@mcp-ts/sdk 2.5.3 → 2.6.0

package/src/server/storage/neon-backend.ts

@@ -1,4 +1,4 @@
-import type { SessionStore, Session, SessionCredentials } from './types.js';
+import type { SessionStore, Session, SessionCredentials, GetOptions, SessionResult } from './types.js';
 import type { SessionStatus } from './types.js';
 import { DORMANT_SESSION_EXPIRATION_MS } from '../../shared/constants.js';
 import { generateSessionId } from '../../shared/utils.js';
@@ -9,7 +9,6 @@ import { normalizeToolPolicy } from './tool-policy.js';
 export interface NeonStorageOptions {
     schema?: string;
     table?: string;
-    credentialsTable?: string;
 }
 
 type NeonSql = {
@@ -32,21 +31,16 @@ type NeonSessionRow = {
     auth_url?: string | null;
     status?: SessionStatus | null;
     tool_policy?: unknown;
-};
-
-type NeonCredentialsRow = {
-    session_id: string;
-    user_id: string;
     client_information?: unknown;
     tokens?: unknown;
     code_verifier?: unknown;
     client_id?: string | null;
     oauth_state?: unknown;
+    enabled?: boolean;
 };
 
 export class NeonStorageBackend implements SessionStore {
     private readonly tableName: string;
-    private readonly credentialsTableName: string;
 
     constructor(
         private readonly sql: NeonSql,
@@ -54,14 +48,11 @@ export class NeonStorageBackend implements SessionStore {
     ) {
         const schema = options.schema || 'public';
         const table = options.table || 'mcp_sessions';
-        const credentialsTable = options.credentialsTable || 'mcp_credentials';
         this.tableName = `${this.quoteIdentifier(schema)}.${this.quoteIdentifier(table)}`;
-        this.credentialsTableName = `${this.quoteIdentifier(schema)}.${this.quoteIdentifier(credentialsTable)}`;
     }
 
     async init(): Promise<void> {
         await this.assertTable(this.tableName, 'mcp_sessions');
-        await this.assertTable(this.credentialsTableName, 'mcp_credentials');
         console.log('[mcp-ts][Storage] Neon: storage tables verified.');
     }
 
@@ -106,18 +97,12 @@ export class NeonStorageBackend implements SessionStore {
             authUrl: row.auth_url ?? undefined,
             status: row.status ?? 'pending',
             toolPolicy: normalizeToolPolicy(row.tool_policy as Parameters<typeof normalizeToolPolicy>[0]),
-        };
-    }
-
-    private mapRowToCredentials(row: NeonCredentialsRow, userId: string, sessionId: string): SessionCredentials {
-        return {
-            sessionId,
-            userId,
             clientInformation: decryptObject(row.client_information),
             tokens: decryptObject(row.tokens),
             codeVerifier: decryptObject(row.code_verifier),
             clientId: row.client_id ?? undefined,
-            oauthState: row.oauth_state as SessionCredentials['oauthState'],
+            oauthState: row.oauth_state as Session['oauthState'],
+            enabled: row.enabled ?? true,
         };
     }
 
@@ -196,7 +181,8 @@ export class NeonStorageBackend implements SessionStore {
             'status' in data ||
             'headers' in data ||
             'authUrl' in data ||
-            'toolPolicy' in data
+            'toolPolicy' in data ||
+            'enabled' in data
         );
 
         if (shouldUpdateSession) {
@@ -225,6 +211,10 @@ export class NeonStorageBackend implements SessionStore {
                 addSet('tool_policy', toolPolicy);
             }
 
+            if ('enabled' in data) {
+                addSet('enabled', updatedSession.enabled);
+            }
+
             setClauses.push('updated_at = now()');
 
             const updatedRows = await this.sql.query(
@@ -244,53 +234,58 @@ export class NeonStorageBackend implements SessionStore {
 
     async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
         if (!this.hasCredentialData(data)) return;
+        const setClauses: string[] = [];
+        const values: unknown[] = [];
+        let paramIndex = 1;
 
-        await this.sql.query(
-            `INSERT INTO ${this.credentialsTableName} (
-                user_id,
-                session_id,
-                client_information,
-                tokens,
-                code_verifier,
-                client_id,
-                oauth_state,
-                updated_at
-            ) VALUES ($1, $2, $3, $4, $5, $6, $7, now())
-            ON CONFLICT (user_id, session_id)
-            DO UPDATE SET
-                client_information = CASE WHEN $8 THEN EXCLUDED.client_information ELSE ${this.credentialsTableName}.client_information END,
-                tokens = CASE WHEN $9 THEN EXCLUDED.tokens ELSE ${this.credentialsTableName}.tokens END,
-                code_verifier = CASE WHEN $10 THEN EXCLUDED.code_verifier ELSE ${this.credentialsTableName}.code_verifier END,
-                client_id = CASE WHEN $11 THEN EXCLUDED.client_id ELSE ${this.credentialsTableName}.client_id END,
-                oauth_state = CASE WHEN $12 THEN EXCLUDED.oauth_state ELSE ${this.credentialsTableName}.oauth_state END,
-                updated_at = now()`,
-            [
-                userId,
-                sessionId,
-                'clientInformation' in data ? (data.clientInformation == null ? null : encryptObject(data.clientInformation)) : null,
-                'tokens' in data ? (data.tokens == null ? null : encryptObject(data.tokens)) : null,
-                'codeVerifier' in data ? (data.codeVerifier == null ? null : encryptObject(data.codeVerifier)) : null,
-                'clientId' in data ? (data.clientId ?? null) : null,
-                'oauthState' in data ? (data.oauthState ?? null) : null,
-                'clientInformation' in data,
-                'tokens' in data,
-                'codeVerifier' in data,
-                'clientId' in data,
-                'oauthState' in data,
-            ]
-        );
+        const addSet = (column: string, value: unknown) => {
+            setClauses.push(`${column} = $${paramIndex++}`);
+            values.push(value);
+        };
+
+        if ('clientInformation' in data) {
+            addSet('client_information', data.clientInformation == null ? null : encryptObject(data.clientInformation));
+        }
+        if ('tokens' in data) {
+            addSet('tokens', data.tokens == null ? null : encryptObject(data.tokens));
+        }
+        if ('codeVerifier' in data) {
+            addSet('code_verifier', data.codeVerifier == null ? null : encryptObject(data.codeVerifier));
+        }
+        if ('clientId' in data) {
+            addSet('client_id', data.clientId ?? null);
+        }
+        if ('oauthState' in data) {
+            addSet('oauth_state', data.oauthState ?? null);
+        }
+
+        setClauses.push('updated_at = now()');
+
+        const updatedRows = await this.sql.query(
+            `UPDATE ${this.tableName}
+             SET ${setClauses.join(', ')}
+             WHERE user_id = $${paramIndex++} AND session_id = $${paramIndex++}
+             RETURNING id`,
+            [...values, userId, sessionId]
+        ) as Array<{ id: string }>;
 
+        if (updatedRows.length === 0) {
+            throw new Error(`Session ${sessionId} not found for userId ${userId}`);
+        }
     }
 
-    async get(userId: string, sessionId: string): Promise<Session | null> {
+    async get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null> {
         try {
+            const selection = options?.includeCredentials
+                ? '*'
+                : 'session_id, user_id, server_id, server_name, server_url, transport_type, callback_url, created_at, updated_at, expires_at, headers, auth_url, status, tool_policy, enabled';
+
             const rows = await this.sql.query(
-                `SELECT * FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
+                `SELECT ${selection} FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
                 [userId, sessionId]
             ) as NeonSessionRow[];
 
             if (!rows[0]) return null;
-
             return this.mapRowToSessionData(rows[0]);
         } catch (error) {
             console.error('[NeonStorage] Failed to get session:', error);
@@ -300,21 +295,23 @@ export class NeonStorageBackend implements SessionStore {
 
     async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
         try {
-            const credentialRows = await this.sql.query(
-                `SELECT * FROM ${this.credentialsTableName} WHERE user_id = $1 AND session_id = $2`,
-                [userId, sessionId]
-            ) as NeonCredentialsRow[];
-
-            if (credentialRows[0]) {
-                return this.mapRowToCredentials(credentialRows[0], userId, sessionId);
-            }
-
-            const sessionRows = await this.sql.query(
-                `SELECT id FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
+            const rows = await this.sql.query(
+                `SELECT client_information, tokens, code_verifier, client_id, oauth_state
+                 FROM ${this.tableName} WHERE user_id = $1 AND session_id = $2`,
                 [userId, sessionId]
-            ) as Array<{ id: string }>;
+            ) as NeonSessionRow[];
 
-            return sessionRows[0] ? { sessionId, userId } : null;
+            if (!rows[0]) return null;
+            const row = rows[0];
+            return {
+                sessionId,
+                userId,
+                clientInformation: decryptObject(row.client_information),
+                tokens: decryptObject(row.tokens),
+                codeVerifier: decryptObject(row.code_verifier),
+                clientId: row.client_id ?? undefined,
+                oauthState: row.oauth_state as SessionCredentials['oauthState'],
+            };
         } catch (error) {
             console.error('[NeonStorage] Failed to get credentials:', error);
             return null;
@@ -337,7 +334,9 @@ export class NeonStorageBackend implements SessionStore {
     async clearCredentials(userId: string, sessionId: string): Promise<void> {
         try {
             await this.sql.query(
-                `DELETE FROM ${this.credentialsTableName} WHERE user_id = $1 AND session_id = $2`,
+                `UPDATE ${this.tableName}
+                 SET client_information = null, tokens = null, code_verifier = null, client_id = null, oauth_state = null, updated_at = now()
+                 WHERE user_id = $1 AND session_id = $2`,
                 [userId, sessionId]
             );
         } catch (error) {
@@ -383,7 +382,6 @@ export class NeonStorageBackend implements SessionStore {
 
     async clearAll(): Promise<void> {
         try {
-            await this.sql.query(`DELETE FROM ${this.credentialsTableName}`);
             await this.sql.query(`DELETE FROM ${this.tableName}`);
         } catch (error) {
             console.error('[NeonStorage] Failed to clear sessions:', error);

package/src/server/storage/redis-backend.ts

@@ -1,5 +1,5 @@
 import type { Redis } from 'ioredis';
-import type { SessionStore, Session, SessionCredentials } from './types.js';
+import type { SessionStore, Session, SessionCredentials, GetOptions, SessionResult } from './types.js';
 import { generateSessionId } from '../../shared/utils.js';
 import {
     mergeSessionUpdate,
@@ -13,7 +13,6 @@ import {
  */
 export class RedisStorageBackend implements SessionStore {
     private readonly KEY_PREFIX = 'mcp:session:';
-    private readonly CREDENTIALS_KEY_PREFIX = 'mcp:credentials:';
     private readonly USER_ID_KEY_PREFIX = 'mcp:userId:';
     private readonly USER_ID_KEY_SUFFIX = ':sessions';
 
@@ -36,10 +35,6 @@ export class RedisStorageBackend implements SessionStore {
         return `${this.KEY_PREFIX}${userId}:${sessionId}`;
     }
 
-    private getCredentialsKey(userId: string, sessionId: string): string {
-        return `${this.CREDENTIALS_KEY_PREFIX}${userId}:${sessionId}`;
-    }
-
     /**
      * Generates Redis key for tracking all sessions for a user
      * @private
@@ -150,38 +145,29 @@ export class RedisStorageBackend implements SessionStore {
 
     async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
         const sessionKey = this.getSessionKey(userId, sessionId);
-        const credentialsKey = this.getCredentialsKey(userId, sessionId);
-        const sessionExists = await this.redis.exists(sessionKey);
-        if (!sessionExists) {
+        const currentStr = await this.redis.get(sessionKey);
+        if (!currentStr) {
             throw new Error(`Session ${sessionId} not found for userId ${userId}`);
         }
 
-        const session = await this.get(userId, sessionId);
-        const currentTtl = await this.redis.ttl(sessionKey);
-        const effectiveTtl = currentTtl > 0 && session
-            ? currentTtl
-            : resolveSessionRedisTtlSeconds(session ?? { status: 'pending' });
-        const currentStr = await this.redis.get(credentialsKey);
-        const current = currentStr ? JSON.parse(currentStr) as SessionCredentials : { sessionId, userId };
-        const credentials = { ...current, ...data, sessionId, userId };
-        if (effectiveTtl > 0) {
-            await this.redis.set(credentialsKey, JSON.stringify(credentials), 'EX', effectiveTtl);
-        } else {
-            await this.redis.set(credentialsKey, JSON.stringify(credentials));
-        }
+        const current = JSON.parse(currentStr) as Session;
+        const updated = { ...current, ...data, sessionId, userId };
+        const effectiveTtl = resolveSessionRedisTtlSeconds(updated);
+        await this.redis.set(sessionKey, JSON.stringify(updated), 'EX', effectiveTtl);
     }
 
-    async get(userId: string, sessionId: string): Promise<Session | null> {
+    async get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null> {
         try {
             const sessionKey = this.getSessionKey(userId, sessionId);
             const sessionDataStr = await this.redis.get(sessionKey);
+            if (!sessionDataStr) return null;
 
-            if (!sessionDataStr) {
-                return null;
+            const session = normalizeStoredSession(JSON.parse(sessionDataStr) as Session);
+            if (!options?.includeCredentials) {
+                const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+                return sessionOnly as Session;
             }
-
-            const session: Session = JSON.parse(sessionDataStr);
-            return normalizeStoredSession(session);
+            return session;
         } catch (error) {
             console.error('[RedisStorageBackend] Failed to get session:', error);
             return null;
@@ -189,11 +175,16 @@ export class RedisStorageBackend implements SessionStore {
     }
 
     async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
-        const session = await this.get(userId, sessionId);
+        const session = await this.get(userId, sessionId, { includeCredentials: true });
         if (!session) return null;
 
-        const credentialsStr = await this.redis.get(this.getCredentialsKey(userId, sessionId));
-        return credentialsStr ? JSON.parse(credentialsStr) as SessionCredentials : { sessionId, userId };
+        const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+        return {
+            sessionId, userId,
+            clientInformation, tokens, codeVerifier,
+            codeVerifierChallenge, codeVerifierNonce,
+            clientId, oauthState,
+        };
     }
 
     async clearCredentials(userId: string, sessionId: string): Promise<void> {
@@ -201,6 +192,8 @@ export class RedisStorageBackend implements SessionStore {
             clientInformation: null,
             tokens: null,
             codeVerifier: null,
+            codeVerifierChallenge: null,
+            codeVerifierNonce: null,
             clientId: null,
             oauthState: null,
         });
@@ -241,11 +234,10 @@ export class RedisStorageBackend implements SessionStore {
     async delete(userId: string, sessionId: string): Promise<void> {
         try {
             const sessionKey = this.getSessionKey(userId, sessionId);
-            const credentialsKey = this.getCredentialsKey(userId, sessionId);
             const userIdKey = this.getUserIdKey(userId);
 
             await this.redis.srem(userIdKey, sessionId);
-            await this.redis.del(sessionKey, credentialsKey);
+            await this.redis.del(sessionKey);
         } catch (error) {
             console.error('[RedisStorageBackend] Failed to remove session:', error);
         }
@@ -280,9 +272,8 @@ export class RedisStorageBackend implements SessionStore {
     async clearAll(): Promise<void> {
         try {
             const keys = await this.scanKeys(`${this.KEY_PREFIX}*`);
-            const credentialKeys = await this.scanKeys(`${this.CREDENTIALS_KEY_PREFIX}*`);
             const userIdKeys = await this.scanKeys(`${this.USER_ID_KEY_PREFIX}*${this.USER_ID_KEY_SUFFIX}`);
-            const allKeys = [...keys, ...credentialKeys, ...userIdKeys];
+            const allKeys = [...keys, ...userIdKeys];
             if (allKeys.length > 0) {
                 await this.redis.del(...allKeys);
             }
@@ -311,7 +302,6 @@ export class RedisStorageBackend implements SessionStore {
                 const staleSessionIds = sessionIds.filter((_, index) => existenceChecks[index] === 0);
                 if (staleSessionIds.length > 0) {
                     await this.redis.srem(userIdKey, ...staleSessionIds);
-                    await this.redis.del(...staleSessionIds.map((sessionId) => this.getCredentialsKey(userId, sessionId)));
                 }
 
                 const remainingCount = await this.redis.scard(userIdKey);

package/src/server/storage/sqlite-backend.ts

@@ -1,5 +1,5 @@
 import type { Database } from 'better-sqlite3';
-import type { SessionStore, Session, SessionCredentials } from './types.js';
+import type { SessionStore, Session, SessionCredentials, GetOptions, SessionResult } from './types.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { generateSessionId } from '../../shared/utils.js';
@@ -18,14 +18,12 @@ export interface SqliteStorageOptions {
 export class SqliteStorage implements SessionStore {
     private db: Database | null = null;
     private table: string;
-    private credentialsTable: string;
     private initialized = false;
     private dbPath: string;
 
     constructor(options: SqliteStorageOptions = {}) {
         this.dbPath = options.path || './sessions.db';
         this.table = options.table || 'mcp_sessions';
-        this.credentialsTable = `${this.table}_credentials`;
     }
 
     async init(): Promise<void> {
@@ -51,13 +49,6 @@ export class SqliteStorage implements SessionStore {
                     expiresAt INTEGER
                 );
                 CREATE INDEX IF NOT EXISTS idx_${this.table}_userId ON ${this.table}(userId);
-                CREATE TABLE IF NOT EXISTS ${this.credentialsTable} (
-                    sessionId TEXT NOT NULL,
-                    userId TEXT NOT NULL,
-                    data TEXT NOT NULL,
-                    PRIMARY KEY (userId, sessionId),
-                    FOREIGN KEY (sessionId) REFERENCES ${this.table}(sessionId) ON DELETE CASCADE
-                );
             `);
 
             this.initialized = true;
@@ -127,22 +118,19 @@ export class SqliteStorage implements SessionStore {
 
     async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
         this.ensureInitialized();
-        if (!await this.get(userId, sessionId)) {
+        const currentSession = await this.get(userId, sessionId, { includeCredentials: true });
+        if (!currentSession) {
             throw new Error(`Session ${sessionId} not found for userId ${userId}`);
         }
 
-        const current = await this.getCredentials(userId, sessionId) ?? { sessionId, userId };
-        const credentials = { ...current, ...data, sessionId, userId };
+        const updated = { ...currentSession, ...data, sessionId, userId };
         const stmt = this.db!.prepare(
-            `INSERT INTO ${this.credentialsTable} (sessionId, userId, data)
-             VALUES (?, ?, ?)
-             ON CONFLICT(userId, sessionId) DO UPDATE SET data = excluded.data`
+            `UPDATE ${this.table} SET data = ? WHERE sessionId = ? AND userId = ?`
         );
-        stmt.run(sessionId, userId, JSON.stringify(credentials));
-
+        stmt.run(JSON.stringify(updated), sessionId, userId);
     }
 
-    async get(userId: string, sessionId: string): Promise<Session | null> {
+    async get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null> {
         this.ensureInitialized();
 
         const stmt = this.db!.prepare(
@@ -151,18 +139,27 @@ export class SqliteStorage implements SessionStore {
         const row = stmt.get(sessionId, userId) as { data: string } | undefined;
 
         if (!row) return null;
-        return normalizeStoredSession(JSON.parse(row.data) as Session);
+
+        const session = normalizeStoredSession(JSON.parse(row.data) as Session);
+        if (!options?.includeCredentials) {
+            const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+            return sessionOnly as Session;
+        }
+        return session;
     }
 
     async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
         this.ensureInitialized();
-        if (!await this.get(userId, sessionId)) return null;
+        const session = await this.get(userId, sessionId, { includeCredentials: true });
+        if (!session) return null;
 
-        const stmt = this.db!.prepare(
-            `SELECT data FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
-        );
-        const row = stmt.get(sessionId, userId) as { data: string } | undefined;
-        return row ? JSON.parse(row.data) as SessionCredentials : { sessionId, userId };
+        const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+        return {
+            sessionId, userId,
+            clientInformation, tokens, codeVerifier,
+            codeVerifierChallenge, codeVerifierNonce,
+            clientId, oauthState,
+        };
     }
 
     async clearCredentials(userId: string, sessionId: string): Promise<void> {
@@ -170,6 +167,8 @@ export class SqliteStorage implements SessionStore {
             clientInformation: null,
             tokens: null,
             codeVerifier: null,
+            codeVerifierChallenge: null,
+            codeVerifierNonce: null,
             clientId: null,
             oauthState: null,
         });
@@ -202,9 +201,6 @@ export class SqliteStorage implements SessionStore {
         const stmt = this.db!.prepare(
             `DELETE FROM ${this.table} WHERE sessionId = ? AND userId = ?`
         );
-        this.db!.prepare(
-            `DELETE FROM ${this.credentialsTable} WHERE sessionId = ? AND userId = ?`
-        ).run(sessionId, userId);
         stmt.run(sessionId, userId);
     }
 
@@ -217,7 +213,6 @@ export class SqliteStorage implements SessionStore {
 
     async clearAll(): Promise<void> {
         this.ensureInitialized();
-        this.db!.prepare(`DELETE FROM ${this.credentialsTable}`).run();
         const stmt = this.db!.prepare(`DELETE FROM ${this.table}`);
         stmt.run();
     }
@@ -237,15 +232,6 @@ export class SqliteStorage implements SessionStore {
                 deleteStmt.run(row.sessionId, row.userId);
             }
         }
-
-        this.db!.prepare(
-            `DELETE FROM ${this.credentialsTable}
-             WHERE NOT EXISTS (
-                SELECT 1 FROM ${this.table}
-                WHERE ${this.table}.sessionId = ${this.credentialsTable}.sessionId
-                  AND ${this.table}.userId = ${this.credentialsTable}.userId
-             )`
-        ).run();
     }
 
     async disconnect(): Promise<void> {