@cloudgrid-io/mcp 0.21.2 → 0.21.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {

package/src/web-identity.js

@@ -5,6 +5,19 @@ function isTokenExpired(jwt, now) {
   return decodeJwt(jwt).exp * 1000 <= now();
 }
 
+// Is this token a credential the server can actually authenticate with right
+// now? A present, decodable token whose numeric `exp` is still in the future.
+// Anything else — absent, undecodable, or lacking a real expiry — is unusable.
+// Unlike isTokenExpired (which treats an undecodable token as "not expired"
+// because NaN <= now is false), this answers the transport guard's question,
+// where a token we cannot vouch for must not pass.
+function isCredentialUsable(jwt, now) {
+  if (!jwt) return false;
+  const { exp } = decodeJwt(jwt);
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+  return exp * 1000 > now();
+}
+
 export function createWebIdentity({
   initialTransportToken = null,
   now = () => Date.now(),
@@ -33,6 +46,15 @@ export function createWebIdentity({
       return { identityChanged };
     },
 
+    // Whether the session currently holds any credential the server can use:
+    // the effective token (explicit login shadowing transport per #279) is
+    // present, decodable, and unexpired. The transport guard asks this before
+    // accepting a request, so an expired/invalid Bearer with no valid explicit
+    // login is challenged rather than degrading to an in-band login link.
+    hasUsableCredential() {
+      return isCredentialUsable(effectiveToken(), now);
+    },
+
     async getToken() {
       const jwt = effectiveToken();
       return isTokenExpired(jwt, now) ? null : jwt;

package/src/web.js

@@ -55,8 +55,9 @@ function bearerOf(req) {
 
 // A web session: identity lives in memory for the session's lifetime only. The
 // session id doubles as the stable, opaque end-user id for the trusted-server cap.
-function makeWebContext(sessionId, initialTransportToken = null) {
-  const identity = createWebIdentity({ initialTransportToken });
+// The identity is built by the caller so the transport auth guard can consult it
+// (hasUsableCredential) before the session is wired up.
+function makeWebContext(sessionId, identity) {
   return {
     edition: "web",
     state: { pendingLoginCode: null, lastAnonClaim: null, lastDrop: null, anonCookie: null },
@@ -89,6 +90,19 @@ mountOAuth(app, PUBLIC_BASE, { requireAuth: REQUIRE_AUTH });
 const transports = Object.create(null);
 const sessionContexts = Object.create(null);
 
+// Per the MCP authorization spec, a resource server that receives no usable
+// credential answers 401 with a Bearer WWW-Authenticate challenge — the signal
+// Claude web needs to re-run OAuth and render its native login UI. Reused for
+// the missing, expired, and invalid transport-token cases.
+function sendAuthChallenge(res) {
+  res.setHeader("WWW-Authenticate", bearerChallenge(PUBLIC_BASE));
+  res.status(401).json({
+    jsonrpc: "2.0",
+    error: { code: -32001, message: "Authorization required. Complete the OAuth connect." },
+    id: null,
+  });
+}
+
 function captureRequestIdentity(sessionId, jwt) {
   if (!jwt) return;
   const ctx = sessionContexts[sessionId];
@@ -107,17 +121,22 @@ app.post("/mcp", async (req, res) => {
   const jwt = bearerOf(req);
 
   if (REQUIRE_AUTH && !jwt) {
-    res.setHeader("WWW-Authenticate", bearerChallenge(PUBLIC_BASE));
-    res.status(401).json({
-      jsonrpc: "2.0",
-      error: { code: -32001, message: "Authorization required. Complete the OAuth connect." },
-      id: null,
-    });
+    sendAuthChallenge(res);
     return;
   }
 
   if (transport) {
     captureRequestIdentity(sessionId, jwt);
+    // An expired/invalid transport token with no valid explicit login means the
+    // session holds no usable credential — challenge so the client re-runs OAuth,
+    // rather than proceeding and degrading to an in-band copy-paste login link
+    // (#286). Consult the identity, not the raw Bearer: an explicit in-session
+    // login stays authoritative over an expired transport token (#279/#280).
+    const ctx = sessionContexts[sessionId];
+    if (REQUIRE_AUTH && ctx && !ctx.identity.hasUsableCredential()) {
+      sendAuthChallenge(res);
+      return;
+    }
     await transport.handleRequest(req, res, req.body);
     return;
   }
@@ -135,6 +154,13 @@ app.post("/mcp", async (req, res) => {
   // id up front so it is also the trusted-server end-user id. (Distinct name from
   // the incoming `sessionId` header above.)
   const newSessionId = randomUUID();
+  const identity = createWebIdentity({ initialTransportToken: jwt });
+  // A brand-new session has no explicit login yet, so the transport Bearer is the
+  // only possible credential — challenge if it is expired or undecodable (#286).
+  if (REQUIRE_AUTH && !identity.hasUsableCredential()) {
+    sendAuthChallenge(res);
+    return;
+  }
   transport = new StreamableHTTPServerTransport({
     sessionIdGenerator: () => newSessionId,
     onsessioninitialized: (sid) => {
@@ -151,7 +177,7 @@ app.post("/mcp", async (req, res) => {
     }
   };
   const server = new McpServer({ name: "cloudgrid-mcp-web", version }, { instructions: INSTRUCTIONS_WEB });
-  const webCtx = makeWebContext(newSessionId, jwt);
+  const webCtx = makeWebContext(newSessionId, identity);
   sessionContexts[newSessionId] = webCtx;
   // QA session log for this MCP session (dark by default). Keyed by the session
   // id — the host connection boundary. No seed user_request here: current hosts