@sassoftware/sas-score-mcp-serverjs 1.0.1-29 → 1.0.1-30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sassoftware/sas-score-mcp-serverjs",
-  "version": "1.0.1-29",
+  "version": "1.0.1-30",
   "description": "A mcp server for SAS Viya",
   "author": "Deva Kumar <deva.kumar@sas.com>",
   "license": "Apache-2.0",

package/scripts/refreshtoken.js

@@ -0,0 +1,58 @@
+/*
+* Copyright © 2025, SAS Institute Inc., Cary, NC, USA.  All Rights Reserved.
+* SPDX-License-Identifier: Apache-2.0
+*/
+import { Agent, fetch } from 'undici';
+import fs from "fs";
+
+refreshToken()
+.then (token => {
+  console.log(token);
+  fs.writeFileSync('token.txt', token, 'utf8');
+})
+.catch (err => {
+  console.error('[Error] Failed to refresh token: ', err);
+});
+async function refreshToken(){
+  let host = process.env.VIYA_SERVER;
+  let token = "8afd75c0df5141b1a1d27dfe9db06fa5-r";
+  let url = `${host}/SASLogon/oauth/token`;
+
+  let aconnect = {
+    rejectUnauthorized: false  // or false, if you really want to bypass checks
+  }
+
+  const agent = new Agent(aconnect);
+
+  console.error('[Info] Refreshing token...', token);
+  const ibody = {
+    grant_type: 'refresh_token',
+    refresh_token: token,
+    client_id: 'sas.cli'
+  };
+
+  let body = new URLSearchParams(ibody);
+  try {
+    const response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        'Accept': 'application/json',
+        'Content-Type': 'application/x-www-form-urlencoded',
+        dispatcher: agent
+      },
+      body: body.toString()
+    });
+
+    if (!response.ok) {
+      const error = await response.text();
+      console.error('[Error] Failed to refresh token: ', error);
+      throw new Error(error);
+    }
+
+    const data = await response.json();
+    return data.access_token;
+  } catch (err) {
+    console.error('[Error] Failed to refresh token: ', err);
+    throw err;
+  }
+}

package/scripts/token.txt

@@ -0,0 +1 @@
+eyJqa3UiOiJodHRwczovL2xvY2FsaG9zdC9TQVNMb2dvbi90b2tlbl9rZXlzIiwia2lkIjoibGVnYWN5LXRva2VuLWtleSIsInR5cCI6IkpXVCIsImFsZyI6IlJTMjU2In0.eyJzdWIiOiIxNjQzMmUzNC1kNTFiLTQ0ODUtYmRhNS0xMTBkYWI2ODJkMjAiLCJ1c2VyX25hbWUiOiJkZXZhLmt1bWFyQHNhcy5jb20iLCJvcmlnaW4iOiJleHRlcm5hbF9vYXV0aCIsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3QvU0FTTG9nb24vb2F1dGgvdG9rZW4iLCJhdXRob3JpdGllcyI6WyJWU0NvZGVHZW5BSSIsIkRhdGFRdWFsaXR5LkRhdGFRdWFsaXR5TW9uaXRvcmluZ0FkbWluaXN0cmF0b3JzIiwiU2NoZWR1bGVTZXJ2aWNlQWNjb3VudFVzZXJzIiwiQXBwbGljYXRpb25BZG1pbmlzdHJhdG9ycyIsIkJhdGNoU2VydmljZUFjY291bnRVc2VycyIsIkxhdW5jaGVyU3VwZXJVc2VycyIsIkVzcmlVc2VycyIsIkRhdGFBZ2VudEFkbWluaXN0cmF0b3JzIiwiU0NJTSIsIkRhdGFBZ2VudFBvd2VyVXNlcnMiLCJTQVNTY29yZVVzZXJzIiwiU0FTQWRtaW5pc3RyYXRvcnMiLCJHbG9zc2FyeS5HbG9zc2FyeUFkbWluaXN0cmF0b3JzIiwiQ2F0YWxvZy5TdWJqZWN0TWF0dGVyRXhwZXJ0cyIsIkNvbXB1dGVTZXJ2aWNlQWNjb3VudFVzZXJzIiwiQ0FTSG9zdEFjY291bnRSZXF1aXJlZCJdLCJjbGllbnRfaWQiOiJzYXMuY2xpIiwiYXVkIjpbInVhYSIsInNhcy1jb21wdXRlIiwic2FzLXRyYW5zZmVyIiwic2FzLXdvcmtsb2FkLW9yY2hlc3RyYXRvciIsInNhcy1jb25uZWN0Iiwic2FzLWNhcy1tYW5hZ2VtZW50Iiwic2FzLXNjaGVkdWxlciIsImNsaWVudHMiLCJzYXMtcmVwb3J0LXBhY2thZ2VzIiwib3BlbmlkIiwic2FzLWZvbnRzIiwic2FzLWNyZWRlbnRpYWxzIiwic2FzLWNvbmZpZ3VyYXRpb24iLCJzYXMuY2xpIiwic2FzLWF1dGhvcml6YXRpb24iLCJzYXMtZGV2aWNlLW1hbmFnZW1lbnQiLCJzYXMtZm9sZGVycyIsInNhcy1qb2ItZXhlY3V0aW9uIiwic2FzLWF1ZGl0Iiwic2FzLWlkZW50aXRpZXMiLCJzYXMtYmF0Y2giLCJzY2ltIiwic2FzLWxhdW5jaGVyIl0sImV4dF9pZCI6IjAwdTJzcTg3Ynh0YTI2OEhaMnA3IiwicmVtb3RlX2lwIjoiMTQ5LjE3My40NS44OCIsInppZCI6InVhYSIsImdyYW50X3R5cGUiOiJhdXRob3JpemF0aW9uX2NvZGUiLCJ1c2VyX2lkIjoiMTY0MzJlMzQtZDUxYi00NDg1LWJkYTUtMTEwZGFiNjgyZDIwIiwiYXpwIjoic2FzLmNsaSIsInNjb3BlIjpbInNhcy1jb21wdXRlLnVzZXJfaW1wZXJzb25hdGlvbiIsInNhcy1jYXMtbWFuYWdlbWVudC51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtaWRlbnRpdGllcy51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtbGF1bmNoZXIudXNlcl9pbXBlcnNvbmF0aW9uIiwic2FzLWNyZWRlbnRpYWxzLnVzZXJfaW1wZXJzb25hdGlvbiIsInNhcy1hdWRpdC51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtY29uZmlndXJhdGlvbi51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtc2NoZWR1bGVyLnVzZXJfaW1wZXJzb25hdGlvbiIsImNsaWVudHMucmVhZCIsInNhcy1iYXRjaC51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtam9iLWV4ZWN1dGlvbi51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtZGV2aWNlLW1hbmFnZW1lbnQudXNlcl9pbXBlcnNvbmF0aW9uIiwiY2xpZW50cy5zZWNyZXQiLCJvcGVuaWQiLCJzYXMtZm9udHMudXNlcl9pbXBlcnNvbmF0aW9uIiwic2FzLXdvcmtsb2FkLW9yY2hlc3RyYXRvci51c2VyX2ltcGVyc29uYXRpb24iLCJ1YWEuYWRtaW4iLCJjbGllbnRzLmFkbWluIiwic2FzLWF1dGhvcml6YXRpb24udXNlcl9pbXBlcnNvbmF0aW9uIiwic2NpbS5yZWFkIiwidWFhLnVzZXIiLCJzYXMtY29ubmVjdC51c2VyX2ltcGVyc29uYXRpb24iLCJzYXMtcmVwb3J0LXBhY2thZ2VzLnVzZXJfaW1wZXJzb25hdGlvbiIsInNhcy1mb2xkZXJzLnVzZXJfaW1wZXJzb25hdGlvbiIsIlNBU0FkbWluaXN0cmF0b3JzIiwiY2xpZW50cy53cml0ZSIsInNjaW0ud3JpdGUiLCJzYXMtdHJhbnNmZXIudXNlcl9pbXBlcnNvbmF0aW9uIl0sImF1dGhfdGltZSI6MTc3ODY4NjQ5NywiZXhwIjoxNzc4NzAxMTY1LCJpYXQiOjE3Nzg2OTc1NjUsImp0aSI6ImFjNTk0ZGQyMDA0NDQwYTBhYjAzZGJlNzlmMWIzMzI5IiwiZW1haWwiOiJkZXZhLmt1bWFyQHNhcy5jb20iLCJyZXZfc2lnIjoiMmVjZTJiZDAiLCJjbGllbnRfYXV0aF9tZXRob2QiOiJub25lIiwiY2lkIjoic2FzLmNsaSJ9.fBObEchePj1_u3xpdXaXuy3O_7fiZyYSY38fK37LEduGs45ktDaYi_F7hWCQnHEK45b8Ti_ROcyesCVjUcXPzzbw722PYEDT4909qnUM-n0DXEV1tCoOkSbMF7Gv-wbRif7cJP2Q3G-sO5dkw9blGJC-YbvzR04f-TqhcQqmaxQLh7E-G4qIvKtcKtB9j4pCwwc-Dz9LxqIcY5xpEF92wnqYdKtNGSGQsTHyR0cCNAkQBv-dO6snhplBMVZrSGbuo0mGZcA3736n1JJ1jKvPT1rPKn7vtUO30sLfNP3rL21SAEZ6wO3SOs_liJNMllC_cJq5jYytx0rfYuubUH0xZA

package/src/expressMcpServer.js

@@ -9,6 +9,7 @@ import cors from "cors";
 import bodyParser from "body-parser";
 import selfsigned from "selfsigned";
 import openAPIJson from "./openAPIJson.js";
+import createMcpServer from "./createMcpServer.js";
 
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { randomUUID } from "node:crypto";
@@ -21,7 +22,7 @@ import processHeaders from "./processHeaders.js";
 
 // setup express server
 
-async function expressMcpServer(mcpServer, cache, baseAppEnvContext) {
+async function expressMcpServer(_mcpServer, cache, baseAppEnvContext) {
   // setup for change to persistence session
   cache.del("headerCache");
   const app = express();
@@ -50,23 +51,8 @@ async function expressMcpServer(mcpServer, cache, baseAppEnvContext) {
   const pkceStore = new Map(); // ourState -> { codeVerifier, clientRedirectUri, clientState }
   const codeStore = new Map(); // ourCode   -> { access_token, refresh_token, expires_in }
 
-  // Create ONE shared transport for all sessions/users
-  const sharedTransport = new StreamableHTTPServerTransport({
-    sessionIdGenerator: () => randomUUID(),
-    enableJsonResponse: true,
-    enableDnsRebindingProtection: true,
-    onsessioninitialized: (sessionId) => {
-      console.error("[Note] Session initialized with ID:", sessionId);
-    },
-  });
-
-  // Connect mcpServer to the shared transport ONCE
-  await mcpServer.connect(sharedTransport);
-  console.error("[Note] MCP Server connected to shared transport");
-
-  // Store the shared transport for use in request handlers
-  cache.set("sharedTransport", sharedTransport);
-  const transports = new Map(); // Track active session transports for cleanup
+  // Per-session transports — each initialize creates its own transport
+  const transports = new Map(); // sessionId -> transport
   cache.set("transports", transports);
 
   app.get('/.well-known/oauth-protected-resource', (req, res) => {
@@ -171,27 +157,53 @@ async function expressMcpServer(mcpServer, cache, baseAppEnvContext) {
 
   // process mcp endpoint requests
   const handleRequest = async (req, res) => {
-    let transport = cache.get("sharedTransport");
     console.error("=========================================================");
     console.error("Processing POST /mcp request");
-
-    console.error("current active sessions:", cache.get("transports").size);
+    console.error("current active sessions:", transports.size);
     try {
 
       let sessionId = req.headers["mcp-session-id"];
       console.error("[Note]Incoming session ID:", sessionId);
       let body = (req.body == null) ? 'no body' : JSON.stringify(req.body);
       console.error('[Note] Payload is ', body);
-      if (!sessionId && isInitializeRequest(req.body)) {
-        // Use the shared transport for new initialization request
-        console.error("[Note] Initializing new session with shared transport...");
+     
+      if (isInitializeRequest(req.body)) {
+        console.error("[Note]>>>>>>>>>>>>>>>>>>>>>>>>>  Creating  new MCP server");
+        let mcpServer = await createMcpServer(cache, baseAppEnvContext);
+        // New session — create a dedicated transport
+        console.error("[Note] Initializing new session with fresh transport...");
+        const isInitRequest = req.body?.method === 'initialize';
+
+        const transport = new StreamableHTTPServerTransport({
+          sessionIdGenerator: () => randomUUID(),
+          enableJsonResponse: true,
+          onsessioninitialized: (newSessionId) => {
+            console.error("[Note] Session initialized with ID:", newSessionId);
+            transports.set(newSessionId, transport);
+            cache.set("transports", transports);
+            console.error("[Note] Total active sessions:", Object.keys(transports));
+          },
+        });
+        transport.onclose = () => {
+          if (transport.sessionId) {
+            console.error("[Note] Session closed, removing transport:", transport.sessionId);
+            transports.delete(transport.sessionId);
+            cache.del(transport.sessionId);
+          }
+        };
+        await mcpServer.connect(transport);
         console.error("=======================================================");
         return await transport.handleRequest(req, res, req.body);
 
       } else if (sessionId != null) {
+        const transport = transports.get(sessionId);
+        if (!transport) {
+          console.error("[Note] Unknown session ID:", sessionId);
+          return res.status(404).json({ jsonrpc: "2.0", error: { code: -32000, message: "Session not found. Please re-initialize." }, id: null });
+        }
         console.error('[Note] Incoming session ID:', sessionId);
-        console.error("[Note] Using shared transport for session ID:", sessionId);
-        
+        console.error("[Note] Using transport for session ID:", sessionId);
+
         // post the current session - used to pass _appContext to tools
         cache.set("currentId", sessionId);
 
@@ -239,21 +251,28 @@ async function expressMcpServer(mcpServer, cache, baseAppEnvContext) {
     const sessionId = req.headers["mcp-session-id"];
     console.error("[Note] SessionId:", sessionId);
 
-    let transport = cache.get("sharedTransport");
-    console.error("[Note] Using shared transport");
-    /*
     if (!sessionId) {
-      res.status(404).send(`[Error] In ${req.method}: Invalid or missing session ID ${sessionId}`);
-      return;
+      console.error("[Note] No session ID on /DELETE — rejecting");
+      return res.status(400).json({ jsonrpc: "2.0", error: { code: -32000, message: "Bad Request: Mcp-Session-Id header is required" }, id: null });
     }
-      */
+
+    const transport = transports.get(sessionId);
+    if (!transport) {
+      console.error("[Note] Unknown session ID:", sessionId);
+      return res.status(404).json({ jsonrpc: "2.0", error: { code: -32000, message: "Session not found. Please re-initialize." }, id: null });
+    }
+
     if (req.method === "GET") {
+      console.error("[Note] calling transport.handleRequest for GET /mcp");
       await transport.handleRequest(req, res);
       return;
     }
-    if (req.method === "DELETE" && sessionId != null) {
-      console.error("[Note] Deleting cache for session ID:", sessionId);
+    if (req.method === "DELETE") {
+      console.error("[Note] Deleting transport and cache for session ID:", sessionId);
+      transports.delete(sessionId);
       cache.del(sessionId);
+      console.error("[Note] Deleted session ID:", sessionId);
+      console.error("[Note] Total active sessions:", Object.keys(transports));
       res.status(201).send(`[Info] Deleted session ${sessionId}`);
     }
   }

package/src/processHeaders.js

@@ -30,7 +30,6 @@ function processHeaders(req, res, next, cache, appContext) {
   const hdr = req.header("Authorization");
   //for now, ignore Authorization if authflow is not bearer
   let token = (hdr != null) ? hdr.slice(7) : null;
-  //console.error("[Note] Authorization token", token);
   debugger;
   console.error('[Note} AUTHFLOW=',   appContext.AUTHFLOW);
   console.error("[Note] External authorization :", appContext.AUTHEXTERNAL);
@@ -42,7 +41,6 @@ function processHeaders(req, res, next, cache, appContext) {
       console.error("[Note] Expecting external authorization"); 
       if (token != null) {
         console.error("[Note] Using user supplied token for authorization");
-        console.error("[Note] Incoming token:", token);
         headerCache.bearerToken = token;
       } else {
         console.error("[Note] No Authorization token provided in header for external authorization.");

package/src/toolHelpers/getLogonPayload.js

@@ -47,7 +47,6 @@ async function igetLogonPayload(_appContext) {
       return null;
     }
     console.error("[Note] Using user supplied bearer token ");
-    console.error("[Note] Ensure this token is valid and not expired: ", _appContext.bearerToken.substring(0,20) + "...");
     let logonPayload = {
       host: _appContext.VIYA_SERVER,
       authType: "server",
@@ -72,8 +71,7 @@ async function igetLogonPayload(_appContext) {
   }
   
   if (_appContext.AUTHFLOW === "token") {
-    console.error("[Note] Using token supplied by user");
-    console.error("[Note] Ensure this token is valid and not expired: ", _appContext.TOKEN.substring(0,20) + "...");
+    console.error("[Note] Using token supplied by user");  
     let logonPayload = {
       host: _appContext.VIYA_SERVER,
       authType: "server",