@cloudgrid-io/mcp 0.21.3 → 0.21.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudgrid-io/mcp",
-  "version": "0.21.3",
+  "version": "0.21.5",
   "description": "MCP access to CloudGrid — the live runtime environment where the user's apps run WITH the infrastructure they need out of the box: managed MongoDB, Redis (cache/queues/pub-sub), a pgvector store, persistent disk, and built-in AI with no API keys, in any language or stack, no Docker or Kubernetes to manage. Brainstorm, build, plug, and improve apps, games, dashboards, and tools; instant single-page publishes and full runtime-app deploys with a live URL — for developers and non-technical users. Three editions: local stdio (full toolset), hosted web (light, CLI-free), and a public docs-search server.",
   "type": "module",
   "bin": {
@@ -65,7 +65,8 @@
     "test:pull-grid": "node test/pull-grid-param.test.mjs",
     "test:pull-output-schema": "node test/pull-output-schema.test.mjs",
     "test:web-identity": "node --test test/web-identity.test.mjs",
-    "test:web-auth-integration": "node --test test/web-auth-integration.test.mjs"
+    "test:web-auth-integration": "node --test test/web-auth-integration.test.mjs",
+    "test:web-restart-recovery": "node --test test/web-restart-recovery.test.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",

package/src/web-identity.js

@@ -5,6 +5,19 @@ function isTokenExpired(jwt, now) {
   return decodeJwt(jwt).exp * 1000 <= now();
 }
 
+// Is this token a credential the server can actually authenticate with right
+// now? A present, decodable token whose numeric `exp` is still in the future.
+// Anything else — absent, undecodable, or lacking a real expiry — is unusable.
+// Unlike isTokenExpired (which treats an undecodable token as "not expired"
+// because NaN <= now is false), this answers the transport guard's question,
+// where a token we cannot vouch for must not pass.
+function isCredentialUsable(jwt, now) {
+  if (!jwt) return false;
+  const { exp } = decodeJwt(jwt);
+  if (typeof exp !== "number" || !Number.isFinite(exp)) return false;
+  return exp * 1000 > now();
+}
+
 export function createWebIdentity({
   initialTransportToken = null,
   now = () => Date.now(),
@@ -33,6 +46,15 @@ export function createWebIdentity({
       return { identityChanged };
     },
 
+    // Whether the session currently holds any credential the server can use:
+    // the effective token (explicit login shadowing transport per #279) is
+    // present, decodable, and unexpired. The transport guard asks this before
+    // accepting a request, so an expired/invalid Bearer with no valid explicit
+    // login is challenged rather than degrading to an in-band login link.
+    hasUsableCredential() {
+      return isCredentialUsable(effectiveToken(), now);
+    },
+
     async getToken() {
       const jwt = effectiveToken();
       return isTokenExpired(jwt, now) ? null : jwt;

package/src/web.js

@@ -22,7 +22,11 @@ import { randomUUID } from "node:crypto";
 import express from "express";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import {
+  isInitializeRequest,
+  SUPPORTED_PROTOCOL_VERSIONS,
+  LATEST_PROTOCOL_VERSION,
+} from "@modelcontextprotocol/sdk/types.js";
 import { registerTools } from "./tools.js";
 import { mountOAuth, bearerChallenge } from "./oauth.js";
 import { mountLanding } from "./landing.js";
@@ -55,8 +59,9 @@ function bearerOf(req) {
 
 // A web session: identity lives in memory for the session's lifetime only. The
 // session id doubles as the stable, opaque end-user id for the trusted-server cap.
-function makeWebContext(sessionId, initialTransportToken = null) {
-  const identity = createWebIdentity({ initialTransportToken });
+// The identity carries the request's transport token; auth is enforced in-band by
+// the tool layer (needs_auth via grid_login / grid_plug), not by a transport gate.
+function makeWebContext(sessionId, identity) {
   return {
     edition: "web",
     state: { pendingLoginCode: null, lastAnonClaim: null, lastDrop: null, anonCookie: null },
@@ -89,6 +94,19 @@ mountOAuth(app, PUBLIC_BASE, { requireAuth: REQUIRE_AUTH });
 const transports = Object.create(null);
 const sessionContexts = Object.create(null);
 
+// Per the MCP authorization spec, a resource server that receives no usable
+// credential answers 401 with a Bearer WWW-Authenticate challenge — the signal
+// Claude web needs to re-run OAuth and render its native login UI. Reused for
+// the missing, expired, and invalid transport-token cases.
+function sendAuthChallenge(res) {
+  res.setHeader("WWW-Authenticate", bearerChallenge(PUBLIC_BASE));
+  res.status(401).json({
+    jsonrpc: "2.0",
+    error: { code: -32001, message: "Authorization required. Complete the OAuth connect." },
+    id: null,
+  });
+}
+
 function captureRequestIdentity(sessionId, jwt) {
   if (!jwt) return;
   const ctx = sessionContexts[sessionId];
@@ -101,42 +119,15 @@ function captureRequestIdentity(sessionId, jwt) {
   }
 }
 
-app.post("/mcp", async (req, res) => {
-  const sessionId = req.headers["mcp-session-id"];
-  let transport = sessionId ? transports[sessionId] : undefined;
-  const jwt = bearerOf(req);
-
-  if (REQUIRE_AUTH && !jwt) {
-    res.setHeader("WWW-Authenticate", bearerChallenge(PUBLIC_BASE));
-    res.status(401).json({
-      jsonrpc: "2.0",
-      error: { code: -32001, message: "Authorization required. Complete the OAuth connect." },
-      id: null,
-    });
-    return;
-  }
-
-  if (transport) {
-    captureRequestIdentity(sessionId, jwt);
-    await transport.handleRequest(req, res, req.body);
-    return;
-  }
-
-  if (sessionId || !isInitializeRequest(req.body)) {
-    res.status(400).json({
-      jsonrpc: "2.0",
-      error: { code: -32000, message: "No valid session. Send an initialize request first." },
-      id: null,
-    });
-    return;
-  }
-
-  // New session: fresh server + per-session identity context. Generate the session
-  // id up front so it is also the trusted-server end-user id. (Distinct name from
-  // the incoming `sessionId` header above.)
-  const newSessionId = randomUUID();
-  transport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: () => newSessionId,
+// Build a fresh MCP session — server + transport + per-session identity context —
+// keyed by `sessionId`. `sessionId` is also the trusted-server end-user id and,
+// for a rehydrated (restart-evicted) session, the id the client keeps presenting.
+// Identity derives ONLY from the credential passed here (`jwt`), never from
+// anything remembered about the id: a session id is not proof of identity.
+async function buildSession(sessionId, jwt) {
+  const identity = createWebIdentity({ initialTransportToken: jwt });
+  const transport = new StreamableHTTPServerTransport({
+    sessionIdGenerator: () => sessionId,
     onsessioninitialized: (sid) => {
       transports[sid] = transport;
     },
@@ -151,17 +142,17 @@ app.post("/mcp", async (req, res) => {
     }
   };
   const server = new McpServer({ name: "cloudgrid-mcp-web", version }, { instructions: INSTRUCTIONS_WEB });
-  const webCtx = makeWebContext(newSessionId, jwt);
-  sessionContexts[newSessionId] = webCtx;
+  const webCtx = makeWebContext(sessionId, identity);
+  sessionContexts[sessionId] = webCtx;
   // QA session log for this MCP session (dark by default). Keyed by the session
   // id — the host connection boundary. No seed user_request here: current hosts
   // don't forward the first message. The model-as-courier path fills it instead —
   // grid_plug's user_request arg lifts the ask into the log (setUserRequest);
   // absent that, the log records the explicit not-provided line.
-  webCtx.sessionId = newSessionId;
+  webCtx.sessionId = sessionId;
   webCtx.logger = createSessionLogger({
     transport: "hosted",
-    sessionId: newSessionId,
+    sessionId,
     sink: createSink(process.env),
     ctx: webCtx,
   });
@@ -177,6 +168,136 @@ app.post("/mcp", async (req, res) => {
     }
   };
   await server.connect(transport);
+  return { transport, identity };
+}
+
+// Drive an in-process MCP initialize so a freshly-built transport is usable
+// WITHOUT the client sending its own initialize. This is the restart-recovery
+// path: a client whose session was evicted by a pod restart keeps presenting the
+// same stale mcp-session-id on ordinary tool calls and never re-initializes on
+// its own (Claude web does not act on the transport's 400 — see #292). The SDK's
+// StreamableHTTPServerTransport rejects any non-initialize request until it has
+// seen an initialize ("Bad Request: Server not initialized"), so we feed it a
+// synthetic initialize here — adopting the stale id via sessionIdGenerator — then
+// serve the real request on the same session. Verified against the SDK: this sets
+// _initialized, adopts the session id, and fires onsessioninitialized so the
+// transport registers itself for reuse by the client's subsequent requests.
+async function primeSession(transport, req) {
+  const wst = transport._webStandardTransport;
+  if (!wst || typeof wst.handleRequest !== "function") {
+    throw new Error("cannot rehydrate session: transport internals unavailable");
+  }
+  const proposed = req.headers["mcp-protocol-version"];
+  const protocolVersion =
+    typeof proposed === "string" && SUPPORTED_PROTOCOL_VERSIONS.includes(proposed)
+      ? proposed
+      : LATEST_PROTOCOL_VERSION;
+  const initBody = {
+    jsonrpc: "2.0",
+    id: "cg-rehydrate-init",
+    method: "initialize",
+    params: {
+      protocolVersion,
+      capabilities: {},
+      clientInfo: { name: "cloudgrid-mcp-rehydrate", version },
+    },
+  };
+  const initReq = new Request(`${PUBLIC_BASE}/mcp`, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json, text/event-stream" },
+  });
+  const initRes = await wst.handleRequest(initReq, { parsedBody: initBody });
+  // Drain the synthetic initialize's SSE response so its stream closes and no
+  // keep-alive timer leaks. The initialize result itself is discarded — the
+  // client never sees it; it only ever sees the response to its real request.
+  try { await initRes.text(); } catch { /* the init result is discarded either way */ }
+}
+
+app.post("/mcp", async (req, res) => {
+  const sessionId = req.headers["mcp-session-id"];
+  let transport = sessionId ? transports[sessionId] : undefined;
+  const jwt = bearerOf(req);
+
+  if (REQUIRE_AUTH && !jwt) {
+    sendAuthChallenge(res);
+    return;
+  }
+
+  if (transport) {
+    // Capture the request's transport token into the session identity — #279: an
+    // explicit in-session login stays authoritative over an expired transport
+    // token. Do NOT gate on expiry here. #288 added a transport-level 401 on an
+    // expired/invalid Bearer (the "#286 challenge"); it shipped in 0.21.3/0.21.4,
+    // was pulled from production (manifests re-pinned to 0.21.2) hours later, and
+    // #286 is closed not-planned. Auth on this connector is IN-BAND via grid_login
+    // / grid_plug (2026-08-23 founder decision), so a transport 401 on expiry is
+    // wrong by design — it bricks the client with grid_login behind the same 401.
+    // An expired-but-present Bearer must reach the tool layer, where the needs_auth
+    // ask is the recovery path. The only auth gate is the missing-Bearer guard at
+    // the top of this handler (the deployed v0.21.2 posture).
+    captureRequestIdentity(sessionId, jwt);
+    await transport.handleRequest(req, res, req.body);
+    return;
+  }
+
+  const isInit = isInitializeRequest(req.body);
+
+  // A brand-new connection with no session id that is NOT an initialize is a real
+  // protocol error — there is nothing to recover.
+  if (!sessionId && !isInit) {
+    res.status(400).json({
+      jsonrpc: "2.0",
+      error: { code: -32000, message: "No valid session. Send an initialize request first." },
+      id: null,
+    });
+    return;
+  }
+
+  if (isInit) {
+    // A genuine new session — mint a fresh id. The only auth gate is the top-of-
+    // handler missing-Bearer guard (the deployed v0.21.2 posture); the #288
+    // expired-Bearer transport 401 is reverted (see the transport-present block
+    // above), so an expired-but-present Bearer proceeds to the tool layer where
+    // the in-band needs_auth ask lives, rather than being challenged.
+    const newSessionId = randomUUID();
+    ({ transport } = await buildSession(newSessionId, jwt));
+    await transport.handleRequest(req, res, req.body);
+    return;
+  }
+
+  // A stale session id the process no longer knows — a non-initialize call whose
+  // session was evicted by a pod restart (#292). Rebuild ON THE SAME id the client
+  // keeps presenting, so it recovers without reconnecting. Identity comes ONLY from
+  // this request's Bearer; the stale id carries no remembered identity, and a
+  // rebuilt session legitimately loses the prior in-memory explicit-login override
+  // — degrading to a fresh grid_login, never silently reusing a login (#279/#280).
+  //
+  // No auth gate beyond the top-of-handler missing-Bearer guard (the deployed
+  // v0.21.2 posture): auth on the connected edge is IN-BAND via grid_login /
+  // grid_plug (2026-08-23 founder decision), so an expired-but-present Bearer — a
+  // connected session after a restart — must rebuild and reach the tool layer where
+  // the needs_auth ask is the recovery path, NOT be challenged with grid_login
+  // stuck behind the same 401 (the #286 brick, on the rebuild path). Gating on
+  // expiry (hasUsableCredential) here is exactly what #288 got wrong and was pulled
+  // from production for.
+  ({ transport } = await buildSession(sessionId, jwt));
+  // Rehydrate the evicted session. If priming fails (e.g. an SDK internal moved
+  // out from under us), tear the half-built session down and fall back to the
+  // original 400 rather than leaking a broken session or hanging the request —
+  // a re-initialize still recovers the client.
+  try {
+    await primeSession(transport, req);
+  } catch {
+    try { await transport.close(); } catch { /* best effort */ }
+    delete transports[sessionId];
+    delete sessionContexts[sessionId];
+    res.status(400).json({
+      jsonrpc: "2.0",
+      error: { code: -32000, message: "No valid session. Send an initialize request first." },
+      id: null,
+    });
+    return;
+  }
   await transport.handleRequest(req, res, req.body);
 });