@scorehub/mcp-server 0.1.3 → 0.1.4

package/dist/index.js

@@ -21,17 +21,7 @@ const AUTHORIZE_URL = `${REMOTE_MCP_URL}/authorize`;
 const auth_js_1 = require("./auth.js");
 const node_child_process_1 = require("node:child_process");
 const HOST = new URL(REMOTE_MCP_URL).host;
-let cachedToken = null;
-function getStoredToken() {
-    if (cachedToken)
-        return cachedToken;
-    const t = (0, auth_js_1.loadTokens)(HOST);
-    if (t?.access_token && t.expires_at > Date.now() + 60_000) {
-        cachedToken = t.access_token;
-        return cachedToken;
-    }
-    return null;
-}
+const CLIENT_ID = "scorehub-mcp";
 // ── Remote Tool Proxy ───────────────────────────────────────
 async function fetchRemoteTools() {
     try {
@@ -46,7 +36,7 @@ async function fetchRemoteTools() {
         return [];
     }
 }
-async function callRemoteTool(name, args) {
+async function callRemoteTool(name, args, token) {
     // Map tool names to remote endpoints
     const toolEndpoints = {
         search_creators: "/mcp/tools/search-creators",
@@ -63,7 +53,7 @@ async function callRemoteTool(name, args) {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
-            ...(cachedToken ? { Authorization: `Bearer ${cachedToken}` } : {}),
+            ...(token ? { Authorization: `Bearer ${token}` } : {}),
         },
         body: JSON.stringify(args),
     });
@@ -117,12 +107,8 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
     const { name, arguments: args = {} } = request.params;
     switch (name) {
         case "authorize": {
-            const existing = getStoredToken();
-            if (existing) {
-                return {
-                    content: [{ type: "text", text: "✅ 已授权，可直接使用工具。" }],
-                };
-            }
+            // Always force fresh OAuth flow when user explicitly authorizes
+            (0, auth_js_1.clearTokens)(HOST);
             const authUrl = generateAuthUrl();
             const os = process.platform;
             const cmd = os === "darwin" ? "open" : os === "win32" ? "start" : "xdg-open";
@@ -152,7 +138,6 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                     expires_at: Date.now() + (tokenData.expires_in ?? 3600) * 1000,
                     updated_at: new Date().toISOString(),
                 });
-                cachedToken = tokenData.access_token;
                 return {
                     content: [{ type: "text", text: "✅ 授权成功！可以开始使用工具了。" }],
                 };
@@ -164,14 +149,14 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             }
         }
         case "status": {
-            const token = getStoredToken();
+            const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
             return {
                 content: [
                     {
                         type: "text",
                         text: JSON.stringify({
                             remote_url: REMOTE_MCP_URL,
-                            authorized: !!token,
+                            authorized: !!tokenResult,
                             tools_count: remoteTools.length,
                         }, null, 2),
                     },
@@ -179,10 +164,9 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             };
         }
         default: {
-            // Check authorization for remote tools
-            const token = getStoredToken();
-            cachedToken = token;
-            if (!cachedToken) {
+            // Check authorization for remote tools — re-validates on every call
+            const tokenResult = await (0, auth_js_1.getValidAccessToken)(HOST, TOKEN_ENDPOINT, CLIENT_ID);
+            if (!tokenResult) {
                 const authUrl = generateAuthUrl();
                 return {
                     content: [
@@ -194,7 +178,7 @@ server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
                 };
             }
             try {
-                const result = await callRemoteTool(name, args);
+                const result = await callRemoteTool(name, args, tokenResult.access_token);
                 return { content: [{ type: "text", text: result }] };
             }
             catch (e) {

package/package.json

@@ -1,18 +1,25 @@
 {
   "name": "@scorehub/mcp-server",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "ScoreHub local MCP proxy — OAuth login, token caching, and tool forwarding to remote MCP endpoint",
   "main": "dist/index.js",
   "bin": {
     "scorehub-mcp": "./dist/index.js"
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "scripts": {
     "build": "tsc && node -e \"const fs=require('fs');const f='dist/index.js';fs.writeFileSync(f,'#!/usr/bin/env node\\n'+fs.readFileSync(f,'utf8'));fs.chmodSync(f,0o755)\"",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js"
   },
-  "keywords": ["mcp", "scorehub", "tiktok", "oauth"],
+  "keywords": [
+    "mcp",
+    "scorehub",
+    "tiktok",
+    "oauth"
+  ],
   "license": "MIT",
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0"