@mcp-ts/sdk 2.5.3 → 2.6.0

package/src/server/storage/supabase-backend.ts

@@ -1,5 +1,5 @@
 import type { SupabaseClient } from '@supabase/supabase-js';
-import type { SessionStore, Session, SessionCredentials } from './types.js';
+import type { SessionStore, Session, SessionCredentials, GetOptions, SessionResult } from './types.js';
 import { generateSessionId } from '../../shared/utils.js';
 import { encryptObject, decryptObject } from './crypto.js';
 import { resolveSessionExpiresAt } from './session-lifecycle.js';
@@ -11,7 +11,6 @@ export class SupabaseStorageBackend implements SessionStore {
 
     async init(): Promise<void> {
         await this.assertTable('mcp_sessions', 'session_id');
-        await this.assertTable('mcp_credentials', 'session_id');
         console.log('[mcp-ts][Storage] Supabase: storage tables verified.');
     }
 
@@ -53,18 +52,12 @@ export class SupabaseStorageBackend implements SessionStore {
             authUrl: row.auth_url,
             status: row.status ?? 'pending',
             toolPolicy: normalizeToolPolicy(row.tool_policy),
-        };
-    }
-
-    private mapRowToCredentials(row: any, userId: string, sessionId: string): SessionCredentials {
-        return {
-            sessionId,
-            userId,
-            clientInformation: decryptObject(row?.client_information),
-            tokens: decryptObject(row?.tokens),
-            codeVerifier: decryptObject(row?.code_verifier),
-            clientId: row?.client_id,
-            oauthState: row?.oauth_state,
+            clientInformation: decryptObject(row.client_information),
+            tokens: decryptObject(row.tokens),
+            codeVerifier: decryptObject(row.code_verifier),
+            clientId: row.client_id,
+            oauthState: row.oauth_state,
+            enabled: row.enabled ?? true,
         };
     }
 
@@ -140,6 +133,7 @@ export class SupabaseStorageBackend implements SessionStore {
         if ('headers' in data) updateData.headers = encryptObject(data.headers);
         if ('authUrl' in data) updateData.auth_url = data.authUrl ?? null;
         if ('toolPolicy' in data) updateData.tool_policy = normalizeToolPolicy(data.toolPolicy);
+        if ('enabled' in data) updateData.enabled = data.enabled;
 
         const shouldUpdateSession = Object.keys(updateData).some((key) => key !== 'updated_at');
 
@@ -178,32 +172,35 @@ export class SupabaseStorageBackend implements SessionStore {
     async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
         if (!this.hasCredentialData(data)) return;
 
-        const row: any = {
-            user_id: userId,
-            session_id: sessionId,
+        const updateData: Record<string, unknown> = {
             updated_at: new Date().toISOString(),
         };
 
-        if ('clientInformation' in data) row.client_information = data.clientInformation == null ? null : encryptObject(data.clientInformation);
-        if ('tokens' in data) row.tokens = data.tokens == null ? null : encryptObject(data.tokens);
-        if ('codeVerifier' in data) row.code_verifier = data.codeVerifier == null ? null : encryptObject(data.codeVerifier);
-        if ('clientId' in data) row.client_id = data.clientId ?? null;
-        if ('oauthState' in data) row.oauth_state = data.oauthState ?? null;
+        if ('clientInformation' in data) updateData.client_information = data.clientInformation == null ? null : encryptObject(data.clientInformation);
+        if ('tokens' in data) updateData.tokens = data.tokens == null ? null : encryptObject(data.tokens);
+        if ('codeVerifier' in data) updateData.code_verifier = data.codeVerifier == null ? null : encryptObject(data.codeVerifier);
+        if ('clientId' in data) updateData.client_id = data.clientId ?? null;
+        if ('oauthState' in data) updateData.oauth_state = data.oauthState ?? null;
 
         const { error } = await this.supabase
-            .from('mcp_credentials')
-            .upsert(row, { onConflict: 'user_id,session_id' });
+            .from('mcp_sessions')
+            .update(updateData)
+            .eq('user_id', userId)
+            .eq('session_id', sessionId);
 
         if (error) {
             throw new Error(`Failed to update credentials: ${error.message}`);
         }
-
     }
 
-    async get(userId: string, sessionId: string): Promise<Session | null> {
+    async get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null> {
+        const selection = options?.includeCredentials
+            ? '*'
+            : 'session_id, user_id, server_id, server_name, server_url, transport_type, callback_url, created_at, updated_at, expires_at, headers, auth_url, status, tool_policy, enabled';
+
         const { data, error } = await this.supabase
             .from('mcp_sessions')
-            .select('*')
+            .select(selection)
             .eq('user_id', userId)
             .eq('session_id', sessionId)
             .maybeSingle();
@@ -220,8 +217,8 @@ export class SupabaseStorageBackend implements SessionStore {
 
     async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
         const { data, error } = await this.supabase
-            .from('mcp_credentials')
-            .select('*')
+            .from('mcp_sessions')
+            .select('client_information, tokens, code_verifier, client_id, oauth_state')
             .eq('user_id', userId)
             .eq('session_id', sessionId)
             .maybeSingle();
@@ -231,21 +228,17 @@ export class SupabaseStorageBackend implements SessionStore {
             return null;
         }
 
-        if (data) {
-            return this.mapRowToCredentials(data, userId, sessionId);
-        }
-
-        const { data: sessionRows, error: sessionError } = await this.supabase
-            .from('mcp_sessions')
-            .select('id')
-            .eq('user_id', userId)
-            .eq('session_id', sessionId);
-
-        if (sessionError || !sessionRows || sessionRows.length === 0) {
-            return null;
-        }
+        if (!data) return null;
 
-        return { sessionId, userId };
+        return {
+            sessionId,
+            userId,
+            clientInformation: decryptObject(data.client_information),
+            tokens: decryptObject(data.tokens),
+            codeVerifier: decryptObject(data.code_verifier),
+            clientId: data.client_id,
+            oauthState: data.oauth_state,
+        };
     }
 
     async list(userId: string): Promise<Session[]> {
@@ -264,8 +257,15 @@ export class SupabaseStorageBackend implements SessionStore {
 
     async clearCredentials(userId: string, sessionId: string): Promise<void> {
         const { error } = await this.supabase
-            .from('mcp_credentials')
-            .delete()
+            .from('mcp_sessions')
+            .update({
+                client_information: null,
+                tokens: null,
+                code_verifier: null,
+                client_id: null,
+                oauth_state: null,
+                updated_at: new Date().toISOString(),
+            })
             .eq('user_id', userId)
             .eq('session_id', sessionId);
 
@@ -314,15 +314,6 @@ export class SupabaseStorageBackend implements SessionStore {
     }
 
     async clearAll(): Promise<void> {
-        const { error: credentialsError } = await this.supabase
-            .from('mcp_credentials')
-            .delete()
-            .neq('session_id', '');
-
-        if (credentialsError) {
-            console.error('[SupabaseStorage] Failed to clear credentials:', credentialsError);
-        }
-
         const { error } = await this.supabase
             .from('mcp_sessions')
             .delete()

package/src/server/storage/types.ts

@@ -46,6 +46,15 @@ export interface Session {
      */
     status?: SessionStatus;
     toolPolicy?: ToolPolicy;
+    /** When false, the session is excluded from agent tool discovery and RPC access. Defaults to true. */
+    enabled?: boolean;
+    clientInformation?: OAuthClientInformationMixed | null;
+    tokens?: OAuthTokens | null;
+    codeVerifier?: string | null;
+    codeVerifierChallenge?: string | null;
+    codeVerifierNonce?: string | null;
+    clientId?: string | null;
+    oauthState?: OAuthState | null;
 }
 
 export interface SessionCredentials {
@@ -54,6 +63,8 @@ export interface SessionCredentials {
     clientInformation?: OAuthClientInformationMixed | null;
     tokens?: OAuthTokens | null;
     codeVerifier?: string | null;
+    codeVerifierChallenge?: string | null;
+    codeVerifierNonce?: string | null;
     clientId?: string | null;
     oauthState?: OAuthState | null;
 }
@@ -86,6 +97,12 @@ export interface SetClientOptions {
 /**
  * Interface for MCP session stores.
  */
+export type GetOptions = {
+    includeCredentials?: boolean;
+};
+
+export type SessionResult = Session;
+
 export interface SessionStore {
     /**
      * Optional initialization (e.g., database connection)
@@ -118,9 +135,12 @@ export interface SessionStore {
     patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void>;
 
     /**
-     * Retrieves a session
+     * Retrieves a session, optionally including its credential fields in one round-trip.
+     * When includeCredentials is true, the returned session has credential fields
+     * (clientInformation, tokens, codeVerifier, etc.) populated from storage.
+     * When false or undefined, credential fields are left as undefined.
      */
-    get(userId: string, sessionId: string): Promise<Session | null>;
+    get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null>;
 
     /**
      * Retrieves runtime credentials for a session.

package/src/shared/types.ts

@@ -193,7 +193,8 @@ export type McpRpcMethod =
   | 'listResources'
   | 'readResource'
   | 'setToolPolicy'
-  | 'getToolPolicy';
+  | 'getToolPolicy'
+  | 'updateSession';
 
 export interface McpRpcRequest {
   id: string;
@@ -218,8 +219,6 @@ export interface ConnectParams {
   callbackUrl: string;
   transportType?: TransportType;
   headers?: Record<string, string>;
-  clientId?: string;
-  clientSecret?: string;
 }
 
 export interface DisconnectParams {
@@ -266,6 +265,11 @@ export interface GetToolPolicyParams {
   sessionId: string;
 }
 
+export interface UpdateSessionParams {
+  sessionId: string;
+  enabled?: boolean;
+}
+
 export type McpRpcParams =
   | ConnectParams
   | DisconnectParams
@@ -277,6 +281,7 @@ export type McpRpcParams =
   | FinishAuthParams
   | SetToolPolicyParams
   | GetToolPolicyParams
+  | UpdateSessionParams
   | undefined;
 
 // RPC Result Types
@@ -294,6 +299,7 @@ export interface SessionInfo {
    */
   status: SessionStatus;
   toolPolicy?: ToolPolicy;
+  enabled?: boolean;
 }
 
 export interface SessionListResult {
@@ -330,6 +336,10 @@ export interface SetToolPolicyResult {
   toolCount: number;
 }
 
+export interface UpdateSessionResult {
+  success: boolean;
+}
+
 export type ToolAccessInfo = Tool & {
   toolId: string;
   allowed: boolean;