@mcp-ts/sdk 1.3.5 → 1.3.6

package/src/server/storage/supabase-backend.ts

@@ -0,0 +1,227 @@
+import type { SupabaseClient } from '@supabase/supabase-js';
+import { StorageBackend, SessionData } from './types.js';
+import { SESSION_TTL_SECONDS } from '../../shared/constants.js';
+
+export class SupabaseStorageBackend implements StorageBackend {
+    private readonly DEFAULT_TTL = SESSION_TTL_SECONDS;
+
+    constructor(private supabase: SupabaseClient) {}
+    
+    async init(): Promise<void> {
+        // Validate that the table exists
+        const { error } = await this.supabase
+            .from('mcp_sessions')
+            .select('session_id')
+            .limit(0);
+
+        if (error) {
+            // Postgres error code 42P01 is "relation does not exist"
+            if (error.code === '42P01') {
+                throw new Error(
+                    '[SupabaseStorage] Table "mcp_sessions" not found in your database. ' +
+                    'Please run "npx mcp-ts supabase-init" in your project to set up the required table and RLS policies.'
+                );
+            }
+            throw new Error(`[SupabaseStorage] Initialization check failed: ${error.message}`);
+        }
+
+        console.log('[mcp-ts][Storage] Supabase: ✓ "mcp_sessions" table verified.');
+    }
+
+    generateSessionId(): string {
+        return crypto.randomUUID();
+    }
+
+    private mapRowToSessionData(row: any): SessionData {
+        return {
+            sessionId: row.session_id,
+            serverId: row.server_id,
+            serverName: row.server_name,
+            serverUrl: row.server_url,
+            transportType: row.transport_type,
+            callbackUrl: row.callback_url,
+            createdAt: new Date(row.created_at).getTime(),
+            identity: row.identity,
+            headers: row.headers,
+            active: row.active,
+            clientInformation: row.client_information,
+            tokens: row.tokens,
+            codeVerifier: row.code_verifier,
+            clientId: row.client_id,
+        };
+    }
+
+    async createSession(session: SessionData, ttl?: number): Promise<void> {
+        const { sessionId, identity } = session;
+        if (!sessionId || !identity) throw new Error('identity and sessionId required');
+
+        const effectiveTtl = ttl ?? this.DEFAULT_TTL;
+        const expiresAt = new Date(Date.now() + effectiveTtl * 1000).toISOString();
+
+        const { error } = await this.supabase
+            .from('mcp_sessions')
+            .insert({
+                session_id: sessionId,
+                user_id: identity, // Maps user_id to identity to support RLS using auth.uid()
+                server_id: session.serverId,
+                server_name: session.serverName,
+                server_url: session.serverUrl,
+                transport_type: session.transportType,
+                callback_url: session.callbackUrl,
+                created_at: new Date(session.createdAt || Date.now()).toISOString(),
+                identity: identity,
+                headers: session.headers,
+                active: session.active ?? false,
+                client_information: session.clientInformation,
+                tokens: session.tokens,
+                code_verifier: session.codeVerifier,
+                client_id: session.clientId,
+                expires_at: expiresAt
+            });
+
+        if (error) {
+            // Postgres error code 23505 is unique violation
+            if (error.code === '23505') {
+                throw new Error(`Session ${sessionId} already exists`);
+            }
+            throw new Error(`Failed to create session in Supabase: ${error.message}`);
+        }
+    }
+
+    async updateSession(identity: string, sessionId: string, data: Partial<SessionData>, ttl?: number): Promise<void> {
+        const effectiveTtl = ttl ?? this.DEFAULT_TTL;
+        const expiresAt = new Date(Date.now() + effectiveTtl * 1000).toISOString();
+
+        // Convert the camelCase keys to snake_case for Supabase
+        const updateData: any = {
+            expires_at: expiresAt,
+            updated_at: new Date().toISOString()
+        };
+
+        if ('serverId' in data) updateData.server_id = data.serverId;
+        if ('serverName' in data) updateData.server_name = data.serverName;
+        if ('serverUrl' in data) updateData.server_url = data.serverUrl;
+        if ('transportType' in data) updateData.transport_type = data.transportType;
+        if ('callbackUrl' in data) updateData.callback_url = data.callbackUrl;
+        if ('active' in data) updateData.active = data.active;
+        if ('headers' in data) updateData.headers = data.headers;
+        if ('clientInformation' in data) updateData.client_information = data.clientInformation;
+        if ('tokens' in data) updateData.tokens = data.tokens;
+        if ('codeVerifier' in data) updateData.code_verifier = data.codeVerifier;
+        if ('clientId' in data) updateData.client_id = data.clientId;
+
+        const { data: updatedRows, error } = await this.supabase
+            .from('mcp_sessions')
+            .update(updateData)
+            .eq('identity', identity)
+            .eq('session_id', sessionId)
+            .select('id');
+
+        if (error) {
+            throw new Error(`Failed to update session: ${error.message}`);
+        }
+
+        if (!updatedRows || updatedRows.length === 0) {
+            throw new Error(`Session ${sessionId} not found for identity ${identity}`);
+        }
+    }
+
+    async getSession(identity: string, sessionId: string): Promise<SessionData | null> {
+        const { data, error } = await this.supabase
+            .from('mcp_sessions')
+            .select('*')
+            .eq('identity', identity)
+            .eq('session_id', sessionId)
+            .maybeSingle();
+
+        if (error) {
+            console.error('[SupabaseStorage] Failed to get session:', error);
+            return null;
+        }
+
+        if (!data) return null;
+
+        return this.mapRowToSessionData(data);
+    }
+
+    async getIdentitySessionsData(identity: string): Promise<SessionData[]> {
+        const { data, error } = await this.supabase
+            .from('mcp_sessions')
+            .select('*')
+            .eq('identity', identity);
+
+        if (error) {
+            console.error(`[SupabaseStorage] Failed to get session data for ${identity}:`, error);
+            return [];
+        }
+
+        return data.map(row => this.mapRowToSessionData(row));
+    }
+
+    async removeSession(identity: string, sessionId: string): Promise<void> {
+        const { error } = await this.supabase
+            .from('mcp_sessions')
+            .delete()
+            .eq('identity', identity)
+            .eq('session_id', sessionId);
+
+        if (error) {
+            console.error('[SupabaseStorage] Failed to remove session:', error);
+        }
+    }
+
+    async getIdentityMcpSessions(identity: string): Promise<string[]> {
+        const { data, error } = await this.supabase
+            .from('mcp_sessions')
+            .select('session_id')
+            .eq('identity', identity);
+
+        if (error) {
+            console.error(`[SupabaseStorage] Failed to get sessions for ${identity}:`, error);
+            return [];
+        }
+
+        return data.map(row => row.session_id);
+    }
+
+    async getAllSessionIds(): Promise<string[]> {
+        const { data, error } = await this.supabase
+            .from('mcp_sessions')
+            .select('session_id');
+
+        if (error) {
+            console.error('[SupabaseStorage] Failed to get all sessions:', error);
+            return [];
+        }
+
+        return data.map(row => row.session_id);
+    }
+
+    async clearAll(): Promise<void> {
+        // Warning: This deletes everything. Typically only used in testing.
+        const { error } = await this.supabase
+            .from('mcp_sessions')
+            .delete()
+            .neq('session_id', ''); // Delete all rows trick
+            
+        if (error) {
+            console.error('[SupabaseStorage] Failed to clear sessions:', error);
+        }
+    }
+
+    async cleanupExpiredSessions(): Promise<void> {
+        const { error } = await this.supabase
+            .from('mcp_sessions')
+            .delete()
+            .lt('expires_at', new Date().toISOString());
+
+        if (error) {
+            console.error('[SupabaseStorage] Failed to cleanup expired sessions:', error);
+        }
+    }
+
+    async disconnect(): Promise<void> {
+        // Supabase client handles its own connection pooling over HTTP, 
+        // there is no explicit disconnect method.
+    }
+}

package/src/shared/event-routing.ts

@@ -1,28 +1,28 @@
-import type { McpConnectionEvent, McpObservabilityEvent } from './events.js';
-import type { McpRpcResponse } from './types.js';
-
-export function isRpcResponseEvent(
-  event: McpConnectionEvent | McpObservabilityEvent | McpRpcResponse
-): event is McpRpcResponse {
-  return 'id' in event && ('result' in event || 'error' in event);
-}
-
-export function isConnectionEvent(
-  event: McpConnectionEvent | McpObservabilityEvent | McpRpcResponse
-): event is McpConnectionEvent {
-  if (!('type' in event)) {
-    return false;
-  }
-
-  switch (event.type) {
-    case 'state_changed':
-    case 'tools_discovered':
-    case 'auth_required':
-    case 'error':
-    case 'disconnected':
-    case 'progress':
-      return true;
-    default:
-      return false;
-  }
-}
+import type { McpConnectionEvent, McpObservabilityEvent } from './events.js';
+import type { McpRpcResponse } from './types.js';
+
+export function isRpcResponseEvent(
+  event: McpConnectionEvent | McpObservabilityEvent | McpRpcResponse
+): event is McpRpcResponse {
+  return 'id' in event && ('result' in event || 'error' in event);
+}
+
+export function isConnectionEvent(
+  event: McpConnectionEvent | McpObservabilityEvent | McpRpcResponse
+): event is McpConnectionEvent {
+  if (!('type' in event)) {
+    return false;
+  }
+
+  switch (event.type) {
+    case 'state_changed':
+    case 'tools_discovered':
+    case 'auth_required':
+    case 'error':
+    case 'disconnected':
+    case 'progress':
+      return true;
+    default:
+      return false;
+  }
+}

package/supabase/migrations/20260330195700_install_mcp_sessions.sql

@@ -0,0 +1,84 @@
+-- Create the mcp_sessions table
+CREATE TABLE IF NOT EXISTS public.mcp_sessions (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    session_id TEXT NOT NULL UNIQUE,
+    user_id TEXT NOT NULL, -- Will store the Next.js user's ID or identity
+    server_id TEXT,
+    server_name TEXT,
+    server_url TEXT NOT NULL,
+    transport_type TEXT NOT NULL,
+    callback_url TEXT NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    expires_at TIMESTAMPTZ NOT NULL,
+    active BOOLEAN DEFAULT false,
+    identity TEXT NOT NULL,
+    headers JSONB,
+    client_information JSONB,
+    tokens JSONB,
+    code_verifier TEXT,
+    client_id TEXT
+);
+
+-- Add an index on identity and user_id for faster lookups
+CREATE INDEX IF NOT EXISTS idx_mcp_sessions_identity ON public.mcp_sessions(identity);
+CREATE INDEX IF NOT EXISTS idx_mcp_sessions_user_id ON public.mcp_sessions(user_id);
+-- Add an index on expires_at to speed up the cleanup job
+CREATE INDEX IF NOT EXISTS idx_mcp_sessions_expires_at ON public.mcp_sessions(expires_at);
+
+-- Trigger to automatically update the 'updated_at' column
+CREATE OR REPLACE FUNCTION public.set_current_timestamp_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+  NEW.updated_at = now();
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+DROP TRIGGER IF EXISTS trg_mcp_sessions_updated_at ON public.mcp_sessions;
+CREATE TRIGGER trg_mcp_sessions_updated_at
+BEFORE UPDATE ON public.mcp_sessions
+FOR EACH ROW
+EXECUTE FUNCTION public.set_current_timestamp_updated_at();
+
+-- Enable Row Level Security (RLS)
+ALTER TABLE public.mcp_sessions ENABLE ROW LEVEL SECURITY;
+
+-- Policy 1: Users can read their own sessions
+CREATE POLICY "Users can view their own sessions"
+ON public.mcp_sessions
+FOR SELECT
+TO authenticated
+USING (
+    auth.uid()::text = user_id OR auth.uid()::text = identity
+);
+
+-- Policy 2: Users can insert their own sessions
+CREATE POLICY "Users can insert their own sessions"
+ON public.mcp_sessions
+FOR INSERT
+TO authenticated
+WITH CHECK (
+    auth.uid()::text = user_id OR auth.uid()::text = identity
+);
+
+-- Policy 3: Users can update their own sessions
+CREATE POLICY "Users can update their own sessions"
+ON public.mcp_sessions
+FOR UPDATE
+TO authenticated
+USING (
+    auth.uid()::text = user_id OR auth.uid()::text = identity
+)
+WITH CHECK (
+    auth.uid()::text = user_id OR auth.uid()::text = identity
+);
+
+-- Policy 4: Users can delete their own sessions
+CREATE POLICY "Users can delete their own sessions"
+ON public.mcp_sessions
+FOR DELETE
+TO authenticated
+USING (
+    auth.uid()::text = user_id OR auth.uid()::text = identity
+);