@programinglive/dev-workflow-mcp-server 1.7.13 → 1.7.14

package/CHANGELOG.md

@@ -2,6 +2,47 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [1.7.14](https://github.com/programinglive/dev-workflow-mcp-server/compare/v1.7.13...v1.7.14) (2025-12-19)
+
+
+### ✨ Features
+
+* add API dependencies and update login to use API client ([94bb42f](https://github.com/programinglive/dev-workflow-mcp-server/commit/94bb42f27b4bd225bb3813b81d5f2bff973edb16))
+* add REST API server for frontend database access ([cdb347c](https://github.com/programinglive/dev-workflow-mcp-server/commit/cdb347cf204ce423b94db7e72980783e986a124d))
+* implement JWT authentication and update client ([8efbe80](https://github.com/programinglive/dev-workflow-mcp-server/commit/8efbe80c3a69046f716b247fc359158dc8fec3e2))
+
+
+### ♻️ Refactors
+
+* remove session cookies, enforce JWT only ([bacd83a](https://github.com/programinglive/dev-workflow-mcp-server/commit/bacd83a16510499667143f4906d0cc8de0127d61))
+
+
+### 🐛 Bug Fixes
+
+* add credentials:include to getCurrentUser to persist session ([b8f2df5](https://github.com/programinglive/dev-workflow-mcp-server/commit/b8f2df531a2d2bae78ad3c3ea2c7dcda62e5e835))
+* add root netlify.toml for monorepo support ([54c5ed3](https://github.com/programinglive/dev-workflow-mcp-server/commit/54c5ed3960aafd5a814773efa487efe9197d4385))
+* enable trust proxy and force secure cookies for cross-domain session ([2c5d6e8](https://github.com/programinglive/dev-workflow-mcp-server/commit/2c5d6e858d05de06304d88286b931b1f12a95bf1))
+* ensure getMe uses full API URL ([b3bd0da](https://github.com/programinglive/dev-workflow-mcp-server/commit/b3bd0da097de57b42d9253615f791677011486af))
+* force API URL to tunnel address to resolve cached old IP ([1883731](https://github.com/programinglive/dev-workflow-mcp-server/commit/18837313a7b96395f1cf04b56d7fe1a74e13b1ed))
+* inline auth functions in API server ([eefd73c](https://github.com/programinglive/dev-workflow-mcp-server/commit/eefd73c82dcf47d419662eaeb8854f6047e6464a))
+* remove duplicate variable declarations in API server ([31d3621](https://github.com/programinglive/dev-workflow-mcp-server/commit/31d3621213ddb3560ee0570fdf6411d9acf7018f))
+* remove dynamic API route for static export ([05a4dd0](https://github.com/programinglive/dev-workflow-mcp-server/commit/05a4dd0e4901e5ac329e50ebe392839d1242de4e))
+* remove explicit publish path to fix netlify build ([cd64bcf](https://github.com/programinglive/dev-workflow-mcp-server/commit/cd64bcf0b4effb71be090235357d665d1f26b567))
+* remove incorrect netlify publish dir for dynamic build ([ea34cf4](https://github.com/programinglive/dev-workflow-mcp-server/commit/ea34cf464466b4ddc8eaa6432434d1fbabb3583e))
+* remove incorrect publish dir from netlify config ([010236f](https://github.com/programinglive/dev-workflow-mcp-server/commit/010236fd0eb1419f7cae4429159f4aac1a988174))
+* restore static export for netlify deployment ([685d841](https://github.com/programinglive/dev-workflow-mcp-server/commit/685d84178b239b5cd681b4d479456e69519a8af8))
+* update API URL to use Cloudflare Tunnel for HTTPS ([ab72f6c](https://github.com/programinglive/dev-workflow-mcp-server/commit/ab72f6c0b8acc6974aba7c8df8418e35da6f2a51))
+* use apiClient in history page and add version indicator ([4889669](https://github.com/programinglive/dev-workflow-mcp-server/commit/48896694166cd5d42ab4134d4dbfdb0df8ca0d44))
+* use npm install instead of ci to avoid lockfile issues ([e5fae26](https://github.com/programinglive/dev-workflow-mcp-server/commit/e5fae26f767c5f0e4aba2593df321c700ac14a38))
+
+
+### 🧹 Chores
+
+* bump version to 1.7.14 to ensure fresh build ([f7d8886](https://github.com/programinglive/dev-workflow-mcp-server/commit/f7d88861ceb111c57e3b34bf4b5a5cc25a19805b))
+* bump version to 1.7.15 for JWT frontend deploy ([7850268](https://github.com/programinglive/dev-workflow-mcp-server/commit/7850268d019251619d60a0a841db2bab8061be04))
+* cleanup post-release and update website version to 1.7.13 ([7341d44](https://github.com/programinglive/dev-workflow-mcp-server/commit/7341d446bbddcb9232e70606acaf950fde7ff5c2))
+* save pending changes before release ([4d4b1c9](https://github.com/programinglive/dev-workflow-mcp-server/commit/4d4b1c9e6122baed3cc6782a572fe3700dabf19b))
+
 ### [1.7.13](https://github.com/programinglive/dev-workflow-mcp-server/compare/v1.7.12...v1.7.13) (2025-12-18)
 
 

package/cloudflared-config.yml

@@ -0,0 +1,3 @@
+url: http://localhost:8080
+tunnel: api-devworkflow
+credentials-file: /home/dhika/.cloudflared/credentials.json

package/docker-compose.yml

@@ -19,6 +19,23 @@ services:
       timeout: 5s
       retries: 5
 
+  api:
+    build:
+      context: ./web
+      dockerfile: Dockerfile.api
+    container_name: dev-workflow-api
+    ports:
+      - "8080:8080"
+    environment:
+      - DEV_WORKFLOW_DB_URL=${DEV_WORKFLOW_DB_URL}
+      - SESSION_SECRET=${SESSION_SECRET:-dev-workflow-secret-change-in-production}
+      - NODE_ENV=${NODE_ENV:-production}
+      - API_PORT=8080
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: unless-stopped
+
 volumes:
   postgres_data:
     driver: local

package/docs/release-notes/RELEASE_NOTES.md

@@ -4,6 +4,8 @@ Authoritative history of user-visible changes for the Development Workflow MCP S
 
 | Version | Date | Notes |
 |---------|------|-------|
+| 1.7.14 | 2025-12-19 | add API dependencies and update login to use API client (94bb42f) |
+| 1.7.13 | 2025-12-18 | remote db connection, history api 500 errors, and windows startup (ce559a6) |
 | 1.7.12 | 2025-12-17 | post-release cleanup v1.7.11 (c2ee733) |
 | 1.7.11 | 2025-12-17 | test: comprehensive DB adapter tests, env support, and warning fixes (64b029a) |
 | 1.7.10 | 2025-12-16 | update release notes and finalize ci config (92ac78a) |
@@ -37,6 +39,42 @@ Authoritative history of user-visible changes for the Development Workflow MCP S
 
 
 
+
+
+## 1.7.14 – ✨ Features
+
+Released on **2025-12-19**.
+
+- add API dependencies and update login to use API client (94bb42f)
+- add REST API server for frontend database access (cdb347c)
+- implement JWT authentication and update client (8efbe80)
+- remove session cookies, enforce JWT only (bacd83a)
+- add credentials:include to getCurrentUser to persist session (b8f2df5)
+- add root netlify.toml for monorepo support (54c5ed3)
+- enable trust proxy and force secure cookies for cross-domain session (2c5d6e8)
+- ensure getMe uses full API URL (b3bd0da)
+- force API URL to tunnel address to resolve cached old IP (1883731)
+- inline auth functions in API server (eefd73c)
+- remove duplicate variable declarations in API server (31d3621)
+- remove dynamic API route for static export (05a4dd0)
+- remove explicit publish path to fix netlify build (cd64bcf)
+- remove incorrect netlify publish dir for dynamic build (ea34cf4)
+- remove incorrect publish dir from netlify config (010236f)
+- restore static export for netlify deployment (685d841)
+- update API URL to use Cloudflare Tunnel for HTTPS (ab72f6c)
+- use apiClient in history page and add version indicator (4889669)
+- use npm install instead of ci to avoid lockfile issues (e5fae26)
+- bump version to 1.7.14 to ensure fresh build (f7d8886)
+- bump version to 1.7.15 for JWT frontend deploy (7850268)
+- cleanup post-release and update website version to 1.7.13 (7341d44)
+- save pending changes before release (4d4b1c9)
+
+## 1.7.13 – 🐛 Bug Fixes
+
+Released on **2025-12-18**.
+
+- remote db connection, history api 500 errors, and windows startup (ce559a6)
+
 ## 1.7.12 – 📝 Documentation
 
 Released on **2025-12-17**.

package/netlify.toml

@@ -0,0 +1,7 @@
+[build]
+  base = "web"
+  command = "npm run build"
+  # publish = ".next" (Removed to allow auto-detection)
+
+[[plugins]]
+  package = "@netlify/plugin-nextjs"

package/nginx-api.conf

@@ -0,0 +1,27 @@
+server {
+    listen 80;
+    server_name api.devworkflow.programinglive.com;
+
+    location / {
+        proxy_pass http://localhost:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_cache_bypass $http_upgrade;
+        
+        # CORS headers (backup in case API doesn't set them)
+        add_header 'Access-Control-Allow-Origin' 'https://devworkflow.programinglive.com' always;
+        add_header 'Access-Control-Allow-Credentials' 'true' always;
+        add_header 'Access-Control-Allow-Methods' 'GET, POST, PUT, DELETE, OPTIONS' always;
+        add_header 'Access-Control-Allow-Headers' 'Content-Type, Authorization' always;
+        
+        # Handle preflight requests
+        if ($request_method = 'OPTIONS') {
+            return 204;
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@programinglive/dev-workflow-mcp-server",
-  "version": "1.7.13",
+  "version": "1.7.14",
   "description": "MCP server to enforce development workflow discipline",
   "homepage": "https://devworkflow.programinglive.com/",
   "mcpName": "io.github.programinglive/dev-workflow-mcp-server",

package/scripts/test-auth-flow.js

@@ -0,0 +1,75 @@
+import fetch from 'node-fetch';
+
+const API_BASE_URL = 'https://hollywood-andrew-cycle-genre.trycloudflare.com';
+const USERNAME = 'programinglive';
+const PASSWORD = 'mcpdevserver';
+
+async function testAuthFlow() {
+    console.log('🚀 Starting Auth Flow Test...');
+    console.log(`Target: ${API_BASE_URL}\n`);
+
+    try {
+        // 1. Login
+        console.log('1️⃣  Attempting Login...');
+        const loginRes = await fetch(`${API_BASE_URL}/api/auth/login`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ username: USERNAME, password: PASSWORD }),
+        });
+
+        console.log(`   Status: ${loginRes.status}`);
+        if (!loginRes.ok) {
+            throw new Error(`Login failed: ${loginRes.statusText}`);
+        }
+
+        const loginData = await loginRes.json();
+        const token = loginData.token;
+
+        if (token) {
+            console.log('   ✅ Login Successful! JWT Token received.');
+            console.log(`   Token: ${token.substring(0, 20)}...`);
+        } else {
+            console.log('   ⚠️  Login successful but NO TOKEN returned (Legacy Session mode?)');
+        }
+
+        // 2. Access Protected Route (GET /me)
+        console.log('\n2️⃣  Verifying Session/Token (GET /api/auth/me)...');
+        const headers = {};
+        if (token) {
+            headers['Authorization'] = `Bearer ${token}`;
+            console.log('   Using Authorization: Bearer header');
+        } else {
+            console.log('   Using Cookies (if any)');
+        }
+
+        const meRes = await fetch(`${API_BASE_URL}/api/auth/me`, {
+            headers,
+        });
+
+        console.log(`   Status: ${meRes.status}`);
+        if (meRes.ok) {
+            const meData = await meRes.json();
+            console.log(`   ✅ Authorized! User: ${meData.username} (${meData.email})`);
+        } else {
+            console.error('   ❌ Authorization Failed!');
+            console.error(await meRes.text());
+        }
+
+        // 3. Access History (GET /api/history)
+        console.log('\n3️⃣  Fetching History...');
+        const historyRes = await fetch(`${API_BASE_URL}/api/history`, { headers });
+        console.log(`   Status: ${historyRes.status}`);
+
+        if (historyRes.ok) {
+            const historyData = await historyRes.json();
+            console.log(`   ✅ History fetched! Count: ${historyData.history ? historyData.history.length : 0}`);
+        } else {
+            console.log('   ❌ History fetch failed.');
+        }
+
+    } catch (error) {
+        console.error('\n❌ Test Failed:', error.message);
+    }
+}
+
+testAuthFlow();

package/web/Dockerfile.api

@@ -0,0 +1,25 @@
+FROM node:20-alpine
+
+# Install dependencies for native modules
+RUN apk add --no-cache python3 make g++ postgresql-client
+
+WORKDIR /app
+
+# Copy package files
+COPY package*.json ./
+
+# Install dependencies
+RUN npm install --only=production
+
+# Copy application code
+COPY . .
+
+# Expose API port
+EXPOSE 8080
+
+# Set environment
+ENV NODE_ENV=production
+ENV API_PORT=8080
+
+# Run API server
+CMD ["node", "api-server.js"]

package/web/api-server.js

@@ -0,0 +1,211 @@
+import express from 'express';
+import cors from 'cors';
+import pg from 'pg';
+import dotenv from 'dotenv';
+import bcrypt from 'bcrypt';
+import jwt from 'jsonwebtoken';
+
+dotenv.config({ path: '../.env' });
+
+const app = express();
+const { Pool } = pg;
+
+const PORT = process.env.API_PORT || 8080;
+const dbUrl = process.env.DEV_WORKFLOW_DB_URL;
+const JWT_SECRET = process.env.JWT_SECRET || 'dev-workflow-jwt-secret-change-me';
+
+if (!dbUrl) {
+    console.error('❌ DEV_WORKFLOW_DB_URL is not set');
+    process.exit(1);
+}
+
+const pool = new Pool({ connectionString: dbUrl });
+
+// Authentication helper functions
+async function authenticateUser(pool, username, password) {
+    const result = await pool.query(
+        'SELECT * FROM users WHERE username = $1',
+        [username]
+    );
+
+    if (result.rows.length === 0) {
+        return null;
+    }
+
+    const user = result.rows[0];
+    const isValid = await bcrypt.compare(password, user.password_hash);
+
+    if (!isValid) {
+        return null;
+    }
+
+    return {
+        id: user.id,
+        username: user.username,
+        email: user.email,
+    };
+}
+
+async function getUserById(pool, userId) {
+    const result = await pool.query(
+        'SELECT id, username, email FROM users WHERE id = $1',
+        [userId]
+    );
+
+    return result.rows[0] || null;
+}
+
+// CORS configuration - allow Netlify domain
+const corsOptions = {
+    origin: [
+        'https://devworkflow.programinglive.com',
+        'http://localhost:3000',
+    ],
+    credentials: true,
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization'],
+};
+
+app.use(cors(corsOptions));
+app.use(express.json());
+app.use(express.urlencoded({ extended: true }));
+app.set('trust proxy', 1);
+
+// Middleware to verify JWT
+const requireAuth = (req, res, next) => {
+    const authHeader = req.headers.authorization;
+
+    if (authHeader && authHeader.startsWith('Bearer ')) {
+        const token = authHeader.split(' ')[1];
+        try {
+            const decoded = jwt.verify(token, JWT_SECRET);
+            req.user = decoded;
+            return next();
+        } catch (err) {
+            return res.status(401).json({ error: 'Invalid token' });
+        }
+    }
+
+    return res.status(401).json({ error: 'Authentication required' });
+};
+
+// Health check endpoint
+app.get('/api/health', (req, res) => {
+    res.json({ status: 'ok', timestamp: new Date().toISOString() });
+});
+
+// Authentication endpoints
+app.post('/api/auth/login', async (req, res) => {
+    try {
+        const { username, password } = req.body;
+
+        if (!username || !password) {
+            return res.status(400).json({ error: 'Username and password are required' });
+        }
+
+        const user = await authenticateUser(pool, username, password);
+
+        if (!user) {
+            return res.status(401).json({ error: 'Invalid credentials' });
+        }
+
+        // Generate JWT Token
+        const token = jwt.sign(
+            { userId: user.id, username: user.username },
+            JWT_SECRET,
+            { expiresIn: '30d' }
+        );
+
+        res.json({
+            success: true,
+            token,
+            user: {
+                id: user.id,
+                username: user.username,
+                email: user.email,
+            },
+        });
+    } catch (error) {
+        console.error('Login error:', error);
+        res.status(500).json({ error: 'Internal server error' });
+    }
+});
+
+app.post('/api/auth/logout', (req, res) => {
+    // Client-side only action for JWT
+    res.json({ success: true });
+});
+
+app.get('/api/auth/me', requireAuth, async (req, res) => {
+    try {
+        const user = await getUserById(pool, req.user.userId);
+
+        if (!user) {
+            return res.status(404).json({ error: 'User not found' });
+        }
+
+        res.json({
+            id: user.id,
+            username: user.username,
+            email: user.email,
+        });
+    } catch (error) {
+        console.error('Get user error:', error);
+        res.status(500).json({ error: 'Internal server error' });
+    }
+});
+
+// Workflow history endpoints
+app.get('/api/history', requireAuth, async (req, res) => {
+    try {
+        const result = await pool.query(
+            `SELECT id, task_type, description, commit_message, completed_at, tests_passed, documentation_type
+             FROM workflow_history
+             WHERE user_id = $1
+             ORDER BY completed_at DESC
+             LIMIT 100`,
+            [req.user.userId]
+        );
+
+        res.json({
+            history: result.rows,
+        });
+    } catch (error) {
+        console.error('Get history error:', error);
+        res.status(500).json({ error: 'Failed to fetch history' });
+    }
+});
+
+app.post('/api/history', requireAuth, async (req, res) => {
+    try {
+        const { task_type, description, commit_message, tests_passed, documentation_type } = req.body;
+
+        const result = await pool.query(
+            `INSERT INTO workflow_history (user_id, task_type, description, commit_message, tests_passed, documentation_type, completed_at)
+             VALUES ($1, $2, $3, $4, $5, $6, NOW())
+             RETURNING *`,
+            [req.user.userId, task_type, description, commit_message, tests_passed, documentation_type]
+        );
+
+        res.json({
+            success: true,
+            history: result.rows[0],
+        });
+    } catch (error) {
+        console.error('Create history error:', error);
+        res.status(500).json({ error: 'Failed to create history entry' });
+    }
+});
+
+// Error handling middleware
+app.use((err, req, res, next) => {
+    console.error('Unhandled error:', err);
+    res.status(500).json({ error: 'Internal server error' });
+});
+
+// Start server
+app.listen(PORT, '0.0.0.0', () => {
+    console.log(`✅ API server running on port ${PORT}`);
+    console.log(`📊 Database: ${dbUrl.replace(/:[^:]*@/, ':****@')}`);
+    console.log(`🌐 CORS enabled for: ${corsOptions.origin.join(', ')}`);
+});

package/web/app/history/page.tsx

@@ -2,6 +2,7 @@
 
 import { useEffect, useState, useMemo } from 'react';
 import { useRouter } from 'next/navigation';
+import { apiClient } from '@/lib/api-client';
 import {
     CheckCircle,
     XCircle,
@@ -34,27 +35,33 @@ export default function HistoryPage() {
     const router = useRouter();
 
     useEffect(() => {
-        fetch('/api/auth/me')
-            .then(res => {
-                if (res.ok) {
-                    setIsAuthenticated(true);
-                    // Sync auth state with Navbar
-                    localStorage.setItem('isLoggedIn', 'true');
-                    window.dispatchEvent(new Event('authUpdate'));
-                    return fetch('/api/history-fallback');
-                } else {
-                    router.push('/login');
+        const loadData = async () => {
+            try {
+                // Verify auth
+                const user = await apiClient.getCurrentUser();
+                if (!user) {
                     throw new Error('Not authenticated');
                 }
-            })
-            .then(res => res?.json())
-            .then(data => {
-                if (data?.history) {
-                    setHistory(data.history);
+
+                setIsAuthenticated(true);
+                // Sync auth state
+                localStorage.setItem('isLoggedIn', 'true');
+                window.dispatchEvent(new Event('authUpdate'));
+
+                // Fetch history
+                const result = await apiClient.getHistory();
+                if (result?.history) {
+                    setHistory(result.history);
                 }
-            })
-            .catch(() => { })
-            .finally(() => setLoading(false));
+            } catch (error) {
+                console.error('History load error:', error);
+                router.push('/login');
+            } finally {
+                setLoading(false);
+            }
+        };
+
+        loadData();
     }, [router]);
 
     const stats = useMemo(() => {

package/web/app/login/page.tsx

@@ -4,6 +4,7 @@ import { useState, useEffect } from 'react';
 import { useRouter } from 'next/navigation';
 import Image from 'next/image';
 import { Lock, User } from 'lucide-react';
+import { apiClient } from '@/lib/api-client';
 
 export default function LoginPage() {
     const [username, setUsername] = useState('');
@@ -21,9 +22,9 @@ export default function LoginPage() {
             return;
         }
 
-        fetch('/api/auth/me')
-            .then(res => {
-                if (res.ok) {
+        apiClient.getCurrentUser()
+            .then(user => {
+                if (user) {
                     router.push('/history');
                 }
             })
@@ -37,23 +38,17 @@ export default function LoginPage() {
         setLoading(true);
 
         try {
-            const response = await fetch('/api/auth/login', {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ username, password }),
-            });
+            const data = await apiClient.login(username, password);
 
-            const data = await response.json();
-
-            if (response.ok) {
+            if (data.success) {
                 localStorage.setItem('isLoggedIn', 'true');
                 window.dispatchEvent(new Event('authUpdate'));
                 router.push('/history');
             } else {
-                setError(data.error || 'Login failed');
+                setError('Login failed');
             }
-        } catch (err) {
-            setError('Network error. Please try again.');
+        } catch (err: any) {
+            setError(err.message || 'Network error. Please try again.');
         } finally {
             setLoading(false);
         }
@@ -77,6 +72,9 @@ export default function LoginPage() {
                     <p className="mt-2 text-sm text-gray-500 dark:text-gray-400">
                         Sign in to access your workflow history
                     </p>
+                    <p className="mt-1 text-xs text-gray-400 font-mono">
+                        v1.7.18 (JWT Fix)
+                    </p>
                 </div>
 
                 <form className="mt-8 space-y-6" onSubmit={handleSubmit}>

package/web/components/Hero.tsx

@@ -17,7 +17,7 @@ export default function Hero() {
             .catch(() => setDownloads(null));
 
         // Version is hardcoded for static export
-        setVersion("1.7.11");
+        setVersion("1.7.13");
     }, []);
 
     const formatDownloads = (num: number) => {

package/web/components/History.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useState, useEffect } from "react";
+import { apiClient } from "@/lib/api-client";
 
 type HistoryItem = {
     id: number;
@@ -31,11 +32,10 @@ export default function History() {
 
     const loadData = async () => {
         try {
-            // Fetch workflow history from API
-            const response = await fetch('/api/workflow/history');
+            // Fetch workflow history from API via apiClient
+            const data = await apiClient.getHistory();
 
-            if (response.ok) {
-                const data = await response.json();
+            if (data?.history) {
                 setHistory(data.history || []);
                 setTotalPages(Math.ceil((data.history?.length || 0) / 10));
                 setSummary({