@mcp-ts/sdk 2.3.4 → 2.4.0

package/src/server/storage/session-lifecycle.ts

@@ -0,0 +1,78 @@
+import {
+    DORMANT_SESSION_EXPIRATION_MS,
+    DORMANT_SESSION_EXPIRATION_SECONDS,
+    STATE_EXPIRATION_MS,
+} from '../../shared/constants.js';
+import type { Session, SessionStatus } from './types.js';
+
+export function resolveSessionExpiresAt(status: SessionStatus = 'pending', referenceTime = Date.now()): number | null {
+    return status === 'active' ? null : referenceTime + STATE_EXPIRATION_MS;
+}
+
+export function resolveSessionRedisTtlSeconds(session: Pick<Session, 'status'>): number {
+    return session.status === 'active'
+        ? DORMANT_SESSION_EXPIRATION_SECONDS
+        : Math.floor(STATE_EXPIRATION_MS / 1000);
+}
+
+export function normalizeNewSession(session: Session, now = Date.now()): Session {
+    const createdAt = session.createdAt || now;
+    const updatedAt = session.updatedAt ?? createdAt;
+    const status = session.status ?? 'pending';
+
+    return {
+        ...session,
+        status,
+        createdAt,
+        updatedAt,
+        expiresAt: resolveSessionExpiresAt(status, status === 'active' ? updatedAt : createdAt),
+    };
+}
+
+export function mergeSessionUpdate(
+    current: Session,
+    data: Partial<Session>,
+    now = Date.now()
+): Session {
+    const updatedAt = data.updatedAt ?? now;
+    const updated = {
+        ...current,
+        ...data,
+        updatedAt,
+    };
+    const status = updated.status ?? 'pending';
+
+    return {
+        ...updated,
+        status,
+        expiresAt: resolveSessionExpiresAt(status, updatedAt),
+    };
+}
+
+export function normalizeStoredSession(session: Session): Session {
+    const createdAt = session.createdAt || Date.now();
+    const updatedAt = session.updatedAt ?? createdAt;
+    const status = session.status ?? 'pending';
+    const expiresAt = status === 'active'
+        ? null
+        : session.expiresAt ?? resolveSessionExpiresAt(status, createdAt);
+
+    return {
+        ...session,
+        status,
+        createdAt,
+        updatedAt,
+        expiresAt,
+    };
+}
+
+export function isSessionExpired(session: Session, now = Date.now()): boolean {
+    const hydrated = normalizeStoredSession(session);
+
+    if (hydrated.status === 'active') {
+        return hydrated.updatedAt !== undefined &&
+            hydrated.updatedAt < now - DORMANT_SESSION_EXPIRATION_MS;
+    }
+
+    return typeof hydrated.expiresAt === 'number' && hydrated.expiresAt < now;
+}

package/src/server/storage/sqlite-backend.ts

@@ -1,8 +1,14 @@
 import type { Database } from 'better-sqlite3';
-import type { SessionStore, Session } from './types.js';
+import type { SessionStore, Session, SessionCredentials } from './types.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { generateSessionId } from '../../shared/utils.js';
+import {
+    mergeSessionUpdate,
+    normalizeNewSession,
+    normalizeStoredSession,
+    isSessionExpired,
+} from './session-lifecycle.js';
 
 export interface SqliteStorageOptions {
     path?: string;
@@ -12,12 +18,14 @@ export interface SqliteStorageOptions {
 export class SqliteStorage implements SessionStore {
     private db: Database | null = null;
     private table: string;
+    private credentialsTable: string;
     private initialized = false;
     private dbPath: string;
 
     constructor(options: SqliteStorageOptions = {}) {
         this.dbPath = options.path || './sessions.db';
         this.table = options.table || 'mcp_sessions';
+        this.credentialsTable = `${this.table}_credentials`;
     }
 
     async init(): Promise<void> {
@@ -34,6 +42,7 @@ export class SqliteStorage implements SessionStore {
             }
 
             this.db = new DatabaseConstructor(this.dbPath);
+            this.db.pragma('foreign_keys = ON');
             this.db.exec(`
                 CREATE TABLE IF NOT EXISTS ${this.table} (
                     sessionId TEXT PRIMARY KEY,
@@ -42,6 +51,13 @@ export class SqliteStorage implements SessionStore {
                     expiresAt INTEGER
                 );
                 CREATE INDEX IF NOT EXISTS idx_${this.table}_userId ON ${this.table}(userId);
+                CREATE TABLE IF NOT EXISTS ${this.credentialsTable} (
+                    sessionId TEXT NOT NULL,
+                    userId TEXT NOT NULL,
+                    data TEXT NOT NULL,
+                    PRIMARY KEY (userId, sessionId),
+                    FOREIGN KEY (sessionId) REFERENCES ${this.table}(sessionId) ON DELETE CASCADE
+                );
             `);
 
             this.initialized = true;
@@ -66,7 +82,7 @@ export class SqliteStorage implements SessionStore {
         return generateSessionId();
     }
 
-    async create(session: Session, ttl?: number): Promise<void> {
+    async create(session: Session): Promise<void> {
         this.ensureInitialized();
         const { sessionId, userId } = session;
 
@@ -74,13 +90,13 @@ export class SqliteStorage implements SessionStore {
             throw new Error('userId and sessionId required');
         }
 
-        const expiresAt = ttl ? Date.now() + ttl * 1000 : null;
+        const sessionWithLifecycle = normalizeNewSession(session);
 
         try {
             const stmt = this.db!.prepare(
                 `INSERT INTO ${this.table} (sessionId, userId, data, expiresAt) VALUES (?, ?, ?, ?)`
             );
-            stmt.run(sessionId, userId, JSON.stringify(session), expiresAt);
+            stmt.run(sessionId, userId, JSON.stringify(sessionWithLifecycle), sessionWithLifecycle.expiresAt ?? null);
         } catch (error: any) {
             if (error.code === 'SQLITE_CONSTRAINT_PRIMARYKEY') {
                 throw new Error(`Session ${sessionId} already exists`);
@@ -89,7 +105,7 @@ export class SqliteStorage implements SessionStore {
         }
     }
 
-    async update(userId: string, sessionId: string, data: Partial<Session>, ttl?: number): Promise<void> {
+    async update(userId: string, sessionId: string, data: Partial<Session>): Promise<void> {
         this.ensureInitialized();
         if (!sessionId || !userId) {
             throw new Error('userId and sessionId required');
@@ -100,14 +116,30 @@ export class SqliteStorage implements SessionStore {
             throw new Error(`Session ${sessionId} not found for userId ${userId}`);
         }
 
-        const updatedSession = { ...currentSession, ...data };
-        const expiresAt = ttl ? Date.now() + ttl * 1000 : null;
+        const updatedSession = mergeSessionUpdate(currentSession, data);
 
         const stmt = this.db!.prepare(
             `UPDATE ${this.table} SET data = ?, expiresAt = ? WHERE sessionId = ? AND userId = ?`
         );
 
-        stmt.run(JSON.stringify(updatedSession), expiresAt, sessionId, userId);
+        stmt.run(JSON.stringify(updatedSession), updatedSession.expiresAt ?? null, sessionId, userId);
+    }
+
+    async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
+        this.ensureInitialized();
+        if (!await this.get(userId, sessionId)) {
+            throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+        }
+
+        const current = await this.getCredentials(userId, sessionId) ?? { sessionId, userId };
+        const credentials = { ...current, ...data, sessionId, userId };
+        const stmt = this.db!.prepare(
+            `INSERT INTO ${this.credentialsTable} (sessionId, userId, data)
+             VALUES (?, ?, ?)
+             ON CONFLICT(userId, sessionId) DO UPDATE SET data = excluded.data`
+        );
+        stmt.run(sessionId, userId, JSON.stringify(credentials));
+
     }
 
     async get(userId: string, sessionId: string): Promise<Session | null> {
@@ -119,7 +151,28 @@ export class SqliteStorage implements SessionStore {
         const row = stmt.get(sessionId, userId) as { data: string } | undefined;
 
         if (!row) return null;
-        return JSON.parse(row.data) as Session;
+        return normalizeStoredSession(JSON.parse(row.data) as Session);
+    }
+
+    async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
+        this.ensureInitialized();
+        if (!await this.get(userId, sessionId)) return null;
+
+        const stmt = this.db!.prepare(
+            `SELECT data FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
+        );
+        const row = stmt.get(sessionId, userId) as { data: string } | undefined;
+        return row ? JSON.parse(row.data) as SessionCredentials : { sessionId, userId };
+    }
+
+    async clearCredentials(userId: string, sessionId: string): Promise<void> {
+        await this.patchCredentials(userId, sessionId, {
+            clientInformation: null,
+            tokens: null,
+            codeVerifier: null,
+            clientId: null,
+            oauthState: null,
+        });
     }
 
     async list(userId: string): Promise<Session[]> {
@@ -130,7 +183,7 @@ export class SqliteStorage implements SessionStore {
         );
         const rows = stmt.all(userId) as { data: string }[];
 
-        return rows.map(row => JSON.parse(row.data) as Session);
+        return rows.map(row => normalizeStoredSession(JSON.parse(row.data) as Session));
     }
 
     async listIds(userId: string): Promise<string[]> {
@@ -149,6 +202,9 @@ export class SqliteStorage implements SessionStore {
         const stmt = this.db!.prepare(
             `DELETE FROM ${this.table} WHERE sessionId = ? AND userId = ?`
         );
+        this.db!.prepare(
+            `DELETE FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
+        ).run(sessionId, userId);
         stmt.run(sessionId, userId);
     }
 
@@ -161,17 +217,35 @@ export class SqliteStorage implements SessionStore {
 
     async clearAll(): Promise<void> {
         this.ensureInitialized();
+        this.db!.prepare(`DELETE FROM ${this.credentialsTable}`).run();
         const stmt = this.db!.prepare(`DELETE FROM ${this.table}`);
         stmt.run();
     }
 
     async cleanupExpired(): Promise<void> {
         this.ensureInitialized();
-        const now = Date.now();
-        const stmt = this.db!.prepare(
-            `DELETE FROM ${this.table} WHERE expiresAt IS NOT NULL AND expiresAt < ?`
-        );
-        stmt.run(now);
+        const rows = this.db!.prepare(`SELECT sessionId, userId, data FROM ${this.table}`).all() as {
+            sessionId: string;
+            userId: string;
+            data: string;
+        }[];
+        const deleteStmt = this.db!.prepare(`DELETE FROM ${this.table} WHERE sessionId = ? AND userId = ?`);
+
+        for (const row of rows) {
+            const session = normalizeStoredSession(JSON.parse(row.data) as Session);
+            if (isSessionExpired(session)) {
+                deleteStmt.run(row.sessionId, row.userId);
+            }
+        }
+
+        this.db!.prepare(
+            `DELETE FROM ${this.credentialsTable}
+             WHERE NOT EXISTS (
+                SELECT 1 FROM ${this.table}
+                WHERE ${this.table}.sessionId = ${this.credentialsTable}.sessionId
+                  AND ${this.table}.userId = ${this.credentialsTable}.userId
+             )`
+        ).run();
     }
 
     async disconnect(): Promise<void> {

package/src/server/storage/supabase-backend.ts

@@ -1,33 +1,35 @@
 import type { SupabaseClient } from '@supabase/supabase-js';
-import type { SessionStore, Session } from './types.js';
-import { SESSION_TTL_SECONDS } from '../../shared/constants.js';
+import type { SessionStore, Session, SessionCredentials } from './types.js';
 import { generateSessionId } from '../../shared/utils.js';
 import { encryptObject, decryptObject } from './crypto.js';
+import { resolveSessionExpiresAt } from './session-lifecycle.js';
+import { DORMANT_SESSION_EXPIRATION_MS } from '../../shared/constants.js';
 
 export class SupabaseStorageBackend implements SessionStore {
-    private readonly DEFAULT_TTL = SESSION_TTL_SECONDS;
-
     constructor(private supabase: SupabaseClient) {}
-    
+
     async init(): Promise<void> {
-        // Validate that the table exists
+        await this.assertTable('mcp_sessions', 'session_id');
+        await this.assertTable('mcp_credentials', 'session_id');
+        console.log('[mcp-ts][Storage] Supabase: storage tables verified.');
+    }
+
+    private async assertTable(table: string, column: string): Promise<void> {
         const { error } = await this.supabase
-            .from('mcp_sessions')
-            .select('session_id')
+            .from(table)
+            .select(column)
             .limit(0);
 
-        if (error) {
-            // Postgres error code 42P01 is "relation does not exist"
-            if (error.code === '42P01') {
-                throw new Error(
-                    '[SupabaseStorage] Table "mcp_sessions" not found in your database. ' +
-                    'Please run "npx mcp-ts supabase-init" in your project to set up the required table and RLS policies.'
-                );
-            }
-            throw new Error(`[SupabaseStorage] Initialization check failed: ${error.message}`);
+        if (!error) return;
+
+        if (error.code === '42P01') {
+            throw new Error(
+                `[SupabaseStorage] Table "${table}" not found in your database. ` +
+                'Please run "npx mcp-ts supabase-init" to set up the required storage schema.'
+            );
         }
 
-        console.log('[mcp-ts][Storage] Supabase: ✓ "mcp_sessions" table verified.');
+        throw new Error(`[SupabaseStorage] Initialization check failed for "${table}": ${error.message}`);
     }
 
     generateSessionId(): string {
@@ -43,60 +45,76 @@ export class SupabaseStorageBackend implements SessionStore {
             transportType: row.transport_type,
             callbackUrl: row.callback_url,
             createdAt: new Date(row.created_at).getTime(),
+            updatedAt: new Date(row.updated_at ?? row.created_at).getTime(),
+            expiresAt: row.expires_at ? new Date(row.expires_at).getTime() : null,
             userId: row.user_id,
             headers: decryptObject(row.headers),
-            active: row.active,
-            clientInformation: row.client_information,
-            tokens: decryptObject(row.tokens),
-            codeVerifier: row.code_verifier,
-            clientId: row.client_id,
+            authUrl: row.auth_url,
+            status: row.status ?? 'pending',
+        };
+    }
+
+    private mapRowToCredentials(row: any, userId: string, sessionId: string): SessionCredentials {
+        return {
+            sessionId,
+            userId,
+            clientInformation: decryptObject(row?.client_information),
+            tokens: decryptObject(row?.tokens),
+            codeVerifier: decryptObject(row?.code_verifier),
+            clientId: row?.client_id,
+            oauthState: row?.oauth_state,
         };
     }
 
-    async create(session: Session, ttl?: number): Promise<void> {
+    private hasCredentialData(data: Partial<SessionCredentials>): boolean {
+        return (
+            'clientInformation' in data ||
+            'tokens' in data ||
+            'codeVerifier' in data ||
+            'clientId' in data ||
+            'oauthState' in data
+        );
+    }
+
+    async create(session: Session): Promise<void> {
         const { sessionId, userId } = session;
         if (!sessionId || !userId) throw new Error('userId and sessionId required');
 
-        const effectiveTtl = ttl ?? this.DEFAULT_TTL;
-        const expiresAt = new Date(Date.now() + effectiveTtl * 1000).toISOString();
+        const status = session.status ?? 'pending';
+        const createdAt = new Date(session.createdAt || Date.now()).toISOString();
+        const updatedAt = new Date(session.updatedAt ?? session.createdAt ?? Date.now()).toISOString();
+        const expiresAt = resolveSessionExpiresAt(status, new Date(createdAt).getTime());
 
         const { error } = await this.supabase
             .from('mcp_sessions')
             .insert({
                 session_id: sessionId,
-                user_id: userId, // Maps user_id to userId to support RLS using auth.uid()
+                user_id: userId,
                 server_id: session.serverId,
                 server_name: session.serverName,
                 server_url: session.serverUrl,
                 transport_type: session.transportType,
                 callback_url: session.callbackUrl,
-                created_at: new Date(session.createdAt || Date.now()).toISOString(),
+                created_at: createdAt,
+                updated_at: updatedAt,
                 headers: encryptObject(session.headers),
-                active: session.active ?? false,
-                client_information: session.clientInformation,
-                tokens: encryptObject(session.tokens),
-                code_verifier: session.codeVerifier,
-                client_id: session.clientId,
-                expires_at: expiresAt
+                auth_url: session.authUrl ?? null,
+                status,
+                expires_at: expiresAt === null ? null : new Date(expiresAt).toISOString(),
             });
 
         if (error) {
-            // Postgres error code 23505 is unique violation
             if (error.code === '23505') {
                 throw new Error(`Session ${sessionId} already exists`);
             }
             throw new Error(`Failed to create session in Supabase: ${error.message}`);
         }
-    }
 
-    async update(userId: string, sessionId: string, data: Partial<Session>, ttl?: number): Promise<void> {
-        const effectiveTtl = ttl ?? this.DEFAULT_TTL;
-        const expiresAt = new Date(Date.now() + effectiveTtl * 1000).toISOString();
+    }
 
-        // Convert the camelCase keys to snake_case for Supabase
+    async update(userId: string, sessionId: string, data: Partial<Session>): Promise<void> {
         const updateData: any = {
-            expires_at: expiresAt,
-            updated_at: new Date().toISOString()
+            updated_at: new Date().toISOString(),
         };
 
         if ('serverId' in data) updateData.server_id = data.serverId;
@@ -104,27 +122,72 @@ export class SupabaseStorageBackend implements SessionStore {
         if ('serverUrl' in data) updateData.server_url = data.serverUrl;
         if ('transportType' in data) updateData.transport_type = data.transportType;
         if ('callbackUrl' in data) updateData.callback_url = data.callbackUrl;
-        if ('active' in data) updateData.active = data.active;
+        if ('status' in data) {
+            const status = data.status ?? 'pending';
+            const expiresAt = resolveSessionExpiresAt(status);
+            updateData.status = status;
+            updateData.expires_at = expiresAt === null ? null : new Date(expiresAt).toISOString();
+        }
         if ('headers' in data) updateData.headers = encryptObject(data.headers);
-        if ('clientInformation' in data) updateData.client_information = data.clientInformation;
-        if ('tokens' in data) updateData.tokens = data.tokens === undefined ? null : encryptObject(data.tokens);
-        if ('codeVerifier' in data) updateData.code_verifier = data.codeVerifier;
-        if ('clientId' in data) updateData.client_id = data.clientId;
+        if ('authUrl' in data) updateData.auth_url = data.authUrl ?? null;
 
-        const { data: updatedRows, error } = await this.supabase
-            .from('mcp_sessions')
-            .update(updateData)
-            .eq('user_id', userId)
-            .eq('session_id', sessionId)
-            .select('id');
+        const shouldUpdateSession = Object.keys(updateData).some((key) => key !== 'updated_at');
 
-        if (error) {
-            throw new Error(`Failed to update session: ${error.message}`);
+        let updatedRows: any[] | null = null;
+        if (shouldUpdateSession) {
+            const result = await this.supabase
+                .from('mcp_sessions')
+                .update(updateData)
+                .eq('user_id', userId)
+                .eq('session_id', sessionId)
+                .select('id');
+
+            if (result.error) {
+                throw new Error(`Failed to update session: ${result.error.message}`);
+            }
+            updatedRows = result.data;
+        } else {
+            const result = await this.supabase
+                .from('mcp_sessions')
+                .select('id')
+                .eq('user_id', userId)
+                .eq('session_id', sessionId);
+
+            if (result.error) {
+                throw new Error(`Failed to update session: ${result.error.message}`);
+            }
+            updatedRows = result.data;
         }
 
         if (!updatedRows || updatedRows.length === 0) {
             throw new Error(`Session ${sessionId} not found for userId ${userId}`);
         }
+
+    }
+
+    async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
+        if (!this.hasCredentialData(data)) return;
+
+        const row: any = {
+            user_id: userId,
+            session_id: sessionId,
+            updated_at: new Date().toISOString(),
+        };
+
+        if ('clientInformation' in data) row.client_information = data.clientInformation == null ? null : encryptObject(data.clientInformation);
+        if ('tokens' in data) row.tokens = data.tokens == null ? null : encryptObject(data.tokens);
+        if ('codeVerifier' in data) row.code_verifier = data.codeVerifier == null ? null : encryptObject(data.codeVerifier);
+        if ('clientId' in data) row.client_id = data.clientId ?? null;
+        if ('oauthState' in data) row.oauth_state = data.oauthState ?? null;
+
+        const { error } = await this.supabase
+            .from('mcp_credentials')
+            .upsert(row, { onConflict: 'user_id,session_id' });
+
+        if (error) {
+            throw new Error(`Failed to update credentials: ${error.message}`);
+        }
+
     }
 
     async get(userId: string, sessionId: string): Promise<Session | null> {
@@ -145,6 +208,36 @@ export class SupabaseStorageBackend implements SessionStore {
         return this.mapRowToSessionData(data);
     }
 
+    async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
+        const { data, error } = await this.supabase
+            .from('mcp_credentials')
+            .select('*')
+            .eq('user_id', userId)
+            .eq('session_id', sessionId)
+            .maybeSingle();
+
+        if (error) {
+            console.error('[SupabaseStorage] Failed to get credentials:', error);
+            return null;
+        }
+
+        if (data) {
+            return this.mapRowToCredentials(data, userId, sessionId);
+        }
+
+        const { data: sessionRows, error: sessionError } = await this.supabase
+            .from('mcp_sessions')
+            .select('id')
+            .eq('user_id', userId)
+            .eq('session_id', sessionId);
+
+        if (sessionError || !sessionRows || sessionRows.length === 0) {
+            return null;
+        }
+
+        return { sessionId, userId };
+    }
+
     async list(userId: string): Promise<Session[]> {
         const { data, error } = await this.supabase
             .from('mcp_sessions')
@@ -159,6 +252,18 @@ export class SupabaseStorageBackend implements SessionStore {
         return data.map(row => this.mapRowToSessionData(row));
     }
 
+    async clearCredentials(userId: string, sessionId: string): Promise<void> {
+        const { error } = await this.supabase
+            .from('mcp_credentials')
+            .delete()
+            .eq('user_id', userId)
+            .eq('session_id', sessionId);
+
+        if (error) {
+            throw new Error(`Failed to clear credentials: ${error.message}`);
+        }
+    }
+
     async delete(userId: string, sessionId: string): Promise<void> {
         const { error } = await this.supabase
             .from('mcp_sessions')
@@ -199,30 +304,50 @@ export class SupabaseStorageBackend implements SessionStore {
     }
 
     async clearAll(): Promise<void> {
-        // Warning: This deletes everything. Typically only used in testing.
+        const { error: credentialsError } = await this.supabase
+            .from('mcp_credentials')
+            .delete()
+            .neq('session_id', '');
+
+        if (credentialsError) {
+            console.error('[SupabaseStorage] Failed to clear credentials:', credentialsError);
+        }
+
         const { error } = await this.supabase
             .from('mcp_sessions')
             .delete()
-            .neq('session_id', ''); // Delete all rows trick
-            
+            .neq('session_id', '');
+
         if (error) {
             console.error('[SupabaseStorage] Failed to clear sessions:', error);
         }
     }
 
     async cleanupExpired(): Promise<void> {
-        const { error } = await this.supabase
+        const { error: transientError } = await this.supabase
             .from('mcp_sessions')
             .delete()
+            .not('expires_at', 'is', null)
+            .neq('status', 'active')
             .lt('expires_at', new Date().toISOString());
 
-        if (error) {
-            console.error('[SupabaseStorage] Failed to cleanup expired sessions:', error);
+        if (transientError) {
+            console.error('[SupabaseStorage] Failed to cleanup expired inactive sessions:', transientError);
+        }
+
+        const dormantCutoff = new Date(Date.now() - DORMANT_SESSION_EXPIRATION_MS).toISOString();
+        const { error: dormantError } = await this.supabase
+            .from('mcp_sessions')
+            .delete()
+            .eq('status', 'active')
+            .lt('updated_at', dormantCutoff);
+
+        if (dormantError) {
+            console.error('[SupabaseStorage] Failed to cleanup dormant active sessions:', dormantError);
         }
     }
 
     async disconnect(): Promise<void> {
-        // Supabase client handles its own connection pooling over HTTP, 
-        // there is no explicit disconnect method.
+        // Supabase client handles its own connection pooling over HTTP.
     }
 }