@frontmcp/plugin-approval 1.7.2 → 1.8.0

package/esm/index.mjs

@@ -1035,14 +1035,19 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
     if (!approval.expiresAt) return false;
     return Date.now() > approval.expiresAt;
   }
+  /**
+   * The context this call is running in, as established by the SESSION (GHSA-r848-p7wf-96rc).
+   *
+   * Deliberately ignores `toolContext.input.context`. The only consumer of this value is
+   * `isPreApprovedContext`, which skips the approval prompt outright, so reading it from the
+   * arguments of the call being gated let a caller name its own pre-approved context and walk
+   * straight past the gate. Only `authInfo.extra.approvalContext`, which the server sets
+   * while authenticating, can say what context a call belongs to.
+   */
   getCurrentContext(flowCtx) {
-    const { toolContext } = flowCtx.state;
-    const ctx = toolContext?.tryGetContext?.();
-    const inputContext = toolContext?.input?.["context"];
-    const contextFromInput = this.isApprovalContext(inputContext) ? inputContext : void 0;
+    const ctx = flowCtx.state.toolContext?.tryGetContext?.();
     const sessionContext = ctx?.authInfo?.extra?.["approvalContext"];
-    const contextFromSession = this.isApprovalContext(sessionContext) ? sessionContext : void 0;
-    return contextFromInput ?? contextFromSession;
+    return this.isApprovalContext(sessionContext) ? sessionContext : void 0;
   }
   isApprovalContext(value) {
     return typeof value === "object" && value !== null && "type" in value && "identifier" in value && typeof value.type === "string" && typeof value.identifier === "string";

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2",
-    "@frontmcp/utils": "1.7.2",
+    "@frontmcp/sdk": "1.8.0",
+    "@frontmcp/utils": "1.8.0",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/lazy-zod": "1.8.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {

package/hooks/approval-check.hook.d.ts

@@ -16,6 +16,15 @@ export default class ApprovalCheckPlugin extends DynamicPlugin<Record<string, ne
     checkApproval(flowCtx: FlowCtxOf<'tools:call-tool'>): Promise<void>;
     private resolveApprovalConfig;
     private isExpired;
+    /**
+     * The context this call is running in, as established by the SESSION (GHSA-r848-p7wf-96rc).
+     *
+     * Deliberately ignores `toolContext.input.context`. The only consumer of this value is
+     * `isPreApprovedContext`, which skips the approval prompt outright, so reading it from the
+     * arguments of the call being gated let a caller name its own pre-approved context and walk
+     * straight past the gate. Only `authInfo.extra.approvalContext`, which the server sets
+     * while authenticating, can say what context a call belongs to.
+     */
     private getCurrentContext;
     private isApprovalContext;
     private getStringExtra;

package/hooks/approval-check.hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-check.hook.d.ts","sourceRoot":"","sources":["../../src/hooks/approval-check.hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAoB,SAAS,EAAE,MAAM,eAAe,CAAC;AAO3E;;;;GAIG;AAKH,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnF;;OAEG;IAEG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;IAwDzD,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,oBAAoB;YAUd,sBAAsB;CAsBrC"}
+{"version":3,"file":"approval-check.hook.d.ts","sourceRoot":"","sources":["../../src/hooks/approval-check.hook.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAoB,MAAM,eAAe,CAAC;AAa3E;;;;GAIG;AAKH,MAAM,CAAC,OAAO,OAAO,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnF;;OAEG;IAEG,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAAC;IAwDzD,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAOzB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,cAAc;IAMtB,OAAO,CAAC,oBAAoB;YAUd,sBAAsB;CAsBrC"}

package/index.js

@@ -1085,14 +1085,19 @@ var ApprovalCheckPlugin = class extends import_sdk4.DynamicPlugin {
     if (!approval.expiresAt) return false;
     return Date.now() > approval.expiresAt;
   }
+  /**
+   * The context this call is running in, as established by the SESSION (GHSA-r848-p7wf-96rc).
+   *
+   * Deliberately ignores `toolContext.input.context`. The only consumer of this value is
+   * `isPreApprovedContext`, which skips the approval prompt outright, so reading it from the
+   * arguments of the call being gated let a caller name its own pre-approved context and walk
+   * straight past the gate. Only `authInfo.extra.approvalContext`, which the server sets
+   * while authenticating, can say what context a call belongs to.
+   */
   getCurrentContext(flowCtx) {
-    const { toolContext } = flowCtx.state;
-    const ctx = toolContext?.tryGetContext?.();
-    const inputContext = toolContext?.input?.["context"];
-    const contextFromInput = this.isApprovalContext(inputContext) ? inputContext : void 0;
+    const ctx = flowCtx.state.toolContext?.tryGetContext?.();
     const sessionContext = ctx?.authInfo?.extra?.["approvalContext"];
-    const contextFromSession = this.isApprovalContext(sessionContext) ? sessionContext : void 0;
-    return contextFromInput ?? contextFromSession;
+    return this.isApprovalContext(sessionContext) ? sessionContext : void 0;
   }
   isApprovalContext(value) {
     return typeof value === "object" && value !== null && "type" in value && "identifier" in value && typeof value.type === "string" && typeof value.identifier === "string";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/plugin-approval",
-  "version": "1.7.2",
+  "version": "1.8.0",
   "description": "Approval plugin for FrontMCP - tool authorization workflow with PKCE webhook security",
   "author": "AgentFront <info@agentfront.dev>",
   "license": "Apache-2.0",
@@ -49,13 +49,13 @@
     }
   },
   "dependencies": {
-    "@frontmcp/sdk": "1.7.2",
-    "@frontmcp/utils": "1.7.2",
+    "@frontmcp/sdk": "1.8.0",
+    "@frontmcp/utils": "1.8.0",
     "ioredis": "^5.8.0",
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.7.2",
+    "@frontmcp/lazy-zod": "1.8.0",
     "@vercel/kv": "^2.0.0 || ^3.0.0"
   },
   "peerDependenciesMeta": {