@fruggr/zendesk-mcp-server 3.2.1 → 3.3.1

package/dist/THIRD-PARTY-NOTICES.md

@@ -30,9 +30,9 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/core@2.2.0
+## @modelcontextprotocol/core@2.3.1
 
-License: MIT
+License: Apache-2.0
 
 ```
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -253,9 +253,9 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ```
 
-## @modelcontextprotocol/node@2.1.0
+## @modelcontextprotocol/node@2.1.1
 
-License: MIT
+License: Apache-2.0
 
 ```
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -476,9 +476,9 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ```
 
-## @modelcontextprotocol/server@2.2.0
+## @modelcontextprotocol/server@2.3.1
 
-License: MIT
+License: Apache-2.0
 
 ```
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -2629,7 +2629,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## mdast-util-find-and-replace@3.0.2
+## mdast-util-find-and-replace@3.0.3
 
 License: MIT
 
@@ -2658,7 +2658,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## mdast-util-from-markdown@2.0.3
+## mdast-util-from-markdown@2.1.0
 
 License: MIT
 
@@ -2920,7 +2920,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## mdast-util-to-markdown@2.1.3
+## mdast-util-to-markdown@2.2.0
 
 License: MIT
 

package/dist/{http-7NVoxfEA.js → http-BYYYoQaK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { _ as __toESM, a as REQUEST_TIMEOUT_MS, c as getOAuthUrls, d as createStartupError, f as errnoCode, g as __require, h as __exportAll, i as zendeskGet, l as WebStandardStreamableHTTPServerTransport, m as __commonJSMin, o as deadlineSignal, r as silentLogger, t as createMcpServer, u as STARTUP_DOCS } from "./index.js";
-import { d as escapeHtml, l as requestedScope, n as configDir, o as generateCodeChallenge, s as generateCodeVerifier, u as supportedScopes } from "./token-persistence-BeetFqPF.js";
+import { _ as __commonJSMin, a as verifyBearerToken, b as __toESM, c as zendeskGet, f as getOAuthUrls, h as errnoCode, i as WebStandardStreamableHTTPServerTransport, l as REQUEST_TIMEOUT_MS, m as createStartupError, o as OAuthError, p as STARTUP_DOCS, r as silentLogger, s as OAuthErrorCode, t as createMcpServer, u as deadlineSignal, v as __exportAll, y as __require } from "./index.js";
+import { d as escapeHtml, l as requestedScope, n as configDir, o as generateCodeChallenge, s as generateCodeVerifier, u as supportedScopes } from "./token-persistence-BUHh23BM.js";
 import * as util$1 from "node:util";
 import { format, inspect } from "node:util";
 import * as crypto$2 from "node:crypto";
@@ -16,7 +16,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { accessSync, chmodSync, constants, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { Http2ServerRequest, constants as constants$1 } from "http2";
 import crypto$1 from "crypto";
-//#region node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.12/node_modules/@hono/node-server/dist/index.mjs
+//#region node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.13/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -504,7 +504,7 @@ var getRequestListener = (fetchCallback, options = {}) => {
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.0_@modelcontextprotocol+server@2.2.0_hono@4.13.12/node_modules/@modelcontextprotocol/node/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.1_@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/node/dist/index.mjs
 /**
 * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
 * It supports both SSE streaming and direct HTTP responses.
@@ -543,8 +543,12 @@ var getRequestListener = (fetchCallback, options = {}) => {
 *
 * @example Using with a pre-parsed request body (e.g. Express)
 * ```ts source="./streamableHttp.examples.ts#NodeStreamableHTTPServerTransport_express"
-* app.post('/mcp', (req, res) => {
-*     transport.handleRequest(req, res, req.body);
+* app.post('/mcp', async (req, res) => {
+*     // Stateless example: create a server and a transport per request.
+*     const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*     const transport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*     await server.connect(transport);
+*     await transport.handleRequest(req, res, req.body);
 * });
 * ```
 */
@@ -36178,16 +36182,16 @@ const resolveMasterSecret = (input, logger = silentLogger) => {
 //#endregion
 //#region src/auth/server/authorization-server.ts
 const decoder = new TextDecoder();
-const asVerified = (claims, issuer, resource) => {
-	const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
-	if (!(claims.iss === issuer && audiences.includes(resource) && typeof claims.exp === "number" && claims.exp * 1e3 > Date.now() && typeof claims.zd === "string" && typeof claims.gid === "string")) return void 0;
+const asVerified = (claims, issuer) => {
+	if (!(claims.iss === issuer && typeof claims.exp === "number" && typeof claims.zd === "string" && typeof claims.gid === "string")) return void 0;
 	return {
 		zendeskAccessToken: claims.zd,
 		grantId: claims.gid,
 		clientId: String(claims.client_id),
 		subject: String(claims.sub),
 		canWrite: typeof claims.scope === "string" && claims.scope.split(" ").includes("write"),
-		expiresAt: claims.exp
+		expiresAt: claims.exp,
+		resource: typeof claims.aud === "string" ? claims.aud : void 0
 	};
 };
 const createAuthorizationServer = (options) => {
@@ -36252,7 +36256,7 @@ const createAuthorizationServer = (options) => {
 		const keySet = ring.find((set) => set.accessToken.kid === kid);
 		if (!keySet) return void 0;
 		const { plaintext } = await compactDecrypt(bearer, keySet.accessToken.key);
-		return asVerified(JSON.parse(decoder.decode(plaintext)), issuer, resource);
+		return asVerified(JSON.parse(decoder.decode(plaintext)), issuer);
 	};
 	return {
 		issuer,
@@ -36414,11 +36418,36 @@ const resolvePublicUrl = (config, logger = silentLogger) => {
 	return `http://${config.host}:${config.port}`;
 };
 const MISSING_BEARER_MESSAGE = "Missing or invalid access token. Sign in through this server: its OAuth authorization server is named in the protected resource metadata.";
-const extractBearer = (request) => {
+const SPACES = / +/;
+/**
+* The access token on this request, or `undefined` when it must be refused.
+* The SDK parses the header and checks the audience against our `/mcp`
+* resource (`expectedResource`) and the expiry; decrypting and every other
+* claim stay with the authorization server.
+*/
+const authenticate = async (request, as) => {
 	const header = request.headers["authorization"];
-	if (typeof header !== "string") return void 0;
-	if (!header.toLowerCase().startsWith("bearer ")) return void 0;
-	return header.slice(7).trim();
+	const verifier = { verifyAccessToken: async (bearer) => {
+		const token = await as.verifyAccessToken(bearer);
+		if (!token) throw new OAuthError(OAuthErrorCode.InvalidToken, "Invalid access token");
+		return {
+			token: bearer,
+			clientId: token.clientId,
+			scopes: [],
+			expiresAt: token.expiresAt,
+			...token.resource && URL.canParse(token.resource) && { resource: new URL(token.resource) },
+			extra: { verified: token }
+		};
+	} };
+	try {
+		const normalized = typeof header === "string" ? header.replace(SPACES, " ") : void 0;
+		return (await verifyBearerToken(normalized, {
+			verifier,
+			expectedResource: new URL(as.resource)
+		})).extra?.["verified"];
+	} catch {
+		return;
+	}
 };
 const PROTECTED_RESOURCE_PATHS = ["/.well-known/oauth-protected-resource/mcp", "/.well-known/oauth-protected-resource"];
 const sendJson = (res, status, body) => {
@@ -36572,8 +36601,7 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 		await transport.handleRequest(req, res, body);
 	};
 	const handleMcpRequest = async (req, res, as) => {
-		const bearer = extractBearer(req);
-		const token = bearer ? await as.verifyAccessToken(bearer) : void 0;
+		const token = await authenticate(req, as);
 		if (!token) {
 			sendUnauthorized(res, as.issuer);
 			return;