@hapticpaper/mcp-server 1.0.22 → 1.0.26

package/dist/index.js

@@ -310,43 +310,53 @@ ${widgetJs}
             verifyAccessToken: async (token) => {
                 const publicKey = process.env.JWT_PUBLIC_KEY ? process.env.JWT_PUBLIC_KEY.replace(/\\n/g, '\n') : undefined;
                 const secret = process.env.JWT_SECRET;
-                let decoded;
-                if (publicKey) {
-                    try {
-                        decoded = jwt.verify(token, publicKey, { algorithms: ['ES256'] });
-                    }
-                    catch (e) {
-                        // If ES256 fails, and we have a secret, try HS256 (migration path)
-                        if (secret && e.message === 'invalid signature') {
-                            decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
+                // Debug log (redacted)
+                console.error(`[MCP-Auth-Debug] Verifying token. HasPublicKey=${!!publicKey}, HasSecret=${!!secret}`);
+                try {
+                    let decoded;
+                    if (publicKey) {
+                        try {
+                            decoded = jwt.verify(token, publicKey, { algorithms: ['ES256'] });
                         }
-                        else {
-                            throw e;
+                        catch (e) {
+                            // If ES256 fails, and we have a secret, try HS256 (migration path)
+                            // We catch 'invalid signature' (wrong key) AND 'invalid algorithm' (token is HS256 but we asked for ES256)
+                            if (secret && (e.message === 'invalid signature' || e.message.includes('invalid algorithm'))) {
+                                decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
+                            }
+                            else {
+                                throw e;
+                            }
                         }
                     }
+                    else if (secret) {
+                        decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
+                    }
+                    else {
+                        console.error('[MCP-Auth-Error] No keys configured');
+                        throw new Error('Server misconfigured: Neither JWT_PUBLIC_KEY nor JWT_SECRET is set');
+                    }
+                    if (!decoded || typeof decoded !== 'object') {
+                        throw new Error('Invalid token');
+                    }
+                    const scopeStr = typeof decoded.scope === 'string' ? decoded.scope : '';
+                    const permissions = Array.isArray(decoded.permissions) ? decoded.permissions : [];
+                    const scopes = [
+                        ...scopeStr.split(/\s+/).map((s) => s.trim()).filter(Boolean),
+                        ...permissions.map((s) => (typeof s === 'string' ? s.trim() : '')).filter(Boolean),
+                    ];
+                    const exp = decoded.exp;
+                    return {
+                        token,
+                        clientId: decoded.client_id || 'unknown',
+                        scopes: Array.from(new Set(scopes)),
+                        expiresAt: typeof exp === 'number' ? exp : Math.floor(Date.now() / 1000) + 3600,
+                    };
                 }
-                else if (secret) {
-                    decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
-                }
-                else {
-                    throw new Error('Server misconfigured: Neither JWT_PUBLIC_KEY nor JWT_SECRET is set');
-                }
-                if (!decoded || typeof decoded !== 'object') {
-                    throw new Error('Invalid token');
+                catch (err) {
+                    console.error('[MCP-Auth-Error] Token verification failed:', err.message, err.stack);
+                    throw err;
                 }
-                const scopeStr = typeof decoded.scope === 'string' ? decoded.scope : '';
-                const permissions = Array.isArray(decoded.permissions) ? decoded.permissions : [];
-                const scopes = [
-                    ...scopeStr.split(/\s+/).map((s) => s.trim()).filter(Boolean),
-                    ...permissions.map((s) => (typeof s === 'string' ? s.trim() : '')).filter(Boolean),
-                ];
-                const exp = decoded.exp;
-                return {
-                    token,
-                    clientId: decoded.client_id || 'unknown',
-                    scopes: Array.from(new Set(scopes)),
-                    expiresAt: typeof exp === 'number' ? exp : Math.floor(Date.now() / 1000) + 3600,
-                };
             },
         };
         const authMiddleware = requireBearerAuth({

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hapticpaper/mcp-server",
   "mcpName": "com.hapticpaper/mcp",
-  "version": "1.0.22",
+  "version": "1.0.26",
   "description": "Official MCP Server for Haptic Paper - Connect your account to create human tasks from agentic pipelines.",
   "type": "module",
   "main": "dist/index.js",

package/server.json

@@ -25,7 +25,7 @@
     "subfolder": "packages/mcp-server"
   },
   "websiteUrl": "https://hapticpaper.com/developer",
-  "version": "1.0.22",
+  "version": "1.0.26",
   "remotes": [
     {
       "type": "streamable-http",
@@ -37,7 +37,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@hapticpaper/mcp-server",
-      "version": "1.0.22",
+      "version": "1.0.26",
       "transport": {
         "type": "stdio"
       },