@rigstate/mcp 0.6.0 → 0.6.2

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@rigstate/mcp",
-    "version": "0.6.0",
+    "version": "0.6.2",
     "description": "Rigstate MCP Server - Model Context Protocol for AI Editors",
     "type": "module",
     "main": "./dist/index.js",

package/src/lib/supabase.ts

@@ -69,31 +69,27 @@ export async function authenticateApiKey(apiKey: string): Promise<{
             error: 'Supabase configuration missing. Set RIGSTATE_SUPABASE_URL and RIGSTATE_SUPABASE_ANON_KEY.'
         };
     }
+    // Trim whitespace to avoid hash mismatch
+    const cleanApiKey = apiKey.trim();
 
     // Hash the API key with SHA-256 (same as web app)
-    const hashedKey = createHash('sha256').update(apiKey).digest('hex');
+    const hashedKey = createHash('sha256').update(cleanApiKey).digest('hex');
 
     // Use service key if available to bypass RLS, otherwise anon key
     const clientKey = SUPABASE_SERVICE_KEY || SUPABASE_ANON_KEY;
     const supabase = createSupabaseClient(SUPABASE_URL, clientKey);
 
-    // Look up the API key by HASH (not plain text!)
+    // Look up the API key by HASH using the secure RPC
+    // This bypasses RLS on the api_keys table via Security Definer function
     const { data: keyData, error: keyError } = await supabase
-        .from('api_keys')
-        .select('id, user_id, project_id, organization_id, scope')
-        .eq('key_hash', hashedKey)
+        .rpc('authenticate_api_key_hash', { hash: hashedKey })
         .single();
 
     if (keyError || !keyData) {
         return { success: false, error: 'Invalid or revoked API key' };
     }
 
-    // Update last_used_at timestamp (fire and forget)
-    supabase
-        .from('api_keys')
-        .update({ last_used_at: new Date().toISOString() })
-        .eq('id', keyData.id)
-        .then();
+    const { id, user_id } = keyData as { id: string; user_id: string };
 
     // Create a user-scoped client for subsequent operations
     // Use the most privileged key available (SERVICE_KEY or ANON_KEY)
@@ -102,8 +98,8 @@ export async function authenticateApiKey(apiKey: string): Promise<{
     return {
         success: true,
         context: {
-            userId: keyData.user_id,
-            apiKeyId: keyData.id,
+            userId: user_id,
+            apiKeyId: id,
             supabase: userSupabase
         }
     };