npm - @fruggr/zendesk-mcp-server - Versions diffs - 2.1.0 → 2.2.0 - Mend

@fruggr/zendesk-mcp-server 2.1.0 → 2.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/README.md CHANGED Viewed

@@ -224,8 +224,11 @@ file per subdomain in your OS config dir —
 elsewhere; override the path with `ZENDESK_TOKEN_FILE`). It is reused across restarts, so you don't
 re-authenticate every time the MCP client respawns the server. If the Zendesk
 OAuth client has token expiration enabled, the stored refresh token is used to
-renew access silently; only an expired/invalid refresh token triggers a new
-browser sign-in.
+renew access silently — **proactively** (the token is refreshed before use when
+it's expired, near expiry, or of unknown age, so the first request after an
+overnight gap never hits a visible auth error) and **periodically** in the
+background so a long-lived, idle session never serves a stale token. Only an
+expired/invalid refresh token triggers a new browser sign-in.
 > **Port conflict?** If port `27439` is already in use the first tool call returns
 > a clear error telling you to set `ZENDESK_OAUTH_CALLBACK_PORT` (or

package/dist/index.js CHANGED Viewed

@@ -221,7 +221,7 @@ const startBrowserAuth = (config, logger = silentLogger) => {
 				const tokenData = await tokenResponse.json();
 				logger.info("oauth_authenticated");
 				res.writeHead(200, { "Content-Type": "text/html" });
-				res.end("<html><body><h1>Authentication successful!</h1><p>You can close this tab and return to Claude Code.</p><p>This tab will auto-close in <span id=\"t\">10</span>s.</p><script>let n=10;const el=document.getElementById(\"t\");const i=setInterval(()=>{n--;el.textContent=n;if(n<=0){clearInterval(i);window.close();}},1000);<\/script></body></html>");
+				res.end("<html><body><h1>Authentication successful!</h1><p>You can close this tab and return to your AI assistant.</p><p>This tab will auto-close in <span id=\"t\">10</span>s.</p><script>let n=10;const el=document.getElementById(\"t\");const i=setInterval(()=>{n--;el.textContent=n;if(n<=0){clearInterval(i);window.close();}},1000);<\/script></body></html>");
 				clearTimeout(authTimeout);
 				callbackServer.close();
 				resolveToken(tokenData);
@@ -432,6 +432,7 @@ const clearToken = (path, logger = silentLogger) => {
 //#endregion
 //#region src/auth/token-store.ts
 const EXPIRY_SKEW_MS = 6e4;
+const SCHEDULED_REFRESH_MS = 14400 * 1e3;
 const createAuthRequiredError = (authorizeUrl) => Object.assign(/* @__PURE__ */ new Error("Zendesk authentication required. A browser window should have opened for you to sign in. If it did not, open this URL in your browser, then retry your request:\n" + authorizeUrl), {
 	name: "AuthRequiredError",
 	authorizeUrl
@@ -444,16 +445,18 @@ const createTokenStore = (config, logger = silentLogger) => {
 	let authorizeUrl;
 	let starting;
 	let refreshing;
+	let probedUnknownExpiry = false;
 	const persist = (t) => saveToken(tokenPath, t, logger);
 	const setToken = (accessToken, refreshToken) => {
 		token = {
 			accessToken,
 			refreshToken
 		};
+		probedUnknownExpiry = false;
 		persist(token);
 	};
-	const isExpired = (t) => typeof t.expiresAt === "number" && Date.now() >= t.expiresAt - EXPIRY_SKEW_MS;
-	const tryRefresh = async (current) => {
+	const needsRefresh = (t) => typeof t.expiresAt === "number" ? Date.now() >= t.expiresAt - EXPIRY_SKEW_MS : t.refreshToken !== void 0 && !probedUnknownExpiry;
+	const tryRefresh = async (current, { dropOnFailure = true } = {}) => {
 		if (!current.refreshToken) return void 0;
 		try {
 			const result = await refreshAccessToken({
@@ -466,13 +469,16 @@ const createTokenStore = (config, logger = silentLogger) => {
 				refreshToken: result.refresh_token ?? current.refreshToken,
 				expiresAt: expiryFrom(result.expires_in)
 			};
+			probedUnknownExpiry = true;
 			persist(token);
 			logger.info("oauth_token_refreshed_cached");
 			return token.accessToken;
 		} catch (err) {
 			logger.warn("oauth_token_refresh_failed", { error: err instanceof Error ? err.message : String(err) });
-			token = void 0;
-			clearToken(tokenPath, logger);
+			if (dropOnFailure) {
+				token = void 0;
+				clearToken(tokenPath, logger);
+			}
 			return;
 		}
 	};
@@ -490,6 +496,7 @@ const createTokenStore = (config, logger = silentLogger) => {
 					refreshToken: result.refresh_token,
 					expiresAt: expiryFrom(result.expires_in)
 				};
+				probedUnknownExpiry = true;
 				persist(token);
 				logger.info("oauth_token_cached");
 			}).catch((err) => {
@@ -505,7 +512,8 @@ const createTokenStore = (config, logger = silentLogger) => {
 		});
 	};
 	const getToken = async () => {
-		if (token && !isExpired(token)) {
+		if (refreshing) await refreshing;
+		if (token && !needsRefresh(token)) {
 			logger.debug("oauth_token_cache_hit");
 			return token.accessToken;
 		}
@@ -533,10 +541,18 @@ const createTokenStore = (config, logger = silentLogger) => {
 		}
 		logger.info("oauth_token_invalidated");
 	};
+	const scheduledRefresh = setInterval(() => {
+		if (token?.refreshToken && !refreshing) refreshing = tryRefresh(token, { dropOnFailure: false }).finally(() => {
+			refreshing = void 0;
+		});
+	}, SCHEDULED_REFRESH_MS);
+	scheduledRefresh.unref?.();
+	const dispose = () => clearInterval(scheduledRefresh);
 	return {
 		getToken,
 		setToken,
-		invalidate
+		invalidate,
+		dispose
 	};
 };
 //#endregion
@@ -2376,6 +2392,13 @@ const createAllTools = (ctx) => [
 * refreshes/re-authenticates instead of replaying a revoked token. The callback
 * is omitted only where there is nothing to invalidate (e.g. HTTP per-session
 * bearer, owned by the client).
+*
+* Client-visible behaviour on an in-flight revocation: the 401 is a *backstop*,
+* not a transparent retry. The current call still surfaces the error; recovery
+* happens on the *next* call, whose `getToken` sees the invalidated token and
+* silently refreshes (or falls back to browser re-auth if the refresh token is
+* also dead). Proactive refresh keeps this path rare — it only fires when a
+* token is revoked between the pre-call refresh check and the request.
 */
 const runHandler = async (def, params, onUnauthorized) => {
 	try {