@hapticpaper/mcp-server 1.0.32 → 1.0.34

package/dist/index.js

@@ -308,36 +308,13 @@ ${widgetJs}
         }
         const tokenVerifier = {
             verifyAccessToken: async (token) => {
-                const publicKey = process.env.JWT_PUBLIC_KEY ? process.env.JWT_PUBLIC_KEY.replace(/\\n/g, '\n') : undefined;
-                const secret = process.env.JWT_SECRET;
-                // Debug log (redacted)
-                console.error(`[MCP-Auth-Debug] Verifying token. HasPublicKey=${!!publicKey}, HasSecret=${!!secret}`);
                 try {
-                    let decoded;
-                    if (publicKey) {
-                        try {
-                            decoded = jwt.verify(token, publicKey, { algorithms: ['ES256'] });
-                        }
-                        catch (e) {
-                            // If ES256 fails, and we have a secret, try HS256 (migration path)
-                            // We catch 'invalid signature' (wrong key) AND 'invalid algorithm' (token is HS256 but we asked for ES256)
-                            if (secret && (e.message === 'invalid signature' || e.message.includes('invalid algorithm'))) {
-                                decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
-                            }
-                            else {
-                                throw e;
-                            }
-                        }
-                    }
-                    else if (secret) {
-                        decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
-                    }
-                    else {
-                        console.error('[MCP-Auth-Error] No keys configured');
-                        throw new Error('Server misconfigured: Neither JWT_PUBLIC_KEY nor JWT_SECRET is set');
-                    }
+                    // MCP server is just a thin proxy - decode the token without verifying signature.
+                    // The backend will do full verification when we forward the token.
+                    // This avoids duplicating verification logic and makes debugging easier.
+                    const decoded = jwt.decode(token);
                     if (!decoded || typeof decoded !== 'object') {
-                        throw new Error('Invalid token');
+                        throw new Error('Invalid token format');
                     }
                     const scopeStr = typeof decoded.scope === 'string' ? decoded.scope : '';
                     const permissions = Array.isArray(decoded.permissions) ? decoded.permissions : [];
@@ -354,7 +331,7 @@ ${widgetJs}
                     };
                 }
                 catch (err) {
-                    console.error('[MCP-Auth-Error] Token verification failed:', err.message, err.stack);
+                    console.error('[MCP-Auth-Error] Token decode failed:', err.message);
                     throw err;
                 }
             },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hapticpaper/mcp-server",
   "mcpName": "com.hapticpaper/mcp",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "description": "Official MCP Server for Haptic Paper - Connect your account to create human tasks from agentic pipelines.",
   "type": "module",
   "main": "dist/index.js",

package/server.json

@@ -25,7 +25,7 @@
     "subfolder": "packages/mcp-server"
   },
   "websiteUrl": "https://hapticpaper.com/developer",
-  "version": "1.0.32",
+  "version": "1.0.34",
   "remotes": [
     {
       "type": "streamable-http",
@@ -37,7 +37,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@hapticpaper/mcp-server",
-      "version": "1.0.32",
+      "version": "1.0.34",
       "transport": {
         "type": "stdio"
       },