@kadoa/mcp 0.3.9-rc.2 → 0.3.9-rc.3

package/dist/index.js

@@ -49167,37 +49167,13 @@ function createKadoaClient(auth) {
   });
   return client;
 }
-var refreshRawMutex, ctxRefreshMutex;
+var ctxRefreshMutex;
 var init_client = __esm(() => {
   init_dist2();
-  refreshRawMutex = new Map;
   ctxRefreshMutex = new WeakMap;
 });
 
 // src/client.ts
-var exports_client = {};
-__export(exports_client, {
-  refreshSupabaseJwtRaw: () => refreshSupabaseJwtRaw,
-  refreshSupabaseJwt: () => refreshSupabaseJwt,
-  isJwtExpired: () => isJwtExpired,
-  getValidJwt: () => getValidJwt,
-  decodeJwtClaims: () => decodeJwtClaims,
-  createKadoaClient: () => createKadoaClient2,
-  SessionExpiredError: () => SessionExpiredError,
-  KadoaSdkException: () => KadoaSdkException,
-  KadoaClient: () => KadoaClient
-});
-function createKadoaClient2(auth) {
-  const client = new KadoaClient({ bearerToken: auth.jwt });
-  client.axiosInstance.interceptors.request.use((config2) => {
-    config2.headers["x-kadoa-source"] = "mcp";
-    if (auth.teamId) {
-      config2.headers["x-team-id"] = auth.teamId;
-    }
-    return config2;
-  });
-  return client;
-}
 function decodeJwtClaims(jwt2) {
   try {
     const payload = JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
@@ -49219,57 +49195,36 @@ function isJwtExpired(jwt2) {
     return true;
   }
 }
-async function refreshSupabaseJwtRaw(supabaseRefreshToken) {
-  const inflight = refreshRawMutex2.get(supabaseRefreshToken);
-  if (inflight) {
-    console.error(`[JWT_REFRESH] DEDUP: reusing in-flight raw refresh`);
-    return inflight;
+async function refreshSupabaseJwt(ctx) {
+  if (!ctx.supabaseRefreshToken) {
+    console.error("[JWT_REFRESH] No refresh token available, cannot refresh");
+    return;
   }
-  const promise3 = _doRefreshRaw(supabaseRefreshToken).finally(() => {
-    refreshRawMutex2.delete(supabaseRefreshToken);
-  });
-  refreshRawMutex2.set(supabaseRefreshToken, promise3);
-  return promise3;
-}
-async function _doRefreshRaw(supabaseRefreshToken) {
   const supabaseUrl = process.env.SUPABASE_URL;
   if (!supabaseUrl) {
     console.error("[JWT_REFRESH] SUPABASE_URL not set, cannot refresh");
-    return null;
-  }
-  const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      apikey: process.env.SUPABASE_ANON_KEY
-    },
-    body: JSON.stringify({ refresh_token: supabaseRefreshToken })
-  });
-  if (res.ok) {
-    const data = await res.json();
-    return { jwt: data.access_token, refreshToken: data.refresh_token };
-  }
-  const body = await res.text().catch(() => "");
-  console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status} (refreshToken=${supabaseRefreshToken.slice(0, 12)}...): ${body}`);
-  if (body.includes("session_expired") || body.includes("refresh_token_not_found") || body.includes("refresh_token_already_used")) {
-    throw new SessionExpiredError("Your Kadoa session has expired due to inactivity. Please reconnect to re-authenticate.");
-  }
-  return null;
-}
-async function refreshSupabaseJwt(ctx) {
-  if (!ctx.supabaseRefreshToken) {
-    console.error("[JWT_REFRESH] No refresh token available, cannot refresh");
     return;
   }
   try {
     const refreshToken = ctx.supabaseRefreshToken;
     console.error(`[JWT_REFRESH] Refreshing Supabase JWT (refreshToken=${refreshToken.slice(0, 12)}..., team=${ctx.teamId ?? "unknown"})`);
-    const result = await refreshSupabaseJwtRaw(refreshToken);
-    if (!result)
+    const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        apikey: process.env.SUPABASE_ANON_KEY
+      },
+      body: JSON.stringify({ refresh_token: refreshToken })
+    });
+    if (!res.ok) {
+      const body = await res.text().catch(() => "");
+      console.error(`[JWT_REFRESH] FAIL: Supabase returned ${res.status} (refreshToken=${refreshToken.slice(0, 12)}...): ${body}`);
       return;
-    ctx.supabaseJwt = result.jwt;
-    ctx.supabaseRefreshToken = result.refreshToken;
-    ctx.client.setBearerToken(result.jwt);
+    }
+    const data = await res.json();
+    ctx.supabaseJwt = data.access_token;
+    ctx.supabaseRefreshToken = data.refresh_token;
+    ctx.client.setBearerToken(data.access_token);
     try {
       await ctx.persist?.({
         supabaseJwt: ctx.supabaseJwt,
@@ -49279,11 +49234,9 @@ async function refreshSupabaseJwt(ctx) {
     } catch (e) {
       console.error("[JWT_REFRESH] WARN: persist failed, tokens updated in-memory only:", e);
     }
-    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"}, newRefreshToken=${result.refreshToken.slice(0, 12)}...)`);
-    return result.jwt;
+    console.error(`[JWT_REFRESH] OK: token refreshed (team=${ctx.teamId ?? "unknown"}, newRefreshToken=${data.refresh_token.slice(0, 12)}...)`);
+    return data.access_token;
   } catch (error48) {
-    if (error48 instanceof SessionExpiredError)
-      throw error48;
     console.error("[JWT_REFRESH] FAIL: threw", error48);
     return;
   }
@@ -49304,16 +49257,9 @@ async function getValidJwt(ctx) {
   ctxRefreshMutex2.set(ctx, promise3);
   return promise3;
 }
-var SessionExpiredError, refreshRawMutex2, ctxRefreshMutex2;
+var ctxRefreshMutex2;
 var init_client2 = __esm(() => {
   init_dist2();
-  SessionExpiredError = class SessionExpiredError extends Error {
-    constructor(message) {
-      super(message ?? "Supabase session expired. Please re-authenticate.");
-      this.name = "SessionExpiredError";
-    }
-  };
-  refreshRawMutex2 = new Map;
   ctxRefreshMutex2 = new WeakMap;
 });
 
@@ -49338,6 +49284,9 @@ function coerceArray(wrapPlainString = false) {
 function isRealTimeInterval(interval) {
   return interval?.toUpperCase().replace("-", "_") === "REAL_TIME";
 }
+function workflowDashboardUrl(workflowId) {
+  return `${DASHBOARD_BASE_URL}/workflow/${workflowId}`;
+}
 function jsonResult(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
 }
@@ -49431,10 +49380,6 @@ function registerTools(server, ctx) {
         }
         return await handler(...args);
       } catch (error48) {
-        if (error48 instanceof SessionExpiredError) {
-          console.error(`[Tool Error] ${name}: session expired, user must re-authenticate`);
-          return errorResult("Your session has expired. Please reconnect the MCP server to re-authenticate.");
-        }
         let message = classifyError(error48);
         if (KadoaHttpException.isInstance(error48) && error48.httpStatus === 403) {
           try {
@@ -49636,6 +49581,7 @@ function registerTools(server, ctx) {
     return jsonResult({
       success: true,
       workflowId: workflow.workflowId,
+      dashboardUrl: workflowDashboardUrl(workflow.workflowId),
       message
     });
   }));
@@ -49680,6 +49626,7 @@ function registerTools(server, ctx) {
     return jsonResult({
       success: true,
       workflowId: workflow.workflowId,
+      dashboardUrl: workflowDashboardUrl(workflow.workflowId),
       message
     });
   }));
@@ -49699,6 +49646,7 @@ function registerTools(server, ctx) {
       workflows: workflows.map((w) => ({
         id: w.id,
         name: w.name,
+        dashboardUrl: workflowDashboardUrl(w.id),
         status: w.displayState ?? w.state,
         urls: w.urls,
         totalRecords: w.totalRecords,
@@ -49721,6 +49669,7 @@ function registerTools(server, ctx) {
     return jsonResult({
       id: workflow.id,
       name: workflow.name,
+      dashboardUrl: workflowDashboardUrl(workflow.id),
       description: workflow.description,
       status: workflow.displayState ?? workflow.state,
       urls: workflow.urls,
@@ -50148,7 +50097,7 @@ function registerTools(server, ctx) {
     });
   }));
 }
-var SchemaFieldShape;
+var SchemaFieldShape, DASHBOARD_BASE_URL = "https://app.kadoa.com";
 var init_tools = __esm(() => {
   init_zod();
   init_dist2();
@@ -54159,6 +54108,45 @@ function generatePKCE() {
   const challenge = createHash2("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
+async function refreshSupabaseToken(supabaseRefreshToken, context) {
+  const inflight = supabaseRefreshMutex.get(supabaseRefreshToken);
+  if (inflight) {
+    console.error(`[AUTH] REFRESH_DEDUP: reusing in-flight refresh (${context})`);
+    return inflight;
+  }
+  const promise3 = (async () => {
+    const supabaseUrl = process.env.SUPABASE_URL;
+    if (!supabaseUrl || !supabaseRefreshToken)
+      return null;
+    try {
+      const res = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=refresh_token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          apikey: process.env.SUPABASE_ANON_KEY
+        },
+        body: JSON.stringify({ refresh_token: supabaseRefreshToken })
+      });
+      if (res.ok) {
+        const data = await res.json();
+        const newClaims = jwtClaims(data.access_token);
+        console.log(`[AUTH] REFRESH_OK: Supabase JWT refreshed (${context}, newEmail=${newClaims.email})`);
+        return { jwt: data.access_token, refreshToken: data.refresh_token };
+      }
+      const body = await res.text().catch(() => "");
+      console.error(`[AUTH] REFRESH_FAIL: Supabase returned ${res.status} (${context}): ${body.slice(0, 200)}`);
+      return null;
+    } catch (err) {
+      console.error(`[AUTH] REFRESH_FAIL: Supabase refresh threw (${context}):`, err);
+      return null;
+    }
+  })();
+  supabaseRefreshMutex.set(supabaseRefreshToken, promise3);
+  promise3.finally(() => {
+    supabaseRefreshMutex.delete(supabaseRefreshToken);
+  });
+  return promise3;
+}
 function jwtClaims(jwt2) {
   try {
     const payload = JSON.parse(Buffer.from(jwt2.split(".")[1], "base64url").toString());
@@ -54466,22 +54454,12 @@ class KadoaOAuthProvider {
     let { supabaseJwt, supabaseRefreshToken } = entry;
     const claims = jwtClaims(entry.supabaseJwt);
     const context = `email=${claims.email}, team=${entry.teamId}`;
-    try {
-      const { refreshSupabaseJwtRaw: refreshSupabaseJwtRaw2, SessionExpiredError: SessionExpiredError2 } = await Promise.resolve().then(() => (init_client2(), exports_client));
-      const refreshed = await refreshSupabaseJwtRaw2(supabaseRefreshToken);
-      if (refreshed) {
-        supabaseJwt = refreshed.jwt;
-        supabaseRefreshToken = refreshed.refreshToken;
-        console.error(`[AUTH] REFRESH_OK: Supabase JWT refreshed (${context})`);
-      } else {
-        console.error(`[AUTH] REFRESH_WARN: using stale Supabase JWT as fallback (${context})`);
-      }
-    } catch (error48) {
-      if (error48 instanceof Error && error48.name === "SessionExpiredError") {
-        console.error(`[AUTH] REFRESH_DEAD: session permanently expired (${context}): ${error48.message}`);
-        throw new InvalidTokenError("Supabase session expired. Please re-authenticate.");
-      }
-      console.error(`[AUTH] REFRESH_WARN: unexpected error, using stale JWT (${context}):`, error48);
+    const refreshed = await refreshSupabaseToken(supabaseRefreshToken, context);
+    if (refreshed) {
+      supabaseJwt = refreshed.jwt;
+      supabaseRefreshToken = refreshed.refreshToken;
+    } else {
+      console.error(`[AUTH] REFRESH_WARN: using stale Supabase JWT as fallback (${context})`);
     }
     const freshClaims = jwtClaims(supabaseJwt);
     const teamId = freshClaims.activeTeamId ?? entry.teamId;
@@ -54608,7 +54586,7 @@ class KadoaOAuthProvider {
       codeChallenge: pending.params.codeChallenge,
       clientId: pending.client.client_id,
       redirectUri: pending.params.redirectUri,
-      expiresAt: Date.now() + 600000
+      expiresAt: Date.now() + 10 * 60 * 1000
     }, 600);
     const redirectUrl = new URL(pending.params.redirectUri);
     redirectUrl.searchParams.set("code", mcpCode);
@@ -55037,11 +55015,12 @@ function renderLoginPage(state, error48) {
 function escapeHtml(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL;
+var TEAM_SELECTION_TTL, ACCESS_TOKEN_TTL, supabaseRefreshMutex;
 var init_auth2 = __esm(() => {
   init_errors4();
   TEAM_SELECTION_TTL = 10 * 60 * 1000;
   ACCESS_TOKEN_TTL = 7 * 24 * 3600;
+  supabaseRefreshMutex = new Map;
 });
 
 // src/redis-store.ts
@@ -55234,39 +55213,6 @@ async function startHttpServer(options) {
       return;
     }
     const identity = `jwt:${auth.userId.slice(0, 8)}...:team=${auth.teamId.slice(0, 8)}...`;
-    if (isJwtExpired(auth.jwt)) {
-      try {
-        const refreshed = await refreshSupabaseJwtRaw(auth.refreshToken);
-        if (refreshed) {
-          auth.jwt = refreshed.jwt;
-          auth.refreshToken = refreshed.refreshToken;
-          const entry = await store.get("access_tokens", auth.mcpToken);
-          if (entry) {
-            const remainingMs = entry.expiresAt - Date.now();
-            if (remainingMs > 0) {
-              await store.set("access_tokens", auth.mcpToken, {
-                ...entry,
-                supabaseJwt: refreshed.jwt,
-                supabaseRefreshToken: refreshed.refreshToken
-              }, Math.ceil(remainingMs / 1000));
-              console.error(`[PROACTIVE_REFRESH] OK: JWT refreshed on ${method} (${identity})`);
-            }
-          }
-        }
-      } catch (error48) {
-        if (error48 instanceof SessionExpiredError) {
-          console.error(`[PROACTIVE_REFRESH] Session dead on ${method} (${identity}): ${error48.message}`);
-          await store.del("access_tokens", auth.mcpToken);
-          res.status(401).json({
-            jsonrpc: "2.0",
-            error: { code: -32001, message: error48.message },
-            id: req.body?.id ?? null
-          });
-          return;
-        }
-        console.error(`[PROACTIVE_REFRESH] WARN: refresh failed on ${method}, continuing with stale JWT`, error48);
-      }
-    }
     try {
       console.error(`[MCP] POST method=${method} auth=${identity}`);
       const transport = new StreamableHTTPServerTransport({
@@ -55344,7 +55290,6 @@ var init_http2 = __esm(async () => {
   init_bearerAuth();
   init_auth2();
   init_redis_store();
-  init_client2();
   await init_src();
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kadoa/mcp",
-  "version": "0.3.9-rc.2",
+  "version": "0.3.9-rc.3",
   "description": "Kadoa MCP Server — manage workflows from Claude Desktop, Cursor, and other MCP clients",
   "type": "module",
   "main": "dist/index.js",