@fruggr/zendesk-mcp-server 3.1.2 → 3.2.1

package/dist/THIRD-PARTY-NOTICES.md

@@ -30,7 +30,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/core@2.1.0
+## @modelcontextprotocol/core@2.2.0
 
 License: MIT
 
@@ -476,7 +476,7 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ```
 
-## @modelcontextprotocol/server@2.1.0
+## @modelcontextprotocol/server@2.2.0
 
 License: MIT
 
@@ -2774,14 +2774,14 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## mdast-util-gfm-strikethrough@2.0.0
+## mdast-util-gfm-strikethrough@2.0.1
 
 License: MIT
 
 ```
 (The MIT License)
 
-Copyright (c) 2020 Titus Wormer <tituswormer@gmail.com>
+Copyright (c) Titus Wormer <tituswormer@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -2920,7 +2920,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## mdast-util-to-markdown@2.1.2
+## mdast-util-to-markdown@2.1.3
 
 License: MIT
 
@@ -4111,22 +4111,6 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## powershell-utils@0.1.0
-
-License: MIT
-
-```
-MIT License
-
-Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-```
-
 ## powershell-utils@0.2.1
 
 License: MIT
@@ -5198,7 +5182,7 @@ The above copyright notice and this permission notice shall be included in all c
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## wsl-utils@1.0.0
+## wsl-utils@1.0.1
 
 License: MIT
 

package/dist/{http-CmtU-oNu.js → http-7NVoxfEA.js}

@@ -16,7 +16,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { accessSync, chmodSync, constants, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { Http2ServerRequest, constants as constants$1 } from "http2";
 import crypto$1 from "crypto";
-//#region node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.9/node_modules/@hono/node-server/dist/index.mjs
+//#region node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.12/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -504,7 +504,7 @@ var getRequestListener = (fetchCallback, options = {}) => {
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.0_@modelcontextprotocol+server@2.1.0_hono@4.13.9/node_modules/@modelcontextprotocol/node/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.0_@modelcontextprotocol+server@2.2.0_hono@4.13.12/node_modules/@modelcontextprotocol/node/dist/index.mjs
 /**
 * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
 * It supports both SSE streaming and direct HTTP responses.
@@ -2264,82 +2264,6 @@ function decodeJwt(jwt) {
 	return result;
 }
 //#endregion
-//#region src/auth/server/expiring-map.ts
-/**
-* An in-memory map whose entries lapse after their own TTL. Expired entries are
-* swept on every `set`, so the map stays bounded by what was set within the
-* longest TTL, with no timer to hold the process open.
-*/
-const createExpiringMap = () => {
-	const entries = /* @__PURE__ */ new Map();
-	const get = (key) => {
-		const entry = entries.get(key);
-		return entry && entry.expiresAt > Date.now() ? entry.value : void 0;
-	};
-	return {
-		set: (key, value, ttlMs) => {
-			const now = Date.now();
-			for (const [k, entry] of entries) if (entry.expiresAt <= now) entries.delete(k);
-			entries.set(key, {
-				value,
-				expiresAt: now + ttlMs
-			});
-		},
-		get,
-		/** Read and forget: a pending value is used at most once. */
-		take: (key) => {
-			const value = get(key);
-			entries.delete(key);
-			return value;
-		},
-		/** Live and not-yet-swept entries. */
-		size: () => entries.size
-	};
-};
-//#endregion
-//#region src/auth/server/consent.ts
-const hostOf = (uri) => {
-	try {
-		return new URL(uri).host;
-	} catch {
-		return uri;
-	}
-};
-const SCOPE_LABELS = {
-	read: "Read your Zendesk data",
-	write: "Create and change Zendesk data on your behalf"
-};
-/**
-* The MCP consent screen, shown once per client that is not trusted (DCR,
-* unknown CIMD, loopback redirects). Names the client, the scopes and where the
-* code goes, per the spec's UI requirements. Every interpolated value is
-* escaped: the client name comes from a document anyone can publish.
-*/
-const renderConsentPage = (view) => {
-	const name = escapeHtml(view.clientName ?? view.clientId);
-	const scopes = view.scopes.map((scope) => `<li>${escapeHtml(SCOPE_LABELS[scope] ?? scope)}</li>`).join("");
-	const action = `/interaction/${encodeURIComponent(view.uid)}`;
-	return [
-		"<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">",
-		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">",
-		"<title>Authorize access to Zendesk</title>",
-		"<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem;line-height:1.5}",
-		"code{word-break:break-all}button{font:inherit;padding:.5rem 1.25rem;margin-right:.5rem}</style>",
-		"</head><body>",
-		`<h1>Allow ${name} to use your Zendesk account?</h1>`,
-		`<p><strong>${name}</strong> is asking to act as you on <strong>${escapeHtml(view.subdomain)}.zendesk.com</strong>:</p>`,
-		`<ul>${scopes}</ul>`,
-		`<p>After you allow it, you are sent back to <strong>${escapeHtml(hostOf(view.redirectUri))}</strong>`,
-		` (<code>${escapeHtml(view.redirectUri)}</code>). Only continue if you started this connection yourself.</p>`,
-		`<p>Client id: <code>${escapeHtml(view.clientId)}</code></p>`,
-		`<form method="post" action="${action}/confirm" style="display:inline"><button type="submit">Allow</button></form>`,
-		`<form method="post" action="${action}/abort" style="display:inline"><button type="submit">Deny</button></form>`,
-		"</body></html>"
-	].join("");
-};
-/** Plain error page for a failed sign-in. ASCII message, escaped. */
-const renderErrorPage = (title, detail) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Sign-in failed</title></head><body><h1>${escapeHtml(title)}</h1><p>${escapeHtml(detail)}</p></body></html>`;
-//#endregion
 //#region src/auth/server/trusted-clients.ts
 /**
 * Which CIMD clients skip our consent screen, and the fetch shim applied to CIMD
@@ -2425,6 +2349,184 @@ const createCimdFetch = (baseFetch) => async (url, options) => {
 	});
 };
 //#endregion
+//#region src/auth/server/cimd-documents.ts
+/** How long a kept copy may stand in for its document, after it was kept. */
+const LAST_GOOD_TTL_S = 604800;
+const STALE_MAX_AGE_S = 60;
+const CIMD_FETCH_HINT = "A client document, or a URL it names, could not be fetched: the client cannot sign in or refresh unless a last good copy is served. See https://github.com/fruggr/zendesk-mcp-server/blob/main/docs/troubleshooting.md#http-the-log-shows-oauth_client_fetch_failed";
+const isTransientFailure = (status) => status === 403 || status === 408 || status === 429 || status >= 500;
+const messageOf = (err) => {
+	if (!(err instanceof Error)) return String(err);
+	return err.cause instanceof Error ? `${err.message}: ${err.cause.message}` : err.message;
+};
+const ownDocument = async (response, url) => {
+	const parsed = await response.json().catch(() => void 0);
+	return parsed?.client_id === url ? parsed : void 0;
+};
+/**
+* A copy is kept when a token is issued, from the client oidc-provider built
+* and validated: an unauthenticated caller can make the server fetch any URL,
+* but not write to the grant store, and a rejected document is never kept.
+*/
+const createCimdDocuments = (baseFetch, { lastGood, logger }) => {
+	const rewrite = createCimdFetch(baseFetch);
+	const stale = /* @__PURE__ */ new Set();
+	const kept = (url) => lastGood.get(url).catch((err) => {
+		logger.warn("oauth_cimd_last_good_read_failed", {
+			url,
+			error: messageOf(err)
+		});
+	});
+	const report = (url, failure, copy) => {
+		logger.warn("oauth_client_fetch_failed", {
+			url,
+			...failure,
+			fallback: copy ? "last_good" : "none",
+			...copy && { ageS: Math.floor((Date.now() - copy.fetchedAt) / 1e3) },
+			hint: CIMD_FETCH_HINT
+		});
+	};
+	const serve = (url, copy) => {
+		stale.add(url);
+		return Response.json(copy.document, { headers: { "cache-control": `max-age=${STALE_MAX_AGE_S}` } });
+	};
+	const fallBack = async (url, failure, failed) => {
+		const copy = await kept(url);
+		report(url, failure, copy);
+		if (!copy) return void 0;
+		await failed?.body?.cancel();
+		return serve(url, copy);
+	};
+	const succeeded = async (url, response) => {
+		if (await ownDocument(response.clone(), url) && response.status === 200) {
+			stale.delete(url);
+			return response;
+		}
+		const copy = await kept(url);
+		if (!copy) return response;
+		report(url, {
+			status: response.status,
+			error: "not a client document"
+		}, copy);
+		await response.body?.cancel();
+		return serve(url, copy);
+	};
+	const fetch = async (input, init) => {
+		const url = String(input);
+		let response;
+		try {
+			response = await rewrite(input, init);
+		} catch (err) {
+			const copy = await fallBack(url, { error: messageOf(err) });
+			if (copy) return copy;
+			throw err;
+		}
+		if (response.ok) return succeeded(url, response);
+		if (!isTransientFailure(response.status)) {
+			logger.debug("oauth_client_fetch_failed", {
+				url,
+				status: response.status,
+				fallback: "none"
+			});
+			return response;
+		}
+		return await fallBack(url, { status: response.status }, response) ?? response;
+	};
+	return {
+		fetch,
+		granted: async (client) => {
+			if (client.clientIdMetadataDocument !== true || stale.has(client.clientId)) return;
+			try {
+				await lastGood.set(client.clientId, {
+					document: client.metadata(),
+					fetchedAt: Date.now()
+				}, LAST_GOOD_TTL_S);
+			} catch (err) {
+				logger.warn("oauth_cimd_last_good_store_failed", {
+					url: client.clientId,
+					error: messageOf(err)
+				});
+			}
+		}
+	};
+};
+//#endregion
+//#region src/auth/server/expiring-map.ts
+/**
+* An in-memory map whose entries lapse after their own TTL. Expired entries are
+* swept on every `set`, so the map stays bounded by what was set within the
+* longest TTL, with no timer to hold the process open.
+*/
+const createExpiringMap = () => {
+	const entries = /* @__PURE__ */ new Map();
+	const get = (key) => {
+		const entry = entries.get(key);
+		return entry && entry.expiresAt > Date.now() ? entry.value : void 0;
+	};
+	return {
+		set: (key, value, ttlMs) => {
+			const now = Date.now();
+			for (const [k, entry] of entries) if (entry.expiresAt <= now) entries.delete(k);
+			entries.set(key, {
+				value,
+				expiresAt: now + ttlMs
+			});
+		},
+		get,
+		/** Read and forget: a pending value is used at most once. */
+		take: (key) => {
+			const value = get(key);
+			entries.delete(key);
+			return value;
+		},
+		/** Live and not-yet-swept entries. */
+		size: () => entries.size
+	};
+};
+//#endregion
+//#region src/auth/server/consent.ts
+const hostOf = (uri) => {
+	try {
+		return new URL(uri).host;
+	} catch {
+		return uri;
+	}
+};
+const SCOPE_LABELS = {
+	read: "Read your Zendesk data",
+	write: "Create and change Zendesk data on your behalf"
+};
+/**
+* The MCP consent screen, shown once per client that is not trusted (DCR,
+* unknown CIMD, loopback redirects). Names the client, the scopes and where the
+* code goes, per the spec's UI requirements. Every interpolated value is
+* escaped: the client name comes from a document anyone can publish.
+*/
+const renderConsentPage = (view) => {
+	const name = escapeHtml(view.clientName ?? view.clientId);
+	const scopes = view.scopes.map((scope) => `<li>${escapeHtml(SCOPE_LABELS[scope] ?? scope)}</li>`).join("");
+	const action = `/interaction/${encodeURIComponent(view.uid)}`;
+	return [
+		"<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">",
+		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">",
+		"<title>Authorize access to Zendesk</title>",
+		"<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem;line-height:1.5}",
+		"code{word-break:break-all}button{font:inherit;padding:.5rem 1.25rem;margin-right:.5rem}</style>",
+		"</head><body>",
+		`<h1>Allow ${name} to use your Zendesk account?</h1>`,
+		`<p><strong>${name}</strong> is asking to act as you on <strong>${escapeHtml(view.subdomain)}.zendesk.com</strong>:</p>`,
+		`<ul>${scopes}</ul>`,
+		`<p>After you allow it, you are sent back to <strong>${escapeHtml(hostOf(view.redirectUri))}</strong>`,
+		` (<code>${escapeHtml(view.redirectUri)}</code>). Only continue if you started this connection yourself.</p>`,
+		`<p>Client id: <code>${escapeHtml(view.clientId)}</code></p>`,
+		`<form method="post" action="${action}/confirm" style="display:inline"><button type="submit">Allow</button></form>`,
+		`<form method="post" action="${action}/abort" style="display:inline"><button type="submit">Deny</button></form>`,
+		"</body></html>"
+	].join("");
+};
+/** Plain error page for a failed sign-in. ASCII message, escaped. */
+const renderErrorPage = (title, detail) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Sign-in failed</title></head><body><h1>${escapeHtml(title)}</h1><p>${escapeHtml(detail)}</p></body></html>`;
+//#endregion
 //#region src/auth/server/upstream.ts
 /**
 * Zendesk as the upstream identity provider, through the same public PKCE client
@@ -35898,13 +36000,12 @@ const buildProvider = (options) => {
 	const { ring, resource } = options;
 	const [current] = ring;
 	const scopes = options.allowWrite ? RESOURCE_SCOPES.join(" ") : "read";
-	const baseFetch = options.fetch ?? ((url, init) => globalThis.fetch(url, init));
 	const provider = new lib_default(options.issuer, {
 		adapter: options.adapter,
 		jwks: { keys: ring.map((set) => set.signingJwk) },
 		cookies: { keys: ring.map((set) => set.cookieKey) },
 		clients: [],
-		fetch: createCimdFetch(baseFetch),
+		fetch: options.cimdDocuments.fetch,
 		scopes: options.allowWrite ? [...RESOURCE_SCOPES, "offline_access"] : ["read", "offline_access"],
 		clientDefaults: {
 			grant_types: ["authorization_code", "refresh_token"],
@@ -36109,6 +36210,10 @@ const createAuthorizationServer = (options) => {
 			hint: "Revoked in this process only. Fix the store before restarting: its next successful write persists the removal."
 		});
 	};
+	const cimdDocuments = createCimdDocuments(options.fetch ?? ((url, init) => globalThis.fetch(url, init)), {
+		lastGood: createSealedCollection(persistent, "CimdDocument", ring),
+		logger
+	});
 	const provider = buildProvider({
 		issuer,
 		resource,
@@ -36118,7 +36223,10 @@ const createAuthorizationServer = (options) => {
 		allowWrite: !config.readOnly,
 		isAllowedOrigin: options.isAllowedOrigin,
 		behindProxy: config.publicUrl?.startsWith("https:") === true,
-		fetch: options.fetch
+		cimdDocuments
+	});
+	provider.on("grant.success", (ctx) => {
+		if (ctx.oidc.client) cimdDocuments.granted(ctx.oidc.client);
 	});
 	provider.on("server_error", (_ctx, err) => {
 		logger.error("oauth_server_error", { error: err.message });