@mcp-ts/sdk 2.3.3 → 2.4.0

package/src/server/storage/types.ts

@@ -5,6 +5,15 @@ import type {
     OAuthClientInformationMixed,
 } from '@modelcontextprotocol/sdk/shared/auth.js';
 
+export interface OAuthState {
+    nonce: string;
+    sessionId: string;
+    serverId: string;
+    createdAt: number;
+}
+
+export type SessionStatus = 'pending' | 'active';
+
 export interface Session {
     sessionId: string;
     serverId?: string; // Database server ID for mapping
@@ -13,20 +22,31 @@ export interface Session {
     transportType: 'sse' | 'streamable-http';
     callbackUrl: string;
     createdAt: number;
+    updatedAt?: number;
+    /**
+     * Storage-owned expiration timestamp for pending/inactive sessions.
+     * Active sessions use updatedAt-based dormancy cleanup instead.
+     */
+    expiresAt?: number | null;
     userId: string;
     headers?: Record<string, string>;
+    authUrl?: string | null;
     /**
-     * Session status marker used for TTL transitions:
-     * - false: short-lived intermediate/error/auth-pending session state
-     *          (keep this value when connection/auth is incomplete or failed)
-     * - true: active long-lived session state after successful connection/auth completion
-     */
-    active?: boolean;
-    // OAuth data (consolidated)
-    clientInformation?: OAuthClientInformationMixed;
-    tokens?: OAuthTokens;
-    codeVerifier?: string;
-    clientId?: string;
+     * Session status marker used for lifecycle cleanup:
+     * - pending: short-lived intermediate/auth-pending session state
+     * - active: restorable session after successful connection/auth completion
+     */
+    status?: SessionStatus;
+}
+
+export interface SessionCredentials {
+    sessionId: string;
+    userId: string;
+    clientInformation?: OAuthClientInformationMixed | null;
+    tokens?: OAuthTokens | null;
+    codeVerifier?: string | null;
+    clientId?: string | null;
+    oauthState?: OAuthState | null;
 }
 
 export type SessionMutationType = 'create' | 'update' | 'delete';
@@ -38,7 +58,6 @@ export interface SessionMutationEvent {
     timestamp: number;
     session?: Session;
     patch?: Partial<Session>;
-    ttl?: number;
 }
 
 export type SessionMutationListener = (event: SessionMutationEvent) => void | Promise<void>;
@@ -72,24 +91,38 @@ export interface SessionStore {
     /**
      * Creates a new session. Throws if session already exists.
      * @param session - Session data to create
-     * @param ttl - Optional TTL in seconds (defaults to backend's default)
      */
-    create(session: Session, ttl?: number): Promise<void>;
+    create(session: Session): Promise<void>;
 
     /**
      * Updates an existing session with partial data. Throws if session does not exist.
      * @param userId - User identifier
      * @param sessionId - Session identifier
      * @param data - Partial session data to update
-     * @param ttl - Optional TTL in seconds (defaults to backend's default)
      */
-    update(userId: string, sessionId: string, data: Partial<Session>, ttl?: number): Promise<void>;
+    update(userId: string, sessionId: string, data: Partial<Session>): Promise<void>;
+
+    /**
+     * Patches runtime credentials for an existing session.
+     * These values are separated from connection metadata in durable SQL stores.
+     */
+    patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void>;
 
     /**
      * Retrieves a session
      */
     get(userId: string, sessionId: string): Promise<Session | null>;
 
+    /**
+     * Retrieves runtime credentials for a session.
+     */
+    getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null>;
+
+    /**
+     * Clears runtime credentials without removing connection metadata.
+     */
+    clearCredentials(userId: string, sessionId: string): Promise<void>;
+
     /**
      * Gets full session data for all sessions owned by a user
      */

package/src/shared/constants.ts

@@ -3,9 +3,11 @@
  * Eliminates magic numbers and enables consistent configuration
  */
 
-// Redis TTL and Session Management
-export const SESSION_TTL_SECONDS = 43200; // 12 hours
+// Session lifecycle
 export const STATE_EXPIRATION_MS = 10 * 60 * 1000; // 10 minutes for OAuth state
+export const PENDING_SESSION_EXPIRATION_SECONDS = Math.floor(STATE_EXPIRATION_MS / 1000);
+export const DORMANT_SESSION_EXPIRATION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+export const DORMANT_SESSION_EXPIRATION_SECONDS = Math.floor(DORMANT_SESSION_EXPIRATION_MS / 1000);
 
 // Heartbeat and Connection
 export const DEFAULT_HEARTBEAT_INTERVAL_MS = 30000; // 30 seconds
@@ -13,16 +15,13 @@ export const DEFAULT_HEARTBEAT_INTERVAL_MS = 30000; // 30 seconds
 // Redis Key Prefixes
 export const REDIS_KEY_PREFIX = 'mcp:session:';
 
-// Token Management
-export const TOKEN_EXPIRY_BUFFER_MS = 5 * 60 * 1000; // 5 minute buffer before expiry
-
 // Client Information
 export const DEFAULT_CLIENT_NAME = 'MCP Assistant';
 export const DEFAULT_CLIENT_URI = 'https://mcp-assistant.in';
 export const DEFAULT_LOGO_URI = 'https://mcp-assistant.in/logo.svg';
 export const DEFAULT_POLICY_URI = 'https://mcp-assistant.in/privacy';
 export const SOFTWARE_ID = '@mcp-ts';
-export const SOFTWARE_VERSION = '1.3.4';
+export const SOFTWARE_VERSION = '2.3.4';
 
 // MCP Client Configuration
 export const MCP_CLIENT_NAME = 'mcp-ts-oauth-client';

package/src/shared/types.ts

@@ -168,6 +168,7 @@ export type ToolInfo = {
 
 // Transport type
 export type TransportType = 'sse' | 'streamable-http';
+export type SessionStatus = 'pending' | 'active';
 
 // SSE/RPC types
 export type McpRpcMethod =
@@ -234,7 +235,7 @@ export interface ReadResourceParams {
 }
 
 export interface FinishAuthParams {
-  sessionId: string;
+  state: string;
   code: string;
 }
 
@@ -256,11 +257,12 @@ export interface SessionInfo {
   serverUrl: string;
   transport: TransportType;
   createdAt: number;
+  updatedAt?: number;
   /**
    * Session readiness for auto-restore.
-   * false means auth is pending and should be resumed explicitly by user action.
+   * `pending` means auth is in progress and should be resumed explicitly by user action.
    */
-  active?: boolean;
+  status: SessionStatus;
 }
 
 export interface SessionListResult {

package/src/shared/utils.ts

@@ -1,5 +1,7 @@
 import { customAlphabet } from 'nanoid';
 
+const OAUTH_STATE_SEPARATOR = '.';
+
 /** first char: letters only (required by OpenAI) */
 const firstChar = customAlphabet(
     'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',
@@ -36,3 +38,27 @@ export function sanitizeServerLabel(name: string): string {
 export function generateSessionId(): string {
     return firstChar() + rest();
 }
+
+export interface ParsedOAuthState {
+  nonce: string;
+  sessionId: string;
+}
+
+export function formatOAuthState(nonce: string, sessionId: string): string {
+  return `${nonce}${OAUTH_STATE_SEPARATOR}${sessionId}`;
+}
+
+export function parseOAuthState(state: string): ParsedOAuthState | undefined {
+  const separatorIndex = state.indexOf(OAUTH_STATE_SEPARATOR);
+  if (separatorIndex <= 0 || separatorIndex === state.length - 1) {
+    return undefined;
+  }
+
+  const nonce = state.slice(0, separatorIndex);
+  const sessionId = state.slice(separatorIndex + 1);
+  if (!nonce || !sessionId || sessionId.includes(OAUTH_STATE_SEPARATOR)) {
+    return undefined;
+  }
+
+  return { nonce, sessionId };
+}