = decodedToken;
         
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');
@@ -94,4 +98,4 @@ async function execute(args) {
 }
 
 exports.definition = toolDefinition;
-exports.execute = execute;
+exports.execute = execute;

package/mcp/tools/getCallLog.js

@@ -45,7 +45,11 @@ async function execute(args) {
         const { jwtToken, sessionIds, requireDetails = false } = args;
 
         // Decode JWT to get userId and platform
-        const { id: userId, platform } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId, platform } = decodedToken;
         
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');

package/mcp/tools/rcGetCallLogs.js

@@ -32,7 +32,11 @@ async function execute(args) {
         if (!rcAccessToken) {
             throw new Error('RingCentral access token not found');
         }
-        const { id: userId } = jwt.decodeJwt(jwtToken);
+        const decodedToken = jwt.decodeJwt(jwtToken);
+        if (!decodedToken) {
+            throw new Error('Invalid JWT token');
+        }
+        const { id: userId } = decodedToken;
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');
         }
@@ -58,4 +62,4 @@ async function execute(args) {
 }
 
 exports.definition = toolDefinition;
-exports.execute = execute;
+exports.execute = execute;