@clipform/mcp-server 4.2.5 → 4.2.7

package/dist/chunk-VPF6MLKM.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/auth-context.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\n\n/**\n * Identity of the end-user a given MCP request is acting on behalf of.\n *\n * Populated by the in-process host (apps/api) after validating an OAuth\n * Bearer on /mcp. The MCP tool layer reads it to decide which workspace\n * forms should land in and which plan tier gates apply.\n *\n * NOT populated when the server runs as a local stdio process (npx) - in\n * that mode tools fall back to edit-token based auth.\n */\nexport interface McpAuthContext {\n  user_id: string;\n  workspace_id: string;\n  scopes: string[];\n  tool_name?: string;\n  api_key?: string;\n  // Set when the human behind this tool call is an anonymous Supabase\n  // session (apps/api's app-chat lane, #2983/#2984) - api-client.ts's\n  // getAuthHeaders reads it to mark the outgoing bot-key HTTP request so the\n  // API can propagate the restriction even though the request itself\n  // authenticates with an API key, not a JWT.\n  is_anonymous?: boolean;\n  // Set on the OAuth branch of apps/api's mcp/handler.ts when this request's\n  // bot API key was resolved on behalf of an OAuth-connected user (#3716) -\n  // api-client.ts's getAuthHeaders reads it to mark the outgoing request so\n  // /v1/me can report auth_mode \"oauth\" instead of the generic \"api_key\" the\n  // bot-key lane would otherwise get, even though the request itself\n  // authenticates with an API key, not an OAuth token.\n  auth_via?: \"oauth\";\n  // #3330 review fix (blocker 1): an HMAC proof (apps/api's mcp-mint-proof.ts)\n  // that THIS exact request's #1415 anon lane freshly minted a brand-new anon\n  // identity for `workspace_id` - set only on the mint branch of\n  // resolveAnonymousMcpAuth, never when auth was resolved via an inbound\n  // form_id (even the caller's own). Lets create-form.ts safely offer a\n  // same-UID claim link without ever deriving \"who to bind it to\" from a\n  // body-supplied id, which would let a batch smuggling another tenant's\n  // form_id alongside a create_form call mint a claim token for THAT\n  // tenant's identity instead of the caller's own.\n  mcp_mint_proof?: string;\n  // #4090: sibling of mcp_mint_proof, set when the anon lane REUSED a\n  // server-verified session binding (#4652) instead of minting. HMAC-bound\n  // to the bound {workspace, uid}; lets create-form.ts re-surface the claim\n  // link on later forms in the session.\n  mcp_session_proof?: string;\n  // #3822: set ONLY on the OAuth branch of apps/api's mcp/handler.ts. Lets a\n  // single tool call target another workspace the connected user belongs to\n  // (per-call, never per-request - see the #3330 note in the package\n  // CLAUDE.md). The host re-checks membership on every call and returns that\n  // workspace's own bot key, or null to mean \"act in the default workspace\n  // unchanged\" (target is the default, or a form_id the user can't reach -\n  // the API then answers exactly as it did before targeting existed). Anon + stdio contexts never carry it, so they\n  // stay pinned to one workspace.\n  resolveWorkspace?: (target: {\n    workspace_id?: string;\n    form_id?: string;\n  }) => Promise<{ workspace_id: string; workspace_name: string; api_key: string } | null>;\n  // #3822: the workspaces the connected user may target (same set\n  // resolveWorkspace accepts). OAuth lane only.\n  listWorkspaces?: () => Promise<{ id: string; name: string }[]>;\n  // #3822: the workspace picked at authorize time - what a call with no\n  // `workspace_id` acts in. OAuth lane only (workspace_id above is swapped\n  // per call when a target is resolved, this never is).\n  default_workspace_id?: string;\n  // #4657: set ONLY by apps/api's mcp/handler.ts for an anonymous request made\n  // entirely of `anon_no_workspace` tools (get_guide / get_workflow /\n  // list_assets). That lane has NO credential of any kind: the static content\n  // is served in-process through this loader instead of an HTTP callApi, so no\n  // secret or key ever sits in the anonymous context. Tools use it when\n  // present and callApi otherwise (stdio / published behaviour unchanged).\n  // #4657: decoded PostHog MCP `$session_id` from the inbound Mcp-Session-Id -\n  // ANALYTICS ONLY (stamped on funnel events). api-client.ts forwards it as\n  // MCP_SESSION_ID_HEADER; nothing about identity or access derives from it.\n  mcp_session_id?: string;\n  loadInternalContent?: (\n    kind: \"guides\" | \"assets\",\n    params?: { type?: string }\n  ) => Promise<Record<string, unknown>>;\n}\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `is_anonymous` is true, so an anonymous\n * app-chat session can't launder itself into an unrestricted API-key caller\n * by asking the bot to publish/mint credentials on its behalf. apps/api's\n * authMiddleware / workspaceAccessMiddleware / requireWorkspaceWriteAuth\n * read this on the API-key path and set isAnonymous accordingly - trusting\n * it is safe because it can only RESTRICT a caller: a real integration that\n * sets this header on its own API-key requests only denies itself, it can\n * never use it to gain anonymous-JWT privileges it doesn't already have.\n */\nexport const MCP_ANONYMOUS_HEADER = \"x-clipform-anonymous\";\n\n/**\n * Marker header the in-process MCP tool layer sets on its outgoing API\n * requests (api-client.ts) when `auth_via` is \"oauth\", so /v1/me can report\n * `auth_mode: \"oauth\"` for an OAuth-connected user instead of the generic\n * \"api_key\" the bot-key lane would otherwise get (#3716). Label-only: it\n * changes nothing but the reported string. Trusting it from the wire is\n * safe because a direct API-key caller who sets this header on their own\n * request only mislabels their own whoami output - they gain no privilege,\n * exactly the same reasoning as MCP_ANONYMOUS_HEADER above (except that\n * header can only restrict, and this one can only relabel).\n */\nexport const MCP_AUTH_VIA_HEADER = \"x-clipform-auth-via\";\n\n/**\n * Carries `mcp_mint_proof` on the same outgoing bot-key request. Unlike\n * MCP_ANONYMOUS_HEADER (a boolean that can only ever RESTRICT), this header's\n * VALUE matters - it names an identity a claim token gets bound to - so its\n * value is HMAC-signed (mcp-mint-proof.ts) rather than trusted raw: a direct\n * external caller reaching `POST /v1/forms` with any valid workspace API key\n * could otherwise hand-set an unsigned \"mint uid\" header to an arbitrary\n * victim's uid themselves (#3330 review).\n */\nexport const MCP_MINT_PROOF_HEADER = \"x-clipform-mcp-mint-proof\";\n\n/** #4090: carries `mcp_session_proof` (same trust model as MCP_MINT_PROOF_HEADER: HMAC-verified server-side, never trusted raw). */\nexport const MCP_SESSION_PROOF_HEADER = \"x-clipform-mcp-session-proof\";\n\n/** Carries `mcp_session_id` to the API for funnel analytics only (#4657). */\nexport const MCP_SESSION_ID_HEADER = \"x-clipform-mcp-session-id\";\n\nconst storage = new AsyncLocalStorage<McpAuthContext>();\n\nexport function runWithMcpAuth<T>(ctx: McpAuthContext, fn: () => Promise<T> | T): Promise<T> | T {\n  return storage.run(ctx, fn);\n}\n\nexport function getMcpAuth(): McpAuthContext | undefined {\n  return storage.getStore();\n}\n\nexport function runWithMcpTool<T>(toolName: string, fn: () => Promise<T> | T): Promise<T> | T {\n  const parent = storage.getStore();\n  if (!parent) return fn();\n  return storage.run({ ...parent, tool_name: toolName }, fn);\n}\n"],"mappings":";AAAA,SAAS,yBAAyB;AA4F3B,IAAM,uBAAuB;AAa7B,IAAM,sBAAsB;AAW5B,IAAM,wBAAwB;AAG9B,IAAM,2BAA2B;AAGjC,IAAM,wBAAwB;AAErC,IAAM,UAAU,IAAI,kBAAkC;AAE/C,SAAS,eAAkB,KAAqB,IAA0C;AAC/F,SAAO,QAAQ,IAAI,KAAK,EAAE;AAC5B;AAEO,SAAS,aAAyC;AACvD,SAAO,QAAQ,SAAS;AAC1B;AAEO,SAAS,eAAkB,UAAkB,IAA0C;AAC5F,QAAM,SAAS,QAAQ,SAAS;AAChC,MAAI,CAAC,OAAQ,QAAO,GAAG;AACvB,SAAO,QAAQ,IAAI,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,EAAE;AAC3D;","names":[]}