@kadoa/mcp 0.3.8 → 0.3.9-rc.1

package/dist/index.js

@@ -48958,13 +48958,37 @@ function createKadoaClient(auth) {
   });
   return client;
 }
-var ctxRefreshMutex;
+var refreshRawMutex, ctxRefreshMutex;
 var init_client = __esm(() => {
   init_dist2();
+  refreshRawMutex = new Map;
   ctxRefreshMutex = new WeakMap;
 });
 
 // src/client.ts
+var exports_client = {};
+__export(exports_client, {
+  refreshSupabaseJwtRaw: () => refreshSupabaseJwtRaw,
+  refreshSupabaseJwt: () => refreshSupabaseJwt,
+  isJwtExpired: () => isJwtExpired,
+  getValidJwt: () => getValidJwt,
+  decodeJwtClaims: () => decodeJwtClaims,
+  createKadoaClient: () => createKadoaClient2,
+  SessionExpiredError: () => SessionExpiredError,
+  KadoaSdkException: () => KadoaSdkException,
+  KadoaClient: () => KadoaClient
+});
+function createKadoaClient2(auth) {
+  const client = new KadoaClient({ bearerToken: auth.jwt });
+  client.axiosInstance.interceptors.request.use((config2) => {
+    config2.headers["x-kadoa-source"] = "mcp";
+    if (auth.teamId) {
+      config2.headers["x-team-id"] = auth.teamId;
+    }
+    return config2;
+  });
+  return client;
+}
 function decodeJwtClaims(jwt2) {
   try {
     const payload = JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
@@ -48986,36 +49010,57 @@ function isJwtExpired(jwt2) {
     return true;
   }
 }
-async function refreshSupabaseJwt(ctx) {
-  if (!ctx.supabaseRefreshToken) {
-    console.error("[JWT_REFRESH] No refresh token available, cannot refresh");
-    return;
+async function refreshSupabaseJwtRaw(supabaseRefreshToken) {
+  const inflight = refreshRawMutex2.get(supabaseRefreshToken);
+  if (inflight) {
+    console.error(`[JWT_REFRESH] DEDUP: reusing in-flight raw refresh`);
+    return inflight;
   }
+  const promise3 = _doRefreshRaw(supabaseRefreshToken).finally(() => {
+    refreshRawMutex2.delete(supabaseRefreshToken);
+  });
+  refreshRawMutex2.set(supabaseRefreshToken, promise3);
+  return promise3;
+}
+async function _doRefreshRaw(supabaseRefreshToken) {
   const supabaseUrl = process.env.SUPABASE_URL;
   if (!supabaseUrl) {
     console.error("[JWT_REFRESH] SUPABASE_URL not set, cannot refresh");
+    return null;
+  }
+  const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      apikey: process.env.SUPABASE_ANON_KEY
+    },
+    body: JSON.stringify({ refresh_token: supabaseRefreshToken })
+  });
+  if (res.ok) {
+    const data = await res.json();
+    return { jwt: data.access_token, refreshToken: data.refresh_token };
+  }
+  const body = await res.text().catch(() => "");
+  console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status} (refreshToken=${supabaseRefreshToken.slice(0, 12)}...): ${body}`);
+  if (body.includes("session_expired") || body.includes("refresh_token_not_found") || body.includes("refresh_token_already_used")) {
+    throw new SessionExpiredError("Your Kadoa session has expired due to inactivity. Please reconnect to re-authenticate.");
+  }
+  return null;
+}
+async function refreshSupabaseJwt(ctx) {
+  if (!ctx.supabaseRefreshToken) {
+    console.error("[JWT_REFRESH] No refresh token available, cannot refresh");
     return;
   }
   try {
     const refreshToken = ctx.supabaseRefreshToken;
     console.error(`[JWT_REFRESH] Refreshing Supabase JWT (refreshToken=${refreshToken.slice(0, 12)}..., team=${ctx.teamId ?? "unknown"})`);
-    const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        apikey: process.env.SUPABASE_ANON_KEY
-      },
-      body: JSON.stringify({ refresh_token: refreshToken })
-    });
-    if (!res.ok) {
-      const body = await res.text().catch(() => "");
-      console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status} (refreshToken=${refreshToken.slice(0, 12)}...): ${body}`);
+    const result = await refreshSupabaseJwtRaw(refreshToken);
+    if (!result)
       return;
-    }
-    const data = await res.json();
-    ctx.supabaseJwt = data.access_token;
-    ctx.supabaseRefreshToken = data.refresh_token;
-    ctx.client.setBearerToken(data.access_token);
+    ctx.supabaseJwt = result.jwt;
+    ctx.supabaseRefreshToken = result.refreshToken;
+    ctx.client.setBearerToken(result.jwt);
     try {
       await ctx.persist?.({
         supabaseJwt: ctx.supabaseJwt,
@@ -49025,9 +49070,11 @@ async function refreshSupabaseJwt(ctx) {
     } catch (e) {
       console.error("[JWT_REFRESH] WARN: persist failed, tokens updated in-memory only:", e);
     }
-    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"}, newRefreshToken=${data.refresh_token.slice(0, 12)}...)`);
-    return data.access_token;
+    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"}, newRefreshToken=${result.refreshToken.slice(0, 12)}...)`);
+    return result.jwt;
   } catch (error48) {
+    if (error48 instanceof SessionExpiredError)
+      throw error48;
     console.error("[JWT_REFRESH] FAIL: threw", error48);
     return;
   }
@@ -49048,9 +49095,16 @@ async function getValidJwt(ctx) {
   ctxRefreshMutex2.set(ctx, promise3);
   return promise3;
 }
-var ctxRefreshMutex2;
+var SessionExpiredError, refreshRawMutex2, ctxRefreshMutex2;
 var init_client2 = __esm(() => {
   init_dist2();
+  SessionExpiredError = class SessionExpiredError extends Error {
+    constructor(message) {
+      super(message ?? "Supabase session expired. Please re-authenticate.");
+      this.name = "SessionExpiredError";
+    }
+  };
+  refreshRawMutex2 = new Map;
   ctxRefreshMutex2 = new WeakMap;
 });
 
@@ -49168,6 +49222,10 @@ function registerTools(server, ctx) {
         }
         return await handler(...args);
       } catch (error48) {
+        if (error48 instanceof SessionExpiredError) {
+          console.error(`[Tool Error] ${name}: session expired, user must re-authenticate`);
+          return errorResult("Your session has expired. Please reconnect the MCP server to re-authenticate.");
+        }
         let message = classifyError(error48);
         if (KadoaHttpException.isInstance(error48) && error48.httpStatus === 403) {
           try {
@@ -53892,45 +53950,6 @@ function generatePKCE() {
   const challenge = createHash2("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
-async function refreshSupabaseToken(supabaseRefreshToken, context) {
-  const inflight = supabaseRefreshMutex.get(supabaseRefreshToken);
-  if (inflight) {
-    console.error(`[AUTH] REFRESH_DEDUP: reusing in-flight refresh (${context})`);
-    return inflight;
-  }
-  const promise3 = (async () => {
-    const supabaseUrl = process.env.SUPABASE_URL;
-    if (!supabaseUrl || !supabaseRefreshToken)
-      return null;
-    try {
-      const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          apikey: process.env.SUPABASE_ANON_KEY
-        },
-        body: JSON.stringify({ refresh_token: supabaseRefreshToken })
-      });
-      if (res.ok) {
-        const data = await res.json();
-        const newClaims = jwtClaims(data.access_token);
-        console.log(`[AUTH] REFRESH_OK: Supabase JWT refreshed (${context}, newEmail=${newClaims.email})`);
-        return { jwt: data.access_token, refreshToken: data.refresh_token };
-      }
-      const body = await res.text().catch(() => "");
-      console.error(`[AUTH] REFRESH_FAIL: Supabase returned ${res.status} (${context}): ${body.slice(0, 200)}`);
-      return null;
-    } catch (err) {
-      console.error(`[AUTH] REFRESH_FAIL: Supabase refresh threw (${context}):`, err);
-      return null;
-    }
-  })();
-  supabaseRefreshMutex.set(supabaseRefreshToken, promise3);
-  promise3.finally(() => {
-    supabaseRefreshMutex.delete(supabaseRefreshToken);
-  });
-  return promise3;
-}
 function jwtClaims(jwt2) {
   try {
     const payload = JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
@@ -54238,12 +54257,22 @@ class KadoaOAuthProvider {
     let { supabaseJwt, supabaseRefreshToken } = entry;
     const claims = jwtClaims(entry.supabaseJwt);
     const context = `email=${claims.email}, team=${entry.teamId}`;
-    const refreshed = await refreshSupabaseToken(supabaseRefreshToken, context);
-    if (refreshed) {
-      supabaseJwt = refreshed.jwt;
-      supabaseRefreshToken = refreshed.refreshToken;
-    } else {
-      console.error(`[AUTH] REFRESH_WARN: using stale Supabase JWT as fallback (${context})`);
+    try {
+      const { refreshSupabaseJwtRaw: refreshSupabaseJwtRaw2, SessionExpiredError: SessionExpiredError2 } = await Promise.resolve().then(() => (init_client2(), exports_client));
+      const refreshed = await refreshSupabaseJwtRaw2(supabaseRefreshToken);
+      if (refreshed) {
+        supabaseJwt = refreshed.jwt;
+        supabaseRefreshToken = refreshed.refreshToken;
+        console.error(`[AUTH] REFRESH_OK: Supabase JWT refreshed (${context})`);
+      } else {
+        console.error(`[AUTH] REFRESH_WARN: using stale Supabase JWT as fallback (${context})`);
+      }
+    } catch (error48) {
+      if (error48 instanceof Error && error48.name === "SessionExpiredError") {
+        console.error(`[AUTH] REFRESH_DEAD: session permanently expired (${context}): ${error48.message}`);
+        throw new InvalidTokenError("Supabase session expired. Please re-authenticate.");
+      }
+      console.error(`[AUTH] REFRESH_WARN: unexpected error, using stale JWT (${context}):`, error48);
     }
     const freshClaims = jwtClaims(supabaseJwt);
     const teamId = freshClaims.activeTeamId ?? entry.teamId;
@@ -54370,7 +54399,7 @@ class KadoaOAuthProvider {
       codeChallenge: pending.params.codeChallenge,
       clientId: pending.client.client_id,
       redirectUri: pending.params.redirectUri,
-      expiresAt: Date.now() + 10 * 60 * 1000
+      expiresAt: Date.now() + 600000
     }, 600);
     const redirectUrl = new URL(pending.params.redirectUri);
     redirectUrl.searchParams.set("code", mcpCode);
@@ -54799,12 +54828,11 @@ function renderLoginPage(state, error48) {
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL, supabaseRefreshMutex;
+var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL;
 var init_auth2 = __esm(() => {
   init_errors4();
   TEAM_SELECTION_TTL = 10 * 60 * 1000;
   ACCESS_TOKEN_TTL = 7 * 24 * 3600;
-  supabaseRefreshMutex = new Map;
 });
 
 // src/redis-store.ts
@@ -54997,6 +55025,39 @@ async function startHttpServer(options) {
       return;
     }
     const identity = `jwt:${auth.userId.slice(0, 8)}...:team=${auth.teamId.slice(0, 8)}...`;
+    if (isJwtExpired(auth.jwt)) {
+      try {
+        const refreshed = await refreshSupabaseJwtRaw(auth.refreshToken);
+        if (refreshed) {
+          auth.jwt = refreshed.jwt;
+          auth.refreshToken = refreshed.refreshToken;
+          const entry = await store.get("access_tokens", auth.mcpToken);
+          if (entry) {
+            const remainingMs = entry.expiresAt - Date.now();
+            if (remainingMs > 0) {
+              await store.set("access_tokens", auth.mcpToken, {
+                ...entry,
+                supabaseJwt: refreshed.jwt,
+                supabaseRefreshToken: refreshed.refreshToken
+              }, Math.ceil(remainingMs / 1000));
+              console.error(`[PROACTIVE_REFRESH] OK: JWT refreshed on ${method} (${identity})`);
+            }
+          }
+        }
+      } catch (error48) {
+        if (error48 instanceof SessionExpiredError) {
+          console.error(`[PROACTIVE_REFRESH] Session dead on ${method} (${identity}): ${error48.message}`);
+          await store.del("access_tokens", auth.mcpToken);
+          res.status(401).json({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: error48.message },
+            id: req.body?.id ?? null
+          });
+          return;
+        }
+        console.error(`[PROACTIVE_REFRESH] WARN: refresh failed on ${method}, continuing with stale JWT`, error48);
+      }
+    }
     try {
       console.error(`[MCP] POST method=${method} auth=${identity}`);
       const transport = new StreamableHTTPServerTransport({
@@ -55074,6 +55135,7 @@ var init_http2 = __esm(async () => {
   init_bearerAuth();
   init_auth2();
   init_redis_store();
+  init_client2();
   await init_src();
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.3.8",
+  "version": "0.3.9-rc.1",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",