@databrainhq/mcp-server 0.3.0-rc.1 → 0.3.0-rc.2

package/dist/apps/server.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   createChartAppServer
-} from "../chunk-NDVW3ZSJ.js";
-import "../chunk-7DS7OLWP.js";
+} from "../chunk-SG7F7PRY.js";
+import "../chunk-3AFT7S6E.js";
 export {
   createChartAppServer
 };

package/dist/apps/stdio.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   loadConfig
-} from "../chunk-RF3HTNO7.js";
+} from "../chunk-4OFVDEFU.js";
 import {
   createChartAppServer
-} from "../chunk-NDVW3ZSJ.js";
-import "../chunk-7DS7OLWP.js";
+} from "../chunk-SG7F7PRY.js";
+import "../chunk-3AFT7S6E.js";
 
 // src/apps/stdio.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{chunk-7DS7OLWP.js → chunk-3AFT7S6E.js}

@@ -24,7 +24,7 @@ var logger = {
 // package.json
 var package_default = {
   name: "@databrainhq/mcp-server",
-  version: "0.3.0-rc.1",
+  version: "0.3.0-rc.2",
   description: "MCP server for Databrain embedded analytics - connect databases, create datamarts, configure embeds, and generate frontend code",
   type: "module",
   bin: {
@@ -1672,6 +1672,54 @@ var WidgetService = class {
       }
     };
   }
+  /**
+   * Read-only sibling of `ensureTenantDashboardScope`.
+   *
+   * The tenant gate above exists to stop a WRITE landing on the data-app
+   * dashboard when the caller meant a tenant's copy, so it insists the
+   * tenant-scoped embed lookup returns the target. A data-app embed has no
+   * tenant row, `listEmbeds(dataAppName, clientId)` answers with an empty list,
+   * and the render path was denied before it ever reached the backend. That is
+   * the wrong trade for a read: the chart route re-derives everything from the
+   * guest token it is handed (embed inside the token's data app, `allowedEmbeds`,
+   * the tenancy subset for the client, and per-metric client visibility), so the
+   * only thing this check can usefully add is refusing another tenant's embed.
+   */
+  async ensureReadableDashboardScope(params) {
+    const clientId = params.clientId.trim();
+    if (!clientId) {
+      return {
+        ok: false,
+        error: "`clientId` cannot be empty. Pick a tenant/client first."
+      };
+    }
+    let ctx;
+    try {
+      ctx = await this.resolveEmbedContext(params.embedId);
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+    if (ctx.embedClientId && ctx.embedClientId !== clientId) {
+      return {
+        ok: false,
+        error: `Embed "${params.embedId}" belongs to another client. Pass the \`clientId\` the embed was created for.`
+      };
+    }
+    if (!ctx.embedClientId && ctx.externalDashboardCreatedBy && ctx.externalDashboardCreatedBy !== clientId) {
+      return {
+        ok: false,
+        error: `Dashboard behind embed "${params.embedId}" belongs to another client. Pass the \`clientId\` the dashboard was created for.`
+      };
+    }
+    return {
+      ok: true,
+      value: {
+        embedId: params.embedId,
+        clientId,
+        dataAppName: ctx.dataAppName || params.dataAppName || null
+      }
+    };
+  }
   /**
    * Resolve a datasource for a widget. Priority:
    *   1. Explicit integrationId + integrationName (fast path).
@@ -1857,6 +1905,7 @@ Do not guess between the two \u2014 wait for the user to choose.`
       dataAppName,
       externalDashboardId,
       dashboardId,
+      embedClientId: isNonEmptyString3(exact.clientId) && exact.clientId || (metadata && isNonEmptyString3(metadata.clientId) ? metadata.clientId : null),
       externalDashboardCreatedBy: (externalDashboard && isNonEmptyString3(externalDashboard.createdBy) ? externalDashboard.createdBy : null) || (isNonEmptyString3(exact.createdBy) ? exact.createdBy : null) || (metadata && isNonEmptyString3(metadata.createdBy) ? metadata.createdBy : null) || (isNonEmptyString3(exact.clientId) ? exact.clientId : null)
     };
   }
@@ -6015,6 +6064,12 @@ function registerGetSemanticLayerGenerationStatus(server, client) {
 
 // src/tools/widgets/list-widgets.ts
 import { z as z29 } from "zod";
+function widgetReferenceId(widget) {
+  for (const candidate of [widget.externalMetricId, widget.id, widget._id, widget.metricId]) {
+    if (typeof candidate === "string" && candidate.trim().length > 0) return candidate.trim();
+  }
+  return void 0;
+}
 function registerListWidgets(server, client) {
   const services = createServiceBundle(client);
   const tool = server.tool(
@@ -6043,17 +6098,18 @@ function registerListWidgets(server, client) {
         );
         if (hasChartApps(server)) {
           const visible = (Array.isArray(widgets) ? widgets : []).slice(0, 50);
-          return chartResult(`${visible.length} widgets available in the first dashboard page.`, {
+          const references = visible.flatMap((w) => {
+            const widgetId = widgetReferenceId(w);
+            return widgetId ? [{
+              name: typeof w.name === "string" ? w.name.slice(0, 500) : "Untitled widget",
+              reference: { widgetId, embedId, clientId: params.clientId }
+            }] : [];
+          });
+          return chartResult(`${references.length} widgets available in the first dashboard page.`, {
             kind: "dashboard",
             title: "Dashboard",
             rows: [],
-            widgets: visible.flatMap((w) => {
-              const widgetId = w.externalMetricId || w.id || w._id;
-              return typeof widgetId === "string" ? [{
-                name: typeof w.name === "string" ? w.name.slice(0, 500) : "Untitled widget",
-                reference: { widgetId, embedId, clientId: params.clientId }
-              }] : [];
-            }),
+            widgets: references,
             description: Array.isArray(widgets) && widgets.length > 50 ? "Showing the first 50 widgets." : ""
           });
         }
@@ -10395,4 +10451,4 @@ export {
   registerAllResources,
   registerAllPrompts
 };
-//# sourceMappingURL=chunk-7DS7OLWP.js.map
+//# sourceMappingURL=chunk-3AFT7S6E.js.map