@fruition/fcp-mcp-server 1.25.0 → 1.26.0

package/dist/index.js

@@ -198,19 +198,19 @@ const TOOL_PERMISSIONS = {
     fcp_get_bulk_notify_history: 'viewer',
 };
 // Resolved role for the current API key. Cached only on successful lookup so
-// transient FCP outages don't pin us to 'none' for the rest of the session.
+// transient FCP outages don't pin us to a failure for the rest of the session.
 let cachedUserRole;
 async function fetchUserRole() {
     if (cachedUserRole !== undefined)
-        return cachedUserRole;
+        return { ok: true, role: cachedUserRole };
     // dev_bypass is the local-dev token; treat as super_admin to avoid
     // gating local development against role lookup.
     if (FCP_API_TOKEN === 'dev_bypass') {
         cachedUserRole = 'super_admin';
-        return cachedUserRole;
+        return { ok: true, role: 'super_admin' };
     }
     if (!FCP_API_TOKEN) {
-        return 'none';
+        return { ok: false, kind: 'no_token' };
     }
     try {
         const res = await fetch(`${FCP_API_URL}/api/mcp/me`, {
@@ -219,17 +219,20 @@ async function fetchUserRole() {
         });
         if (!res.ok) {
             console.error(`[MCP Server] Role lookup failed: HTTP ${res.status}`);
-            return 'none';
+            // 401/403 => the API key itself is bad (invalid/expired/revoked).
+            // Everything else (5xx, 429, ...) is treated as a transient failure.
+            const kind = res.status === 401 || res.status === 403 ? 'auth' : 'transient';
+            return { ok: false, kind, status: res.status };
         }
         const data = await res.json();
         const role = data?.role ?? 'none';
         cachedUserRole = role;
         console.error(`[MCP Server] Resolved user role: ${role} (${data?.email ?? 'unknown'})`);
-        return role;
+        return { ok: true, role };
     }
     catch (err) {
         console.error('[MCP Server] Role lookup error:', err);
-        return 'none';
+        return { ok: false, kind: 'transient' };
     }
 }
 function isRoleAtLeast(actual, required) {
@@ -243,7 +246,26 @@ function isRoleAtLeast(actual, required) {
 }
 async function enforceToolPermission(toolName) {
     const required = TOOL_PERMISSIONS[toolName] ?? 'viewer';
-    const actual = await fetchUserRole();
+    const lookup = await fetchUserRole();
+    // A failed lookup is NOT a role problem. Surface the real cause so the user
+    // takes the right action instead of asking a super_admin for a role they
+    // may already effectively have.
+    if (!lookup.ok) {
+        switch (lookup.kind) {
+            case 'no_token':
+                throw new Error('FCP_API_TOKEN is not set. Add your FCP API key to this MCP server\'s ' +
+                    'env config (create one in FCP → Admin → API Keys).');
+            case 'auth':
+                throw new Error(`Your FCP API key is invalid, expired, or revoked (HTTP ${lookup.status}). ` +
+                    'Create a new key in FCP → Admin → API Keys and update your MCP server ' +
+                    'config. This is NOT a role/permission problem — do not request a role grant.');
+            case 'transient':
+                throw new Error('FCP role lookup is temporarily unavailable' +
+                    (lookup.status ? ` (HTTP ${lookup.status})` : '') +
+                    '. This is a transient FCP error — retry shortly.');
+        }
+    }
+    const actual = lookup.role;
     if (!isRoleAtLeast(actual, required)) {
         throw new Error(`Permission denied: tool '${toolName}' requires ${required} role; ` +
             `your role is '${actual}'. Contact a super_admin (Brad, Mattox, or Andrea) ` +
@@ -2811,7 +2833,7 @@ const TOOLS = [
     },
     {
         name: 'fcp_shield_add_domain',
-        description: 'Add a domain to Fruition Shield WAF protection. Returns DNS records (traffic CNAME + cert validation CNAME) that must be added at the registrar.',
+        description: 'Add a domain to Fruition Shield WAF protection. Custom mode (default) fronts an origin server via the shared distribution. S3 mode (origin_type="s3") provisions a DEDICATED CloudFront distribution + OAC over a private S3 bucket (Steldris static hosting) and returns its distribution id + CloudFront domain. Returns DNS records to add at the registrar.',
         inputSchema: {
             type: 'object',
             properties: {
@@ -2819,9 +2841,14 @@ const TOOLS = [
                     type: 'string',
                     description: 'Domain to protect (e.g., www.butterflies.org)',
                 },
+                origin_type: {
+                    type: 'string',
+                    enum: ['custom', 's3'],
+                    description: 'Origin mode: custom (shared distribution + origin server, default) or s3 (dedicated distribution + OAC over a private S3 bucket).',
+                },
                 origin_host: {
                     type: 'string',
-                    description: 'Origin server IP or hostname (e.g., 146.190.2.169 for K8s prod)',
+                    description: 'Origin server IP or hostname (e.g., 146.190.2.169 for K8s prod). Required for origin_type=custom; ignored for s3.',
                 },
                 origin_port: {
                     type: 'number',
@@ -2831,6 +2858,18 @@ const TOOLS = [
                     type: 'string',
                     description: 'Origin protocol: http or https (default: https)',
                 },
+                s3_bucket: {
+                    type: 'string',
+                    description: 'S3 artifacts bucket (origin_type=s3, e.g. steldris-sites-prod). Required for s3 mode.',
+                },
+                s3_region: {
+                    type: 'string',
+                    description: 'S3 bucket region (origin_type=s3, e.g. us-east-1). Required for s3 mode.',
+                },
+                s3_origin_path: {
+                    type: 'string',
+                    description: 'CloudFront OriginPath — the per-tenant key prefix (origin_type=s3, e.g. /acme).',
+                },
                 website_id: {
                     type: 'number',
                     description: 'Link to existing FCP website ID',
@@ -2841,14 +2880,14 @@ const TOOLS = [
                 },
                 cache_profile: {
                     type: 'string',
-                    description: 'Cache profile: standard, aggressive, minimal, none (default: standard)',
+                    description: 'Cache profile: standard, aggressive, minimal, none (default: standard; s3 defaults to aggressive)',
                 },
                 notes: {
                     type: 'string',
                     description: 'Notes about this domain',
                 },
             },
-            required: ['domain', 'origin_host'],
+            required: ['domain'],
         },
     },
     {
@@ -4734,9 +4773,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 };
             }
             case 'fcp_shield_add_domain': {
-                const { domain, origin_host, origin_port, origin_protocol, website_id, account_id, cache_profile, notes } = args;
+                const { domain, origin_type, origin_host, origin_port, origin_protocol, s3_bucket, s3_region, s3_origin_path, website_id, account_id, cache_profile, notes } = args;
                 const result = await client.shieldAddDomain({
-                    domain, origin_host, origin_port, origin_protocol, website_id, account_id, cache_profile, notes,
+                    domain, origin_type, origin_host, origin_port, origin_protocol, s3_bucket, s3_region, s3_origin_path, website_id, account_id, cache_profile, notes,
                 });
                 return {
                     content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruition/fcp-mcp-server",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "MCP Server for FCP Launch Coordination System - enables Claude Code to interact with FCP launches and track development time",
   "main": "dist/index.js",
   "type": "module",