@hapticpaper/mcp-server 1.0.33 → 1.0.35

package/dist/client/hapticPaperClient.js

@@ -13,10 +13,21 @@ export class HapticPaperClient {
         this.tokenProvider = config.tokenProvider;
         // Request interceptor to add auth token
         this.client.interceptors.request.use(async (config) => {
+            console.error('[HapticPaperClient] Request interceptor called for:', config.url);
             if (this.tokenProvider) {
-                const token = await this.tokenProvider();
-                if (token) {
-                    config.headers.Authorization = `Bearer ${token}`;
+                try {
+                    const token = await this.tokenProvider();
+                    if (token) {
+                        config.headers.Authorization = `Bearer ${token}`;
+                        console.error('[HapticPaperClient] Token added to request');
+                    }
+                    else {
+                        console.error('[HapticPaperClient] Token provider returned empty token');
+                    }
+                }
+                catch (err) {
+                    console.error('[HapticPaperClient] Token provider failed:', err.message, err.stack);
+                    throw err;
                 }
             }
             return config;

package/dist/index.js

@@ -308,36 +308,16 @@ ${widgetJs}
         }
         const tokenVerifier = {
             verifyAccessToken: async (token) => {
-                const publicKey = process.env.JWT_PUBLIC_KEY ? process.env.JWT_PUBLIC_KEY.replace(/\\n/g, '\n') : undefined;
-                const secret = process.env.JWT_SECRET;
-                // Debug log (redacted)
-                console.error(`[MCP-Auth-Debug] Verifying token. HasPublicKey=${!!publicKey}, HasSecret=${!!secret}`);
                 try {
-                    let decoded;
-                    if (publicKey) {
-                        try {
-                            decoded = jwt.verify(token, publicKey, { algorithms: ['ES256'] });
-                        }
-                        catch (e) {
-                            // If ES256 fails, and we have a secret, try HS256 (migration path)
-                            // We catch 'invalid signature' (wrong key) AND 'invalid algorithm' (token is HS256 but we asked for ES256)
-                            if (secret && (e.message === 'invalid signature' || e.message.includes('invalid algorithm'))) {
-                                decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
-                            }
-                            else {
-                                throw e;
-                            }
-                        }
-                    }
-                    else if (secret) {
-                        decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
-                    }
-                    else {
-                        console.error('[MCP-Auth-Error] No keys configured');
-                        throw new Error('Server misconfigured: Neither JWT_PUBLIC_KEY nor JWT_SECRET is set');
-                    }
+                    // MCP server is just a thin proxy - decode the token without verifying signature.
+                    // The backend will do full verification when we forward the token.
+                    // This avoids duplicating verification logic and makes debugging easier.
+                    console.error('[MCP-Token-Debug] Decoding token...');
+                    const decoded = jwt.decode(token);
+                    console.error('[MCP-Token-Debug] Token decoded successfully');
                     if (!decoded || typeof decoded !== 'object') {
-                        throw new Error('Invalid token');
+                        console.error('[MCP-Token-Debug] Token decode returned invalid format:', typeof decoded);
+                        throw new Error('Invalid token format');
                     }
                     const scopeStr = typeof decoded.scope === 'string' ? decoded.scope : '';
                     const permissions = Array.isArray(decoded.permissions) ? decoded.permissions : [];
@@ -346,6 +326,7 @@ ${widgetJs}
                         ...permissions.map((s) => (typeof s === 'string' ? s.trim() : '')).filter(Boolean),
                     ];
                     const exp = decoded.exp;
+                    console.error('[MCP-Token-Debug] Returning auth result');
                     return {
                         token,
                         clientId: decoded.client_id || 'unknown',
@@ -354,7 +335,7 @@ ${widgetJs}
                     };
                 }
                 catch (err) {
-                    console.error('[MCP-Auth-Error] Token verification failed:', err.message, err.stack);
+                    console.error('[MCP-Auth-Error] Token decode failed:', err.message, err.stack);
                     throw err;
                 }
             },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hapticpaper/mcp-server",
   "mcpName": "com.hapticpaper/mcp",
-  "version": "1.0.33",
+  "version": "1.0.35",
   "description": "Official MCP Server for Haptic Paper - Connect your account to create human tasks from agentic pipelines.",
   "type": "module",
   "main": "dist/index.js",

package/server.json

@@ -25,7 +25,7 @@
     "subfolder": "packages/mcp-server"
   },
   "websiteUrl": "https://hapticpaper.com/developer",
-  "version": "1.0.33",
+  "version": "1.0.35",
   "remotes": [
     {
       "type": "streamable-http",
@@ -37,7 +37,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@hapticpaper/mcp-server",
-      "version": "1.0.33",
+      "version": "1.0.35",
       "transport": {
         "type": "stdio"
       },