@kadoa/mcp 0.3.6-rc.7 → 0.3.6-rc.8

package/dist/index.js

@@ -49079,8 +49079,10 @@ function createKadoaClient(auth) {
   }
   return new KadoaClient({ apiKey: resolveApiKey(auth) });
 }
+var ctxRefreshMutex;
 var init_client = __esm(() => {
   init_dist2();
+  ctxRefreshMutex = new WeakMap;
 });
 
 // src/client.ts
@@ -49116,36 +49118,38 @@ function isJwtExpired(jwt2) {
 }
 async function refreshSupabaseJwt(ctx) {
   if (!ctx.supabaseRefreshToken) {
-    console.error("[JWT Refresh] No refresh token available, cannot refresh");
+    console.error("[JWT_REFRESH] No refresh token available, cannot refresh");
     return;
   }
   const supabaseUrl = process.env.SUPABASE_URL;
   if (!supabaseUrl) {
-    console.error("[JWT Refresh] SUPABASE_URL not set, cannot refresh");
+    console.error("[JWT_REFRESH] SUPABASE_URL not set, cannot refresh");
     return;
   }
   try {
+    const refreshToken = ctx.supabaseRefreshToken;
+    console.error(`[JWT_REFRESH] Refreshing Supabase JWT (refreshToken=${refreshToken.slice(0, 12)}..., team=${ctx.teamId ?? "unknown"})`);
     const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json",
         apikey: process.env.SUPABASE_ANON_KEY
       },
-      body: JSON.stringify({ refresh_token: ctx.supabaseRefreshToken })
+      body: JSON.stringify({ refresh_token: refreshToken })
     });
     if (!res.ok) {
       const body = await res.text().catch(() => "");
-      console.error(`[JWT Refresh] Supabase returned ${res.status}: ${body}`);
+      console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status} (refreshToken=${refreshToken.slice(0, 12)}...): ${body}`);
       return;
     }
     const data = await res.json();
     ctx.supabaseJwt = data.access_token;
     ctx.supabaseRefreshToken = data.refresh_token;
     ctx.client.setBearerToken(data.access_token);
-    console.error("[JWT Refresh] Token refreshed successfully");
+    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"}, newRefreshToken=${data.refresh_token.slice(0, 12)}...)`);
     return data.access_token;
   } catch (error48) {
-    console.error("[JWT Refresh] Failed:", error48);
+    console.error("[JWT_REFRESH] FAIL: threw", error48);
     return;
   }
 }
@@ -49154,16 +49158,21 @@ async function getValidJwt(ctx) {
     return;
   if (!isJwtExpired(ctx.supabaseJwt))
     return ctx.supabaseJwt;
-  if (refreshPromise)
-    return refreshPromise;
-  refreshPromise = refreshSupabaseJwt(ctx).finally(() => {
-    refreshPromise = null;
+  const inflight = ctxRefreshMutex2.get(ctx);
+  if (inflight) {
+    console.error("[JWT_REFRESH] DEDUP: reusing in-flight refresh");
+    return inflight;
+  }
+  const promise3 = refreshSupabaseJwt(ctx).finally(() => {
+    ctxRefreshMutex2.delete(ctx);
   });
-  return refreshPromise;
+  ctxRefreshMutex2.set(ctx, promise3);
+  return promise3;
 }
-var refreshPromise = null;
+var ctxRefreshMutex2;
 var init_client2 = __esm(() => {
   init_dist2();
+  ctxRefreshMutex2 = new WeakMap;
 });
 
 // src/tools.ts
@@ -54001,6 +54010,45 @@ function generatePKCE() {
   const challenge = createHash2("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
+async function refreshSupabaseToken(supabaseRefreshToken, context) {
+  const inflight = supabaseRefreshMutex.get(supabaseRefreshToken);
+  if (inflight) {
+    console.error(`[AUTH] REFRESH_DEDUP: reusing in-flight refresh (${context})`);
+    return inflight;
+  }
+  const promise3 = (async () => {
+    const supabaseUrl = process.env.SUPABASE_URL;
+    if (!supabaseUrl || !supabaseRefreshToken)
+      return null;
+    try {
+      const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          apikey: process.env.SUPABASE_ANON_KEY
+        },
+        body: JSON.stringify({ refresh_token: supabaseRefreshToken })
+      });
+      if (res.ok) {
+        const data = await res.json();
+        const newClaims = jwtClaims(data.access_token);
+        console.log(`[AUTH] REFRESH_OK: Supabase JWT refreshed (${context}, newEmail=${newClaims.email})`);
+        return { jwt: data.access_token, refreshToken: data.refresh_token };
+      }
+      const body = await res.text().catch(() => "");
+      console.error(`[AUTH] REFRESH_FAIL: Supabase returned ${res.status} (${context}): ${body.slice(0, 200)}`);
+      return null;
+    } catch (err) {
+      console.error(`[AUTH] REFRESH_FAIL: Supabase refresh threw (${context}):`, err);
+      return null;
+    }
+  })();
+  supabaseRefreshMutex.set(supabaseRefreshToken, promise3);
+  promise3.finally(() => {
+    supabaseRefreshMutex.delete(supabaseRefreshToken);
+  });
+  return promise3;
+}
 function jwtClaims(jwt2) {
   try {
     const payload = JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
@@ -54302,32 +54350,14 @@ class KadoaOAuthProvider {
     }
     await this.store.del("refresh_tokens", refreshToken);
     let { supabaseJwt, supabaseRefreshToken } = entry;
-    try {
-      const supabaseUrl = process.env.SUPABASE_URL;
-      if (supabaseUrl && supabaseRefreshToken) {
-        const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
-          method: "POST",
-          headers: {
-            "Content-Type": "application/json",
-            apikey: process.env.SUPABASE_ANON_KEY
-          },
-          body: JSON.stringify({ refresh_token: supabaseRefreshToken })
-        });
-        if (res.ok) {
-          const data = await res.json();
-          supabaseJwt = data.access_token;
-          supabaseRefreshToken = data.refresh_token;
-          const newClaims = jwtClaims(supabaseJwt);
-          console.log(`[AUTH] REFRESH_OK: Supabase JWT refreshed (email=${newClaims.email}, team=${entry.teamId})`);
-        } else {
-          const body = await res.text().catch(() => "");
-          const claims = jwtClaims(entry.supabaseJwt);
-          console.error(`[AUTH] REFRESH_WARN: Supabase refresh failed HTTP ${res.status} (email=${claims.email}, team=${entry.teamId}): ${body.slice(0, 200)}`);
-        }
-      }
-    } catch (err) {
-      const claims = jwtClaims(entry.supabaseJwt);
-      console.error(`[AUTH] REFRESH_WARN: Supabase refresh threw (email=${claims.email}, team=${entry.teamId}):`, err);
+    const claims = jwtClaims(entry.supabaseJwt);
+    const context = `email=${claims.email}, team=${entry.teamId}`;
+    const refreshed = await refreshSupabaseToken(supabaseRefreshToken, context);
+    if (refreshed) {
+      supabaseJwt = refreshed.jwt;
+      supabaseRefreshToken = refreshed.refreshToken;
+    } else {
+      console.error(`[AUTH] REFRESH_WARN: using stale Supabase JWT as fallback (${context})`);
     }
     const newAccessToken = randomToken();
     const newRefreshToken = randomToken();
@@ -54890,11 +54920,12 @@ function renderLoginPage(state, error48) {
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL;
+var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL, supabaseRefreshMutex;
 var init_auth2 = __esm(() => {
   init_errors4();
   TEAM_SELECTION_TTL = 10 * 60 * 1000;
   ACCESS_TOKEN_TTL = 7 * 24 * 3600;
+  supabaseRefreshMutex = new Map;
 });
 
 // src/redis-store.ts
@@ -54998,23 +55029,39 @@ var exports_http = {};
 __export(exports_http, {
   startHttpServer: () => startHttpServer
 });
-import { randomUUID as randomUUID2 } from "node:crypto";
 import express8 from "express";
+function jwtClaims2(jwt2) {
+  try {
+    return JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
+  } catch {
+    return {};
+  }
+}
 function resolveAuth(req) {
   const extra = req.auth?.extra;
-  if (!extra)
+  if (!extra) {
+    console.error("[AUTH_RESOLVE] FAIL: req.auth.extra is missing");
     return;
+  }
   if (typeof extra.apiKey === "string" && extra.apiKey.startsWith("tk-")) {
     return { kind: "apiKey", apiKey: extra.apiKey };
   }
   if (typeof extra.supabaseJwt === "string") {
-    let userId;
-    try {
-      const payload = JSON.parse(Buffer.from(extra.supabaseJwt.split(".")[1], "base64url").toString());
-      userId = payload.sub;
-    } catch {
+    const claims = jwtClaims2(extra.supabaseJwt);
+    const userId = claims.sub;
+    if (!userId) {
+      console.error(`[AUTH_RESOLVE] FAIL: JWT missing sub claim (email=${claims.email ?? "unknown"})`);
       return;
     }
+    const exp = claims.exp;
+    if (exp) {
+      const remainingSec = exp - Math.floor(Date.now() / 1000);
+      if (remainingSec <= 0) {
+        console.error(`[AUTH_RESOLVE] WARN: JWT already expired ${-remainingSec}s ago (email=${claims.email}, team=${extra.teamId})`);
+      } else if (remainingSec < 300) {
+        console.error(`[AUTH_RESOLVE] WARN: JWT expires in ${remainingSec}s (email=${claims.email}, team=${extra.teamId})`);
+      }
+    }
     return {
       kind: "jwt",
       jwt: extra.supabaseJwt,
@@ -55023,16 +55070,13 @@ function resolveAuth(req) {
       userId
     };
   }
+  console.error(`[AUTH_RESOLVE] FAIL: no apiKey or supabaseJwt in extra (keys: ${Object.keys(extra).join(", ")})`);
   return;
 }
-function getSessionIdentity(auth) {
-  return auth.kind === "jwt" ? auth.userId : auth.apiKey;
-}
 async function startHttpServer() {
   const port = parseInt(process.env.PORT || "3000", 10);
   const app = createMcpExpressApp({ host: "0.0.0.0" });
   app.set("trust proxy", 1);
-  const sessions = {};
   const store = new RedisTokenStore;
   const provider = new KadoaOAuthProvider(store);
   const serverUrl = process.env.MCP_SERVER_URL || `http://localhost:${port}`;
@@ -55060,15 +55104,15 @@ async function startHttpServer() {
   app.get("/health", (_req, res) => {
     res.json({
       status: "ok",
-      sessions: Object.keys(sessions).length,
       redis: store.isConnected() ? "connected" : "fallback"
     });
   });
   const bearerAuth = requireBearerAuth({ verifier: provider });
   app.post("/mcp", bearerAuth, async (req, res) => {
-    const sessionId = req.headers["mcp-session-id"];
     const auth = resolveAuth(req);
+    const method = req.body?.method ?? "unknown";
     if (!auth) {
+      console.error(`[MCP] 401 method=${method} reason=resolve_auth_failed`);
       res.status(401).json({
         jsonrpc: "2.0",
         error: { code: -32001, message: "Unauthorized: unable to resolve credentials" },
@@ -55076,56 +55120,21 @@ async function startHttpServer() {
       });
       return;
     }
-    const identity = getSessionIdentity(auth);
+    const identity = auth.kind === "jwt" ? `jwt:${auth.userId.slice(0, 8)}...:team=${auth.teamId.slice(0, 8)}...` : `apiKey:${auth.apiKey.slice(0, 12)}...`;
     try {
-      if (sessionId && sessions[sessionId]) {
-        if (identity !== sessions[sessionId].identity) {
-          res.status(403).json({
-            jsonrpc: "2.0",
-            error: { code: -32002, message: "Forbidden: identity mismatch" },
-            id: null
-          });
-          return;
-        }
-        await sessions[sessionId].transport.handleRequest(req, res, req.body);
-        return;
-      }
-      if (sessionId && !sessions[sessionId]) {
-        res.status(404).json({
-          jsonrpc: "2.0",
-          error: { code: -32000, message: "Session not found" },
-          id: null
-        });
-        return;
-      }
-      if (!sessionId && isInitializeRequest(req.body)) {
-        const transport = new StreamableHTTPServerTransport({
-          sessionIdGenerator: () => randomUUID2(),
-          onsessioninitialized: (id) => {
-            sessions[id] = { transport, identity };
-          }
-        });
-        transport.onclose = () => {
-          const sid = transport.sessionId;
-          if (sid)
-            delete sessions[sid];
-        };
-        const server = auth.kind === "jwt" ? createServer({
-          jwt: auth.jwt,
-          refreshToken: auth.refreshToken,
-          teamId: auth.teamId
-        }) : createServer({ apiKey: auth.apiKey });
-        await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
-        return;
-      }
-      res.status(400).json({
-        jsonrpc: "2.0",
-        error: { code: -32000, message: "Bad Request: missing session ID or not an initialize request" },
-        id: null
-      });
+      console.error(`[MCP] POST method=${method} auth=${identity}`);
+      const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined
+      });
+      const server = auth.kind === "jwt" ? createServer({
+        jwt: auth.jwt,
+        refreshToken: auth.refreshToken,
+        teamId: auth.teamId
+      }) : createServer({ apiKey: auth.apiKey });
+      await server.connect(transport);
+      await transport.handleRequest(req, res, req.body);
     } catch (error48) {
-      console.error("Error handling MCP request:", error48);
+      console.error(`[MCP] 500 method=${method} auth=${identity} error=`, error48);
       if (!res.headersSent) {
         res.status(500).json({
           jsonrpc: "2.0",
@@ -55135,57 +55144,25 @@ async function startHttpServer() {
       }
     }
   });
-  app.get("/mcp", bearerAuth, async (req, res) => {
-    const sessionId = req.headers["mcp-session-id"];
-    const auth = resolveAuth(req);
-    if (!auth) {
-      res.status(401).send("Unauthorized: Bearer token required");
-      return;
-    }
-    if (!sessionId) {
-      res.status(400).send("Missing session ID");
-      return;
-    }
-    if (!sessions[sessionId]) {
-      res.status(404).send("Session not found");
-      return;
-    }
-    if (getSessionIdentity(auth) !== sessions[sessionId].identity) {
-      res.status(403).send("Forbidden: identity mismatch");
-      return;
-    }
-    await sessions[sessionId].transport.handleRequest(req, res);
+  app.get("/mcp", bearerAuth, (_req, res) => {
+    res.status(405).json({
+      jsonrpc: "2.0",
+      error: { code: -32000, message: "SSE streaming not supported (stateless server)" },
+      id: null
+    });
   });
-  app.delete("/mcp", bearerAuth, async (req, res) => {
-    const sessionId = req.headers["mcp-session-id"];
-    const auth = resolveAuth(req);
-    if (!auth) {
-      res.status(401).send("Unauthorized: Bearer token required");
-      return;
-    }
-    if (!sessionId) {
-      res.status(400).send("Missing session ID");
-      return;
-    }
-    if (!sessions[sessionId]) {
-      res.status(404).send("Session not found");
-      return;
-    }
-    if (getSessionIdentity(auth) !== sessions[sessionId].identity) {
-      res.status(403).send("Forbidden: identity mismatch");
-      return;
-    }
-    await sessions[sessionId].transport.handleRequest(req, res);
+  app.delete("/mcp", bearerAuth, (_req, res) => {
+    res.status(405).json({
+      jsonrpc: "2.0",
+      error: { code: -32000, message: "Session termination not supported (stateless server)" },
+      id: null
+    });
   });
   const httpServer = app.listen(port, () => {
     console.error(`Kadoa MCP HTTP Server listening on port ${port}`);
   });
   const shutdown = async () => {
     console.error("Shutting down HTTP server...");
-    for (const sid of Object.keys(sessions)) {
-      await sessions[sid].transport.close();
-      delete sessions[sid];
-    }
     await store.disconnect();
     httpServer.close();
     process.exit(0);
@@ -55199,7 +55176,6 @@ var init_http2 = __esm(async () => {
   init_streamableHttp();
   init_router();
   init_bearerAuth();
-  init_types2();
   init_auth2();
   init_redis_store();
   await init_src();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.3.6-rc.7",
+  "version": "0.3.6-rc.8",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",