@enfyra/mcp-server 0.0.73 → 0.0.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enfyra/mcp-server",
-  "version": "0.0.73",
+  "version": "0.0.75",
   "description": "MCP server for Enfyra - manage your Enfyra instance via Claude Code",
   "type": "module",
   "license": "MIT",

package/src/lib/mcp-instructions.js

@@ -135,7 +135,7 @@ export function buildMcpServerInstructions(apiBaseUrl) {
     '- Each route has **publishedMethods** (which HTTP verbs are “public”) and **routePermissions** (roles/users for protected access).',
     '- If the **current request method** is listed in **publishedMethods** for that route, the server allows the call **without** a Bearer token (`RoleGuard`).',
     '- Otherwise the client must send an **Authorization** header with **Bearer** JWT from login. Then the user must satisfy **routePermissions** (unless root admin).',
-    '- Owner-scoped GET handlers must preserve caller filters and merge the owner scope for normal users, while root admin operational views may bypass that owner scope with `@USER.isRootAdmin` when the product explicitly needs global admin visibility.',
+    '- Owner-scoped GET handlers must preserve caller filters and merge the owner scope for normal users, while root admin operational views may bypass only the owner scope with `@USER.isRootAdmin` and must keep caller filters intact. Never replace `@QUERY.filter` with `{}` for root admins; doing so breaks detail reads, pagination, and `debugMode=true` explain checks.',
     '- MCP tools that use `fetchAPI` authenticate with the configured `ENFYRA_API_TOKEN`. Explain to users that **direct HTTP** calls need a Bearer token unless the route/method is published.',
     '',
     '### Post-hooks (REST)',

package/src/lib/table-tools.js

@@ -16,8 +16,11 @@ const FORBIDDEN_RELATION_KEYS = [
   'fkCol',
   'fkColumn',
   'foreignKeyColumn',
+  'referencedColumn',
+  'constraintName',
   'sourceColumn',
   'targetColumn',
+  'junctionTableName',
   'junctionSourceColumn',
   'junctionTargetColumn',
 ];
@@ -144,6 +147,23 @@ export function normalizeRelationForTablePatch(relation) {
   return normalized;
 }
 
+export function sanitizeExistingRelationForTablePatch(relation) {
+  const {
+    fkCol,
+    fkColumn,
+    foreignKeyColumn,
+    referencedColumn,
+    constraintName,
+    sourceColumn,
+    targetColumn,
+    junctionTableName,
+    junctionSourceColumn,
+    junctionTargetColumn,
+    ...rest
+  } = relation;
+  return normalizeRelationForTablePatch(rest);
+}
+
 export function resolveRelationTargetsFromMetadata(metadata, relations) {
   return relations.map((relation) => {
     const targetTable = relation.targetTable;
@@ -210,7 +230,7 @@ async function verifyRelationCascade(ENFYRA_API_URL, tableId, beforeIds, {
   propertyName,
 }) {
   const tableData = await fetchTableWithDetails(ENFYRA_API_URL, tableId);
-  const afterRelations = (tableData.relations || []).map(normalizeRelationForTablePatch);
+  const afterRelations = (tableData.relations || []).map(sanitizeExistingRelationForTablePatch);
   const afterIds = afterRelations.map((relation) => String(getId(relation))).filter((id) => id !== 'null');
   const excludedIds = action === 'delete' ? [relationId] : [];
   const missingIds = getMissingIds(beforeIds, afterIds, excludedIds);
@@ -293,7 +313,7 @@ export function registerTableTools(server, ENFYRA_API_URL) {
     if (!tableData) {
       return { content: [{ type: 'text', text: `Error: Table with ID ${sourceTableId} not found.` }] };
     }
-    const existingRelations = (tableData.relations || []).map(normalizeRelationForTablePatch);
+    const existingRelations = (tableData.relations || []).map(sanitizeExistingRelationForTablePatch);
     const beforeIds = existingRelations.map((relation) => String(getId(relation))).filter((id) => id !== 'null');
     const newRelation = { targetTable: targetTableId, type, propertyName };
     if (inversePropertyName !== undefined) newRelation.inversePropertyName = inversePropertyName || null;
@@ -361,7 +381,7 @@ export function registerTableTools(server, ENFYRA_API_URL) {
       return { content: [{ type: 'text', text: `Error: Table with ID ${tableId} not found.` }] };
     }
 
-    const existingRelations = (tableData.relations || []).map(normalizeRelationForTablePatch);
+    const existingRelations = (tableData.relations || []).map(sanitizeExistingRelationForTablePatch);
     const beforeIds = existingRelations.map((relation) => String(getId(relation))).filter((id) => id !== 'null');
     if (!beforeIds.includes(String(relationId))) {
       throw new Error(`Relation ${relationId} was not found on table ${tableId}; refusing schema cascade patch.`);