@app-connect/core 1.7.37 → 1.7.38

package/{mcp → dist/mcp}/mcpHandler.js

@@ -1,3 +1,4 @@
+"use strict";
 /**
  * MCP Server for RC Unified CRM Extension
  *
@@ -5,32 +6,41 @@
  * Fully compatible with stateless deployments (AWS Lambda, etc.).
  * All auth context is resolved per-request; rcExtensionId is cached in CacheModel.
  */
-
-const axios = require('axios');
-const { Op } = require('sequelize');
-const tools = require('./tools');
-const { LlmSessionModel } = require('../models/llmSessionModel');
-const { CacheModel } = require('../models/cacheModel');
-const { UserModel } = require('../models/userModel');
-const { getHashValue } = require('../lib/util');
-const jwt = require('../lib/jwt');
-const logger = require('../lib/logger');
+Object.defineProperty(exports, "__esModule", { value: true });
+// @ts-check
+const axios = /** @type {any} */ (require('axios'));
+const { Op } = /** @type {any} */ (require('sequelize'));
+const tools = /** @type {any} */ (require('./tools'));
+const { LlmSessionModel: RawLlmSessionModel } = require('../models/llmSessionModel');
+const LlmSessionModel = /** @type {any} */ (RawLlmSessionModel);
+const { CacheModel: RawCacheModel } = require('../models/cacheModel');
+const CacheModel = /** @type {any} */ (RawCacheModel);
+const { UserModel: RawUserModel } = require('../models/userModel');
+const UserModel = /** @type {any} */ (RawUserModel);
+const { getHashValue: rawGetHashValue } = require('../lib/util');
+const getHashValue = /** @type {any} */ (rawGetHashValue);
+const jwt = /** @type {any} */ (require('../lib/jwt'));
+const logger = /** @type {any} */ (require('../lib/logger'));
+const { verifyWidgetSessionToken: rawVerifyWidgetSessionToken } = require('./lib/widgetSessionToken');
+const verifyWidgetSessionToken = /** @type {any} */ (rawVerifyWidgetSessionToken);
+const { MCP_OAUTH_INVALID_TOKEN_MESSAGE, buildMcpOAuthError: rawBuildMcpOAuthError, } = require('./lib/oauthError');
+const buildMcpOAuthError = /** @type {any} */ (rawBuildMcpOAuthError);
 const fs = require('fs');
 const path = require('path');
-
 /**
  * Increment this to bust ChatGPT's widget resource cache after every UI build.
  * This is the single source of truth — injected into getPublicConnectors _meta at response time.
  */
-const WIDGET_VERSION = 10;
+const WIDGET_VERSION = 11;
 const WIDGET_URI = `ui://widget/ConnectorList-v${WIDGET_VERSION}.html`;
 const RC_EXTENSION_CACHE_KEY = 'rcExtensionId';
 const RC_EXTENSION_CACHE_STATUS = 'resolved';
-
 const JSON_RPC_INTERNAL_ERROR = -32603;
 const JSON_RPC_METHOD_NOT_FOUND = -32601;
 const JSON_RPC_INVALID_PARAMS = -32602;
-
+function getWidgetSessionToken(req) {
+    return req.headers?.['x-app-connect-widget-token'] || req.headers?.['X-App-Connect-Widget-Token'];
+}
 /**
  * JSON Schema definitions for tools that accept parameters.
  * Without inputSchema, ChatGPT silently drops all arguments when calling the tool.
@@ -84,7 +94,6 @@ const inputSchemas = {
         required: [],
     },
 };
-
 const standardToolResultOutputSchema = {
     type: 'object',
     properties: {
@@ -96,7 +105,6 @@ const standardToolResultOutputSchema = {
     },
     required: ['success'],
 };
-
 /**
  * JSON Schema definitions for each tool's structuredContent response.
  * MCP clients use this from tools/list to understand and validate tool output.
@@ -173,38 +181,33 @@ const outputSchemas = {
     confirmAppointment: standardToolResultOutputSchema,
     cancelAppointment: standardToolResultOutputSchema,
 };
-
 /**
  * Verify an RC access token and return the caller's extension ID.
  * Throws if the token is invalid.
  */
 async function resolveRcExtensionId(rcAccessToken) {
-    const resp = await axios.get(
-        'https://platform.ringcentral.com/restapi/v1.0/account/~/extension/~',
-        { headers: { Authorization: `Bearer ${rcAccessToken}` } }
-    );
+    const resp = await axios.get('https://platform.ringcentral.com/restapi/v1.0/account/~/extension/~', { headers: { Authorization: `Bearer ${rcAccessToken}` } });
     return resp.data?.id?.toString() ?? null;
 }
-
 /**
  * Resolve rcExtensionId for the current request.
  * Checks CacheModel first (avoids RC API call on Lambda cold starts),
  * falls back to a live RC API verification and persists the result.
  */
 async function resolveSessionContext(rcAccessToken, openaiSessionId) {
-    if (!rcAccessToken) return { rcExtensionId: null };
-
+    if (!rcAccessToken)
+        return { rcExtensionId: null };
     if (openaiSessionId) {
         try {
             const cached = await CacheModel.findByPk(`${openaiSessionId}-${RC_EXTENSION_CACHE_KEY}`);
             if (cached?.data?.rcExtensionId && (!cached.expiry || cached.expiry > new Date())) {
                 return { rcExtensionId: cached.data.rcExtensionId };
             }
-        } catch (err) {
+        }
+        catch (err) {
             logger.warn('CacheModel lookup failed:', { message: err.message });
         }
     }
-
     let rcExtensionId = null;
     try {
         rcExtensionId = await resolveRcExtensionId(rcAccessToken);
@@ -218,13 +221,19 @@ async function resolveSessionContext(rcAccessToken, openaiSessionId) {
                 expiry: new Date(Date.now() + 24 * 60 * 60 * 1000), // 24h TTL
             });
         }
-    } catch (err) {
+    }
+    catch (err) {
         logger.warn('Failed to resolve RC extension ID:', { message: err.message });
+        return {
+            rcExtensionId: null,
+            rcTokenError: buildMcpOAuthError({
+                message: MCP_OAUTH_INVALID_TOKEN_MESSAGE,
+                errorDetails: err.message,
+            }),
+        };
     }
-
     return { rcExtensionId };
 }
-
 /**
  * Build the tools list to return in tools/list responses.
  * Injects schema metadata and stamps WIDGET_URI into getPublicConnectors _meta.
@@ -244,7 +253,6 @@ function getToolsList() {
         return def;
     });
 }
-
 function getStructuredContent(result) {
     if (result?.structuredContent && typeof result.structuredContent === 'object' && !Array.isArray(result.structuredContent)) {
         return result.structuredContent;
@@ -254,7 +262,6 @@ function getStructuredContent(result) {
     }
     return { result: result ?? null };
 }
-
 function buildToolResult(toolDefinition, result) {
     const structuredContent = getStructuredContent(result);
     const responseResult = {
@@ -262,17 +269,14 @@ function buildToolResult(toolDefinition, result) {
             ? result.content
             : [{ type: 'text', text: JSON.stringify(structuredContent, null, 2) }],
     };
-
     if (toolDefinition?.outputSchema || outputSchemas[toolDefinition?.name] || result?.structuredContent) {
         responseResult.structuredContent = structuredContent;
     }
     if (structuredContent?.success === false) {
         responseResult.isError = true;
     }
-
     return responseResult;
 }
-
 /**
  * Handle incoming MCP HTTP requests.
  * Stateless: each POST is handled independently with no session state between requests.
@@ -281,12 +285,9 @@ async function handleMcpRequest(req, res) {
     try {
         const { method, params, id } = req.body;
         logger.info('Received MCP request:', { method });
-
         const rcAccessToken = req.headers['authorization']?.split('Bearer ')?.[1];
         const openaiSessionId = params?._meta?.['openai/session'] ?? null;
-
         let response;
-
         switch (method) {
             case 'initialize':
                 response = {
@@ -305,7 +306,6 @@ async function handleMcpRequest(req, res) {
                     },
                 };
                 break;
-
             case 'tools/list':
                 response = {
                     jsonrpc: '2.0',
@@ -313,15 +313,22 @@ async function handleMcpRequest(req, res) {
                     result: { tools: getToolsList() },
                 };
                 break;
-
             case 'tools/call': {
                 const { name: toolName, arguments: args } = params;
                 const toolArgs = { ...(args || {}) };
-
-                if (rcAccessToken) toolArgs.rcAccessToken = rcAccessToken;
-                if (openaiSessionId) toolArgs.openaiSessionId = openaiSessionId;
-
-                const { rcExtensionId } = await resolveSessionContext(rcAccessToken, openaiSessionId);
+                if (rcAccessToken)
+                    toolArgs.rcAccessToken = rcAccessToken;
+                if (openaiSessionId)
+                    toolArgs.openaiSessionId = openaiSessionId;
+                const { rcExtensionId, rcTokenError } = await resolveSessionContext(rcAccessToken, openaiSessionId);
+                if (rcTokenError) {
+                    response = {
+                        jsonrpc: '2.0',
+                        id,
+                        result: buildToolResult({ outputSchema: standardToolResultOutputSchema }, rcTokenError),
+                    };
+                    break;
+                }
                 if (rcExtensionId) {
                     toolArgs.rcExtensionId = rcExtensionId;
                     if (!toolArgs.jwtToken) {
@@ -378,19 +385,18 @@ async function handleMcpRequest(req, res) {
                         }
                     }
                 }
-
                 try {
                     const tool = tools.tools.find(t => t.definition.name === toolName);
-                    if (!tool) throw new Error(`Tool not found: ${toolName}`);
-
+                    if (!tool)
+                        throw new Error(`Tool not found: ${toolName}`);
                     const result = await tool.execute(toolArgs);
-
                     response = {
                         jsonrpc: '2.0',
                         id,
                         result: buildToolResult(tool.definition, result),
                     };
-                } catch (toolError) {
+                }
+                catch (toolError) {
                     response = {
                         jsonrpc: '2.0',
                         id,
@@ -402,23 +408,21 @@ async function handleMcpRequest(req, res) {
                 }
                 break;
             }
-
             case 'resources/list':
                 response = {
                     jsonrpc: '2.0',
                     id,
                     result: {
                         resources: [{
-                            uri: WIDGET_URI,
-                            name: 'connector-list-widget',
-                            title: 'ConnectorList',
-                            description: 'ChatGPT widget for connector selection',
-                            mimeType: 'text/html+skybridge',
-                        }],
+                                uri: WIDGET_URI,
+                                name: 'connector-list-widget',
+                                title: 'ConnectorList',
+                                description: 'ChatGPT widget for connector selection',
+                                mimeType: 'text/html+skybridge',
+                            }],
                     },
                 };
                 break;
-
             case 'resources/read': {
                 const uri = params?.uri;
                 if (!uri?.startsWith('ui://widget/')) {
@@ -429,45 +433,44 @@ async function handleMcpRequest(req, res) {
                     };
                     break;
                 }
-
                 const appUrl = process.env.APP_SERVER || 'http://localhost:6066';
                 const distPath = path.join(__dirname, 'ui', 'dist', 'index.html');
                 const devPath = path.join(__dirname, 'ui', 'index.html');
                 let htmlContent;
-                try { htmlContent = fs.readFileSync(distPath, 'utf8'); }
-                catch { htmlContent = fs.readFileSync(devPath, 'utf8'); }
-
+                try {
+                    htmlContent = fs.readFileSync(distPath, 'utf8');
+                }
+                catch {
+                    htmlContent = fs.readFileSync(devPath, 'utf8');
+                }
                 response = {
                     jsonrpc: '2.0',
                     id,
                     result: {
                         contents: [{
-                            uri: WIDGET_URI,
-                            mimeType: 'text/html+skybridge',
-                            text: htmlContent,
-                            _meta: {
-                                'openai/widgetPrefersBorder': true,
-                                'openai/widgetDomain': appUrl,
-                                'openai/widgetCSP': {
-                                    connect_domains: [appUrl, 'https://appconnect.labs.ringcentral.com'],
-                                    resource_domains: [appUrl],
+                                uri: WIDGET_URI,
+                                mimeType: 'text/html+skybridge',
+                                text: htmlContent,
+                                _meta: {
+                                    'openai/widgetPrefersBorder': true,
+                                    'openai/widgetDomain': appUrl,
+                                    'openai/widgetCSP': {
+                                        connect_domains: [appUrl, 'https://appconnect.labs.ringcentral.com'],
+                                        resource_domains: [appUrl],
+                                    },
                                 },
-                            },
-                        }],
+                            }],
                     },
                 };
                 break;
             }
-
             case 'ping':
                 response = { jsonrpc: '2.0', id, result: {} };
                 break;
-
             case 'notifications/initialized':
             case 'notifications/cancelled':
                 // JSON-RPC notifications — no id, no response expected
                 return res.status(200).end();
-
             default:
                 response = {
                     jsonrpc: '2.0',
@@ -475,9 +478,9 @@ async function handleMcpRequest(req, res) {
                     error: { code: JSON_RPC_METHOD_NOT_FOUND, message: `Method not found: ${method}` },
                 };
         }
-
         res.status(200).json(response);
-    } catch (error) {
+    }
+    catch (error) {
         logger.error('Error handling MCP request:', { stack: error.stack });
         res.status(200).json({
             jsonrpc: '2.0',
@@ -490,7 +493,6 @@ async function handleMcpRequest(req, res) {
         });
     }
 }
-
 /**
  * Handle widget tool calls via direct HTTP (bypasses MCP protocol).
  * The ChatGPT postMessage bridge does not forward tool arguments,
@@ -499,25 +501,34 @@ async function handleMcpRequest(req, res) {
 async function handleWidgetToolCall(req, res) {
     try {
         logger.info('Widget tool call received. body:', JSON.stringify(req.body));
-
         const { tool: toolName, toolArgs: args } = req.body || {};
-
         logger.info('Widget tool call parsed:', { toolName, args: JSON.stringify(args) });
-
+        const widgetContext = verifyWidgetSessionToken(getWidgetSessionToken(req));
+        if (!widgetContext) {
+            return res.status(401).json({ success: false, error: 'Invalid widget session' });
+        }
         if (!toolName) {
             return res.status(400).json({ success: false, error: 'Missing tool name' });
         }
-
-        const allWidgetCallable = [...tools.tools, ...tools.widgetTools];
-        const tool = allWidgetCallable.find(t => t.definition.name === toolName);
+        const tool = tools.widgetTools.find(t => t.definition.name === toolName);
         if (!tool) {
             return res.status(404).json({ success: false, error: `Unknown tool: ${toolName}` });
         }
-
-        const result = await tool.execute(args || {});
+        const toolArgs = args && typeof args === 'object' ? args : {};
+        if (widgetContext.openaiSessionId &&
+            toolArgs.sessionId &&
+            toolArgs.sessionId !== widgetContext.openaiSessionId) {
+            return res.status(403).json({ success: false, error: 'Widget session mismatch' });
+        }
+        const result = await tool.execute({
+            ...toolArgs,
+            rcExtensionId: widgetContext.rcExtensionId,
+            openaiSessionId: widgetContext.openaiSessionId,
+        });
         logger.info('Widget tool call result:', { toolName, success: result?.success });
         res.json(result);
-    } catch (error) {
+    }
+    catch (error) {
         logger.error('Widget tool call error:', { stack: error.stack });
         res.status(500).json({
             success: false,
@@ -525,6 +536,5 @@ async function handleWidgetToolCall(req, res) {
         });
     }
 }
-
 exports.handleMcpRequest = handleMcpRequest;
 exports.handleWidgetToolCall = handleWidgetToolCall;

package/dist/mcp/tools/cancelAppointment.d.ts

@@ -0,0 +1 @@
+export {};

package/{mcp → dist/mcp}/tools/cancelAppointment.js

@@ -1,13 +1,14 @@
-const jwt = require('../../lib/jwt');
-const connectorRegistry = require('../../connector/registry');
-const appointmentCore = require('../../handlers/appointment');
-
+"use strict";
+// @ts-check
+Object.defineProperty(exports, "__esModule", { value: true });
+const jwt = /** @type {any} */ (require('../../lib/jwt'));
+const connectorRegistry = /** @type {any} */ (require('../../connector/registry'));
+const appointmentCore = /** @type {any} */ (require('../../handlers/appointment'));
 /**
  * MCP Tool: Cancel Appointment
  *
  * Cancels (deletes) an existing appointment/event in the CRM platform.
  */
-
 const toolDefinition = {
     name: 'cancelAppointment',
     description: '⚠️ REQUIRES CRM CONNECTION. | Cancel an existing appointment or event in the CRM platform by its ID. This action is destructive — the appointment will be removed.',
@@ -27,51 +28,42 @@ const toolDefinition = {
         destructiveHint: true
     }
 };
-
 /**
  * Execute the cancelAppointment tool
  * @param {Object} args
  * @param {string} args.jwtToken - Injected server-side JWT token
  * @param {string} args.appointmentId - CRM appointment ID to cancel
- * @returns {Object} Result with cancelled appointment data
+ * @returns {Promise<any>} Result with cancelled appointment data
  */
 async function execute(args) {
     try {
         const { jwtToken, appointmentId } = args;
-
         if (!jwtToken) {
             throw new Error('Please go to Settings and authorize CRM platform');
         }
-
         if (!appointmentId) {
             throw new Error('appointmentId is required');
         }
-
         const decodedToken = jwt.decodeJwt(jwtToken);
         if (!decodedToken) {
             throw new Error('Invalid JWT token');
         }
         const { id: userId, platform } = decodedToken;
-
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');
         }
-
         const platformModule = connectorRegistry.getConnector(platform);
         if (!platformModule) {
             throw new Error(`Platform connector not found for: ${platform}`);
         }
-
         if (!platformModule.cancelAppointment) {
             throw new Error(`cancelAppointment is not implemented for platform: ${platform}`);
         }
-
         const { successful, appointment, returnMessage } = await appointmentCore.cancelAppointment({
             platform,
             userId,
             appointmentId
         });
-
         if (successful) {
             return {
                 success: true,
@@ -96,6 +88,5 @@ async function execute(args) {
         };
     }
 }
-
 exports.definition = toolDefinition;
 exports.execute = execute;

package/dist/mcp/tools/checkAuthStatus.d.ts

@@ -0,0 +1 @@
+export {};

package/{mcp → dist/mcp}/tools/checkAuthStatus.js

@@ -1,12 +1,15 @@
-const { getAuthSession } = require('../../lib/authSession');
-const { LlmSessionModel } = require('../../models/llmSessionModel');
-
+"use strict";
+// @ts-check
+Object.defineProperty(exports, "__esModule", { value: true });
+const { getAuthSession: rawGetAuthSession } = require('../../lib/authSession');
+const getAuthSession = /** @type {any} */ (rawGetAuthSession);
+const { LlmSessionModel: RawLlmSessionModel } = require('../../models/llmSessionModel');
+const LlmSessionModel = /** @type {any} */ (RawLlmSessionModel);
 /**
  * MCP Tool: Check Auth Status
  *
  * Polls the status of an ongoing OAuth authentication session
  */
-
 const toolDefinition = {
     name: 'checkAuthStatus',
     description: 'Check the status of an ongoing OAuth authentication session. Poll this after user clicks the auth link.',
@@ -26,13 +29,12 @@ const toolDefinition = {
         destructiveHint: false
     }
 };
-
 /**
  * Execute the checkAuthStatus tool
  * @param {Object} args - The tool arguments
  * @param {string} args.sessionId - The session ID to check
  * @param {string} args.rcExtensionId - The RC extension ID
- * @returns {Object} Result object with authentication status
+ * @returns {Promise<any>} Result object with authentication status
  */
 async function execute(args) {
     try {
@@ -44,16 +46,26 @@ async function execute(args) {
             throw new Error('rcExtensionId is required');
         }
         const session = await getAuthSession(sessionId);
-
         if (!session) {
             return {
                 success: false,
                 error: 'CRM auth session not found or expired. Ask the user to start the auth flow again.'
             };
         }
-
+        if (session.rcExtensionId && session.rcExtensionId !== rcExtensionId) {
+            return {
+                success: false,
+                error: 'CRM auth session does not belong to this RingCentral extension.'
+            };
+        }
         switch (session.status) {
             case 'completed':
+                if (!session.jwtToken) {
+                    return {
+                        success: false,
+                        error: 'CRM auth session completed without a CRM token.'
+                    };
+                }
                 await LlmSessionModel.upsert({
                     id: rcExtensionId,
                     jwtToken: session.jwtToken,
@@ -62,12 +74,10 @@ async function execute(args) {
                 return {
                     data: {
                         status: 'completed',
-                        jwtToken: session.jwtToken,
                         userInfo: session.userInfo,
-                        message: 'IMPORTANT: Authentication successful! Keep jwtToken in memory for future use. DO NOT directly show it to user.'
+                        message: 'Authentication successful. CRM token stored server-side for future tool calls.'
                     }
                 };
-
             case 'expired':
                 return {
                     data: {
@@ -75,7 +85,6 @@ async function execute(args) {
                         errorMessage: 'Authentication session expired. Ask the user to start the auth flow again.'
                     }
                 };
-
             case 'failed':
                 return {
                     data: {
@@ -83,7 +92,6 @@ async function execute(args) {
                         errorMessage: session.errorMessage || 'Unknown error'
                     }
                 };
-
             case 'pending':
             default:
                 return {
@@ -100,6 +108,5 @@ async function execute(args) {
         };
     }
 }
-
 exports.definition = toolDefinition;
 exports.execute = execute;

package/dist/mcp/tools/confirmAppointment.d.ts

@@ -0,0 +1 @@
+export {};

package/{mcp → dist/mcp}/tools/confirmAppointment.js

@@ -1,13 +1,14 @@
-const jwt = require('../../lib/jwt');
-const connectorRegistry = require('../../connector/registry');
-const appointmentCore = require('../../handlers/appointment');
-
+"use strict";
+// @ts-check
+Object.defineProperty(exports, "__esModule", { value: true });
+const jwt = /** @type {any} */ (require('../../lib/jwt'));
+const connectorRegistry = /** @type {any} */ (require('../../connector/registry'));
+const appointmentCore = /** @type {any} */ (require('../../handlers/appointment'));
 /**
  * MCP Tool: Confirm Appointment
  *
  * Marks an existing appointment/event as confirmed in the CRM platform.
  */
-
 const toolDefinition = {
     name: 'confirmAppointment',
     description: '⚠️ REQUIRES CRM CONNECTION. | Confirm an existing appointment or event in the CRM platform by its ID. Returns the updated appointment details.',
@@ -27,51 +28,42 @@ const toolDefinition = {
         destructiveHint: false
     }
 };
-
 /**
  * Execute the confirmAppointment tool
  * @param {Object} args
  * @param {string} args.jwtToken - Injected server-side JWT token
  * @param {string} args.appointmentId - CRM appointment ID to confirm
- * @returns {Object} Result with updated appointment data
+ * @returns {Promise<any>} Result with updated appointment data
  */
 async function execute(args) {
     try {
         const { jwtToken, appointmentId } = args;
-
         if (!jwtToken) {
             throw new Error('Please go to Settings and authorize CRM platform');
         }
-
         if (!appointmentId) {
             throw new Error('appointmentId is required');
         }
-
         const decodedToken = jwt.decodeJwt(jwtToken);
         if (!decodedToken) {
             throw new Error('Invalid JWT token');
         }
         const { id: userId, platform } = decodedToken;
-
         if (!userId) {
             throw new Error('Invalid JWT token: userId not found');
         }
-
         const platformModule = connectorRegistry.getConnector(platform);
         if (!platformModule) {
             throw new Error(`Platform connector not found for: ${platform}`);
         }
-
         if (!platformModule.confirmAppointment) {
             throw new Error(`confirmAppointment is not implemented for platform: ${platform}`);
         }
-
         const { successful, appointment, returnMessage } = await appointmentCore.confirmAppointment({
             platform,
             userId,
             appointmentId
         });
-
         if (successful) {
             return {
                 success: true,
@@ -96,6 +88,5 @@ async function execute(args) {
         };
     }
 }
-
 exports.definition = toolDefinition;
 exports.execute = execute;

package/dist/mcp/tools/createAppointment.d.ts

@@ -0,0 +1 @@
+export {};