@productbrain/mcp 0.0.1-beta.9450 → 0.0.1-beta.9452

package/dist/http.js

@@ -2,7 +2,7 @@ import {
   SERVER_VERSION,
   createProductBrainServer,
   initFeatureFlags
-} from "./chunk-BCYOMOD2.js";
+} from "./chunk-NCTCZQHK.js";
 import {
   DEFAULT_CLOUD_URL,
   apiKeysUrl,
@@ -14,10 +14,10 @@ import {
   initAnalytics,
   runWithAuth,
   shutdownAnalytics
-} from "./chunk-DKJ4X2D7.js";
+} from "./chunk-Q77SFDBZ.js";
 
 // src/http.ts
-import { createHash, randomUUID as randomUUID2 } from "crypto";
+import { createHash, randomUUID } from "crypto";
 import express from "express";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
@@ -56,63 +56,6 @@ function appLogoMarkup(opts = {}) {
   return `<span class="${cls}"><span class="pb-logo__mark"><span class="pb-logo__core"></span></span>${wordmark}</span>`;
 }
 
-// src/lib/refresh-token.ts
-import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "crypto";
-var REFRESH_TOKEN_TTL_MS = 90 * 24 * 60 * 6e4;
-var PREFIX = "pb_rt_";
-var secret = (() => {
-  const fromEnv = process.env.MCP_REFRESH_SECRET;
-  if (fromEnv && fromEnv.length > 0) return Buffer.from(fromEnv, "utf8");
-  if (process.env.NODE_ENV === "production") {
-    console.warn(
-      "[HTTP] WARNING MCP_REFRESH_SECRET not set \u2014 refresh tokens will not survive restart"
-    );
-  }
-  return randomBytes(32);
-})();
-function sign(payloadB64) {
-  return createHmac("sha256", secret).update(payloadB64).digest();
-}
-function signRefreshToken(apiKey) {
-  const payload = {
-    k: apiKey,
-    i: Date.now(),
-    j: randomUUID()
-  };
-  const payloadB64 = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-  const sigB64 = sign(payloadB64).toString("base64url");
-  return `${PREFIX}${payloadB64}.${sigB64}`;
-}
-function verifyRefreshToken(token) {
-  if (typeof token !== "string" || !token.startsWith(PREFIX)) return null;
-  const body = token.slice(PREFIX.length);
-  const dot = body.indexOf(".");
-  if (dot <= 0 || dot === body.length - 1) return null;
-  const payloadB64 = body.slice(0, dot);
-  const sigB64 = body.slice(dot + 1);
-  let providedSig;
-  try {
-    providedSig = Buffer.from(sigB64, "base64url");
-  } catch {
-    return null;
-  }
-  const expectedSig = sign(payloadB64);
-  if (providedSig.length !== expectedSig.length) return null;
-  if (!timingSafeEqual(providedSig, expectedSig)) return null;
-  let payload;
-  try {
-    const json = Buffer.from(payloadB64, "base64url").toString("utf8");
-    payload = JSON.parse(json);
-  } catch {
-    return null;
-  }
-  if (!payload || typeof payload.k !== "string" || typeof payload.i !== "number" || typeof payload.j !== "string") {
-    return null;
-  }
-  if (Date.now() - payload.i > REFRESH_TOKEN_TTL_MS) return null;
-  return { apiKey: payload.k };
-}
-
 // src/sessionCap.ts
 function planKeyAdmission(sessions2, keyHash, cap, now, opts) {
   if (cap < 1) {
@@ -225,7 +168,7 @@ var AUTH_FAILURE_MAX = 10;
 var AUTH_FAILURE_WINDOW_MS = 5 * 6e4;
 var AUTH_BLOCK_DURATION_MS = 15 * 6e4;
 var MAX_AUTH_FAILURE_ENTRIES = 1e4;
-function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenTtlMs) {
+function resolveBearerAuth(authorizationHeader) {
   if (typeof authorizationHeader !== "string" || authorizationHeader.trim() === "") {
     return { status: "absent" };
   }
@@ -239,15 +182,6 @@ function resolveBearerAuth(authorizationHeader, accessTokens2, now, accessTokenT
   if (token.startsWith("pb_sk_")) {
     return { status: "ok", apiKey: token };
   }
-  if (token.startsWith("pb_at_")) {
-    const entry = accessTokens2.get(token);
-    if (!entry) return { status: "rejected" };
-    if (now - entry.createdAt > accessTokenTtlMs) {
-      accessTokens2.delete(token);
-      return { status: "rejected" };
-    }
-    return { status: "ok", apiKey: entry.apiKey };
-  }
   return { status: "rejected" };
 }
 function checkAuthBlock(failures, ip, now) {
@@ -361,6 +295,14 @@ function pendingCodeRefusal(pending, redirectUri, now) {
   if (now > pending.expiresAt) return "expired";
   return null;
 }
+function tokenResponse(apiKey) {
+  return {
+    access_token: apiKey,
+    token_type: "Bearer",
+    // 1 year: validity is enforced by Convex on every call, not by this clock.
+    expires_in: 365 * 24 * 3600
+  };
+}
 
 // src/http.ts
 bootstrapHttp();
@@ -411,7 +353,8 @@ app.get("/.well-known/oauth-authorization-server", (req, res) => {
     token_endpoint: `${base}/oauth/token`,
     registration_endpoint: `${base}/register`,
     response_types_supported: ["code"],
-    grant_types_supported: ["authorization_code", "refresh_token"],
+    grant_types_supported: ["authorization_code"],
+    // TEN-4548: no refresh grant (lib/oauthAuthCode.ts tokenResponse)
     code_challenge_methods_supported: ["S256"],
     token_endpoint_auth_methods_supported: ["none"],
     scopes_supported: ["mcp:tools", "mcp:resources"]
@@ -444,7 +387,7 @@ app.post(
       res.status(400).json({ error: "invalid_redirect_uri", error_description: refusal });
       return;
     }
-    const clientId = `pb_client_${randomUUID2()}`;
+    const clientId = `pb_client_${randomUUID()}`;
     const client = {
       client_id: clientId,
       redirect_uris,
@@ -463,9 +406,6 @@ app.post(
   }
 );
 var pendingCodes = /* @__PURE__ */ new Map();
-var ACCESS_TOKEN_TTL = 3600;
-var ACCESS_TOKEN_TTL_MS = ACCESS_TOKEN_TTL * 1e3;
-var accessTokens = /* @__PURE__ */ new Map();
 setInterval(() => {
   const now = Date.now();
   for (const [code, auth] of pendingCodes) {
@@ -474,9 +414,6 @@ setInterval(() => {
   for (const [id, client] of registeredClients) {
     if (now - client.registeredAt > 24 * 60 * 6e4) registeredClients.delete(id);
   }
-  for (const [token, entry] of accessTokens) {
-    if (now - entry.createdAt > ACCESS_TOKEN_TTL_MS) accessTokens.delete(token);
-  }
   for (const [ip, rec] of authFailures) {
     if (rec.blockedUntil < now && rec.firstFailure + AUTH_FAILURE_WINDOW_MS < now) {
       authFailures.delete(ip);
@@ -1172,7 +1109,7 @@ app.post(
     } catch {
       process.stderr.write("[authorize] key-check unavailable \u2014 proceeding without validation\n");
     }
-    const code = randomUUID2();
+    const code = randomUUID();
     pendingCodes.set(code, {
       apiKey: api_key,
       codeChallenge: code_challenge,
@@ -1191,35 +1128,13 @@ app.post(
     }
   }
 );
-function issueTokens(apiKey) {
-  return {
-    access_token: apiKey,
-    token_type: "Bearer",
-    // 1-year TTL: actual validity enforced by Convex, not by expiry clock.
-    // Long TTL prevents unnecessary refresh cycles after restarts.
-    expires_in: 365 * 24 * 3600,
-    refresh_token: signRefreshToken(apiKey)
-  };
-}
 app.post(
   "/oauth/token",
   authLimiter,
   express.urlencoded({ extended: false }),
   express.json(),
   (req, res) => {
-    const { grant_type, code, code_verifier, redirect_uri, refresh_token } = req.body;
-    if (grant_type === "refresh_token") {
-      const verified = verifyRefreshToken(refresh_token);
-      if (!verified) {
-        res.status(400).json({
-          error: "invalid_grant",
-          error_description: "Invalid or expired refresh token"
-        });
-        return;
-      }
-      res.json(issueTokens(verified.apiKey));
-      return;
-    }
+    const { grant_type, code, code_verifier, redirect_uri } = req.body;
     if (grant_type !== "authorization_code") {
       res.status(400).json({ error: "unsupported_grant_type" });
       return;
@@ -1245,7 +1160,7 @@ app.post(
       return;
     }
     pendingCodes.delete(code);
-    res.json(issueTokens(pending.apiKey));
+    res.json(tokenResponse(pending.apiKey));
   }
 );
 var mcpLimiter = rateLimit({
@@ -1339,7 +1254,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
     send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("POST", "auth_fail");
     if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
@@ -1396,7 +1311,7 @@ app.post("/mcp", mcpLimiter, async (req, res) => {
           }));
           return;
         }
-        const sid = randomUUID2();
+        const sid = randomUUID();
         let initialized = false;
         const transport = new StreamableHTTPServerTransport({
           sessionIdGenerator: () => sid,
@@ -1479,7 +1394,7 @@ app.get("/mcp", mcpLimiter, async (req, res) => {
     send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("GET", "auth_fail");
     if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);
@@ -1528,7 +1443,7 @@ app.delete("/mcp", mcpLimiter, async (req, res) => {
     send429(res, buildAuthLockoutError({ retryAfterSeconds, limit: AUTH_FAILURE_MAX, current: rec?.count ?? AUTH_FAILURE_MAX, id: req.body?.id ?? null }));
     return;
   }
-  const auth = resolveBearerAuth(req.headers?.authorization, accessTokens, nowTs, ACCESS_TOKEN_TTL_MS);
+  const auth = resolveBearerAuth(req.headers?.authorization);
   if (auth.status !== "ok") {
     logRequest("DELETE", "auth_fail");
     if (auth.status === "rejected") recordAuthFailure(authFailures, reqIp, nowTs);