@sendinel/mcp-server 1.0.119 → 1.0.121

package/build/lib/action-approvals.js

@@ -1,3 +1,4 @@
+import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { GATED_ACTIONS, PROTECTED_ACTIONS } from './approval-actions.js';
 export { isApprovalGatedAction } from './approval-actions.js';
@@ -363,7 +364,10 @@ export async function checkApproval(approvalId, options = {}) {
     if (data.used_at || data.status === 'used')
         return { approved: false, status: 'consumed' };
     if (data.status === 'approved' && (!isHumanApprovalChannel(data.decided_via) ||
-        (isHumanRequestableAdminTool(data.action) && data.decided_via !== 'dashboard'))) {
+        (isHumanRequestableAdminTool(data.action) && data.decided_via !== 'dashboard' &&
+            (!['mcp_app', 'mcp_elicitation'].includes(data.decided_via) ||
+                !await humanApprovalEligible(data.action, getProjectId(), { projectId: getProjectId(),
+                    actorId: data.decided_by, oauthTokenId: data.oauth_token_id, authKind: 'oauth', channelVerified: true }))))) {
         return { approved: false, status: 'human_decision_required' };
     }
     if (data.status !== 'approved' || !options.consume) {

package/build/lib/approval-app.js

@@ -1,4 +1,4 @@
-import { isHumanRequestableAdminTool } from './admin-tools.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { randomBytes } from 'node:crypto';
 import { buildApprovalPreview } from '@sendinel/domain';
 import { APPROVAL_APP, APPROVAL_APP_SESSION_META } from './approval-app-conventions.js';
@@ -66,11 +66,10 @@ function live(approval) {
  */
 export async function offerApprovalApp(approval) {
     const runtime = calls.getStore(), actor = identity();
-    if (isHumanRequestableAdminTool(approval.action))
-        return {};
     if (!runtime || !runtime.canDecide || !actor || !approvalAppEnabled() || approval.tier === 'protected' || !live(approval))
         return {};
-    if (await resolveApprovalChannel(runtime.server.server) !== 'mcp_app')
+    if (await resolveApprovalChannel(runtime.server.server) !== 'mcp_app' ||
+        !await humanApprovalEligible(approval.action, actor.projectId))
         return {};
     return { _meta: { ui: { [APPROVAL_APP.resultUriKey]: resourceUri(approval.id) } } };
 }
@@ -95,7 +94,7 @@ export function installApprovalApp(server, options = {}, approvalTool = () => fa
             if (!bound.canDecide || !actor || !approvalAppEnabled() || await resolveApprovalChannel(server.server) !== 'mcp_app')
                 throw unavailable();
             const approval = await loadOwnedPendingApproval(id, actor);
-            if (!approval || isHumanRequestableAdminTool(approval.action))
+            if (!approval || !await humanApprovalEligible(approval.action, actor.projectId))
                 throw unavailable();
             // One outstanding render session per approval. Re-render invalidates the old view.
             const token = await mintApprovalAppSession(approval, actor);
@@ -124,7 +123,7 @@ export function installApprovalApp(server, options = {}, approvalTool = () => fa
                     return refused();
                 const approval = await loadOwnedPendingApproval(approval_id, actor);
                 // Single guarded claim before the callback, so concurrent clicks cannot reuse a session.
-                if (!approval || isHumanRequestableAdminTool(approval.action) || !await claimApprovalAppSession(app_session, approval, actor))
+                if (!approval || !await humanApprovalEligible(approval.action, actor.projectId) || !await claimApprovalAppSession(app_session, approval, actor))
                     return refused();
                 const connectionId = `oauth:${actor.oauthTokenId}`;
                 const callback = createHumanApprovalCallback({ approvalId: approval.id, projectId: actor.projectId,

package/build/lib/approval-elicitation-relay.d.ts

@@ -0,0 +1,19 @@
+import type { ElicitRequest, JSONRPCRequest } from '@modelcontextprotocol/sdk/types.js';
+import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
+export declare function isElicitationResponse(body: unknown): boolean;
+/** Auth has already run. Unknown and malformed responses are deliberately indistinguishable.
+ * No decision can enter this path via a tools/call, model text, or nested tool arguments.
+ */
+export declare function recordElicitationResponse(body: unknown, identity: HumanDecisionIdentity): Promise<void>;
+/** Insert before sending, using the exact wire id (a UUID, since each stateless SDK starts
+ * its request counter at zero). Poll the persisted prompt; never await a response on the old
+ * SDK Server, because the client's answer necessarily arrives at a fresh Server via POST.
+ */
+export declare function relayElicitation(options: {
+    approvalId: string;
+    action: string;
+    identity: HumanDecisionIdentity;
+    params: ElicitRequest['params'];
+    signal: AbortSignal;
+    send(message: JSONRPCRequest): Promise<void>;
+}): Promise<'approved' | 'rejected' | 'decision_pending'>;

package/build/lib/approval-elicitation-relay.js

@@ -0,0 +1,124 @@
+import { randomUUID } from 'node:crypto';
+import { approvalStore } from './tester-requests-store.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+const TABLE = 'mcp_elicitation_prompts';
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+function email() {
+    const source = approvalStore();
+    return typeof source.schema === 'function' ? source.schema('email') : source;
+}
+export function isElicitationResponse(body) {
+    const message = object(body);
+    return !!message && !('method' in message) && 'id' in message && ('result' in message || 'error' in message);
+}
+/** Auth has already run. Unknown and malformed responses are deliberately indistinguishable.
+ * No decision can enter this path via a tools/call, model text, or nested tool arguments.
+ */
+export async function recordElicitationResponse(body, identity) {
+    const message = object(body);
+    if (!isElicitationResponse(message) || message?.jsonrpc !== '2.0' ||
+        (typeof message.id !== 'string' && typeof message.id !== 'number') ||
+        ('error' in message) || !identity.oauthTokenId || !identity.actorId)
+        return;
+    const result = object(message.result), content = object(result?.content);
+    if (result?.action !== 'accept' || (content?.decision !== 'approve' && content?.decision !== 'reject'))
+        return;
+    try {
+        const client = email(), now = new Date().toISOString();
+        const { data: prompt, error } = await client.from(TABLE).select('*')
+            .eq('oauth_token_id', identity.oauthTokenId).eq('jsonrpc_request_id', String(message.id))
+            .eq('status', 'pending').gt('expires_at', now).maybeSingle();
+        if (error || !prompt || prompt.oauth_token_id !== identity.oauthTokenId || prompt.user_id !== identity.actorId ||
+            prompt.jsonrpc_request_id !== String(message.id) || prompt.status !== 'pending' ||
+            !(Date.parse(prompt.expires_at) > Date.now()) || prompt.channel !== 'mcp_elicitation')
+            return;
+        const { data: approval, error: approvalError } = await client.from('action_approvals')
+            .select('id, project_id, oauth_token_id, action, tier, status, used_at, expires_at')
+            .eq('id', prompt.approval_id).eq('project_id', prompt.project_id)
+            .eq('oauth_token_id', identity.oauthTokenId).eq('status', 'pending').is('used_at', null)
+            .gt('expires_at', now).maybeSingle();
+        if (approvalError || !approval || approval.id !== prompt.approval_id || approval.project_id !== prompt.project_id ||
+            approval.oauth_token_id !== prompt.oauth_token_id || approval.status !== 'pending' || approval.used_at != null ||
+            approval.tier !== 'gated' || typeof approval.action !== 'string' || !approval.action ||
+            !(Date.parse(approval.expires_at) > Date.now()))
+            return;
+        // All-project grants' answer POSTs have no project argument. The authenticated token/user
+        // must match the stored prompt; authorize against THAT approval's project, never a body field.
+        if (!await humanApprovalEligible(approval.action, prompt.project_id, { ...identity, projectId: prompt.project_id }))
+            return;
+        const { data, error: rpcError } = await client.rpc('record_elicitation_decision', {
+            p_prompt_id: prompt.id, p_oauth_token_id: identity.oauthTokenId, p_user_id: identity.actorId,
+            p_decision: content.decision, p_project_id: prompt.project_id, p_action: approval.action,
+        });
+        if (rpcError || data !== true)
+            return;
+    }
+    catch {
+        // Never reveal whether a prompt exists, and never fall back to non-atomic REST writes.
+    }
+}
+/** Insert before sending, using the exact wire id (a UUID, since each stateless SDK starts
+ * its request counter at zero). Poll the persisted prompt; never await a response on the old
+ * SDK Server, because the client's answer necessarily arrives at a fresh Server via POST.
+ */
+export async function relayElicitation(options) {
+    const pending = 'decision_pending';
+    const { identity, signal } = options;
+    if (signal.aborted || !identity.projectId || !identity.oauthTokenId || !identity.actorId ||
+        !await humanApprovalEligible(options.action, identity.projectId, identity))
+        return pending;
+    const client = email(), now = Date.now(), requestId = randomUUID();
+    const promptId = randomUUID();
+    try {
+        const { error: expireError } = await client.from(TABLE).update({ status: 'expired' })
+            .eq('oauth_token_id', identity.oauthTokenId).eq('status', 'pending').lt('expires_at', new Date(now).toISOString());
+        if (expireError)
+            return pending;
+        // Bounded per-token purge; an old backlog is drained in chunks, never one unbounded delete.
+        const { data: old, error: oldError } = await client.from(TABLE).select('id')
+            .eq('oauth_token_id', identity.oauthTokenId).lt('created_at', new Date(now - 3_600_000).toISOString()).limit(100);
+        if (oldError)
+            return pending;
+        if (old?.length) {
+            const { error: deleteError } = await client.from(TABLE).delete().eq('oauth_token_id', identity.oauthTokenId)
+                .in('id', old.map((row) => row.id));
+            if (deleteError)
+                return pending;
+        }
+        const { data: approval, error: approvalError } = await client.from('action_approvals')
+            .select('id, expires_at').eq('id', options.approvalId).eq('project_id', identity.projectId)
+            .eq('oauth_token_id', identity.oauthTokenId).eq('action', options.action)
+            .eq('tier', 'gated').eq('status', 'pending').is('used_at', null).gt('expires_at', new Date(now).toISOString()).maybeSingle();
+        if (approvalError || !approval || !(Date.parse(approval.expires_at) > Date.now()) || signal.aborted)
+            return pending;
+        const { error } = await client.from(TABLE).insert({ id: promptId, approval_id: options.approvalId,
+            project_id: identity.projectId, oauth_token_id: identity.oauthTokenId, user_id: identity.actorId,
+            jsonrpc_request_id: requestId, channel: 'mcp_elicitation', status: 'pending',
+            created_at: new Date(now).toISOString(), expires_at: new Date(Math.min(now + 120_000, Date.parse(approval.expires_at))).toISOString() });
+        if (error || signal.aborted)
+            return pending;
+        // The id is created here and passed unchanged both to the row and the actual transport.
+        await options.send({ jsonrpc: '2.0', id: requestId, method: 'elicitation/create', params: options.params });
+        while (!signal.aborted && Date.now() < now + 60_000) {
+            const { data: prompt, error: readError } = await client.from(TABLE).select('status, answer, expires_at')
+                .eq('id', promptId).eq('oauth_token_id', identity.oauthTokenId).eq('user_id', identity.actorId).maybeSingle();
+            if (signal.aborted || readError || !prompt || !(Date.parse(prompt.expires_at) > Date.now()))
+                return pending;
+            if (prompt.status === 'answered')
+                return prompt.answer === 'approve' ? 'approved' : prompt.answer === 'reject' ? 'rejected' : pending;
+            if (prompt.status !== 'pending')
+                return pending;
+            await new Promise(resolve => {
+                const timer = setTimeout(done, 750);
+                function done() { clearTimeout(timer); signal.removeEventListener('abort', done); resolve(); }
+                signal.addEventListener('abort', done, { once: true });
+                if (signal.aborted)
+                    done();
+            });
+        }
+    }
+    catch {
+        // Refused inserts/updates, missing migrations and disconnected streams keep approve_url.
+    }
+    return pending;
+}

package/build/lib/approval-elicitation.d.ts

@@ -1,3 +1,5 @@
+import { type HumanDecisionIdentity } from './approval-human-eligibility.js';
+import type { ElicitRequest } from '@modelcontextprotocol/sdk/types.js';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { RequestId } from '@modelcontextprotocol/sdk/types.js';
 type Decision = 'approve' | 'reject';
@@ -10,9 +12,17 @@ type HumanCallback = {
     }): Promise<boolean>;
 };
 /** Injected at authenticated transport startup, never taken from tool arguments. */
-type TransportBinding = {
+export type TransportBinding = {
     projectId: string;
     userId?: string | null;
+    oauthTokenId?: string | null;
+    identity?: HumanDecisionIdentity;
+    relay?(options: {
+        approvalId: string;
+        action: string;
+        params: ElicitRequest['params'];
+        signal: AbortSignal;
+    }): Promise<ElicitationDecision>;
     createHumanDecision(binding: {
         approvalId: string;
         projectId: string;
@@ -25,9 +35,9 @@ type RequestExtra = {
     requestId?: RequestId;
     signal?: AbortSignal;
 };
-export declare function installApprovalElicitation(server: McpServer, binding: TransportBinding): void;
+export declare function installApprovalElicitation(server: Pick<McpServer, 'server'>, binding: TransportBinding): void;
 /** Called by the registry wrapper with SDK-owned extra, outside parsed model arguments. */
-export declare function runWithApprovalElicitation<T>(server: McpServer, extra: RequestExtra | undefined, run: () => T): T;
+export declare function runWithApprovalElicitation<T>(server: Pick<McpServer, 'server'>, extra: RequestExtra | undefined, run: () => T): T;
 type ApprovalFallback = {
     approval_id: string;
     approve_url: string;

package/build/lib/approval-elicitation.js

@@ -1,4 +1,5 @@
 import { isHumanRequestableAdminTool } from './admin-tools.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { randomUUID } from 'node:crypto';
 import { buildApprovalPreview, isHumanApprovalChannel } from '@sendinel/domain';
@@ -24,8 +25,6 @@ export function runWithApprovalElicitation(server, extra, run) {
 /** All outcomes retain the ordinary approval link/text. Approval never applies the action. */
 export async function elicitApproval(result, frozen, projectId) {
     const pending = { ...result, decision_status: 'decision_pending' };
-    if (isHumanRequestableAdminTool(frozen.action))
-        return pending;
     const context = requests.getStore();
     if (!context || context.projectId !== projectId || result.tier !== 'gated')
         return pending;
@@ -36,7 +35,11 @@ export async function elicitApproval(result, frozen, projectId) {
         channel = 'mcp_elicitation_url';
     if (channel !== 'mcp_elicitation_form' && channel !== 'mcp_elicitation_url')
         return pending;
-    if (channel === 'mcp_elicitation_form' && !context.userId)
+    if (channel === 'mcp_elicitation_form' && (!context.userId ||
+        !await humanApprovalEligible(frozen.action, projectId, context.identity)))
+        return pending;
+    if (channel === 'mcp_elicitation_url' && isHumanRequestableAdminTool(frozen.action) &&
+        !await humanApprovalEligible(frozen.action, projectId, context.identity))
         return pending;
     if (context.signal?.aborted)
         return pending;
@@ -61,14 +64,18 @@ export async function elicitApproval(result, frozen, projectId) {
             `Recipients: ${preview.recipient_count ?? 'unknown'}`, `Footer: ${short(preview.footer_text || 'unknown', 500)}`,
             `Body excerpt:\n${short(preview.body_text, 1500)}`, `Full preview: ${result.approve_url}`].join('\n');
         if (channel === 'mcp_elicitation_form') {
+            const params = { mode: 'form', message, requestedSchema: { type: 'object', properties: {
+                        decision: { type: 'string', enum: ['approve', 'reject'], title: 'Decision' },
+                        note: { type: 'string', title: 'Optional note', maxLength: 500 },
+                    }, required: ['decision'] } };
+            if (context.relay) {
+                const status = await Promise.race([context.relay({ approvalId: result.approval_id,
+                        action: frozen.action, params, signal: controller.signal }), stopped]);
+                return controller.signal.aborted ? pending : { ...result, decision_status: status };
+            }
             const callback = context.createHumanDecision({ approvalId: result.approval_id, projectId,
                 connectionId: context.connectionId, userId: context.userId, channel: 'mcp_elicitation' });
-            const response = await Promise.race([context.server.server.elicitInput({ mode: 'form', message,
-                    requestedSchema: { type: 'object', properties: {
-                            decision: { type: 'string', enum: ['approve', 'reject'], title: 'Decision' },
-                            note: { type: 'string', title: 'Optional note', maxLength: 500 },
-                        }, required: ['decision'] },
-                }, options), stopped]);
+            const response = await Promise.race([context.server.server.elicitInput(params, options), stopped]);
             if (controller.signal.aborted)
                 return pending;
             // Decline/cancel are not explicit rejections. The dashboard link remains usable.

package/build/lib/approval-human-callback.js

@@ -1,4 +1,5 @@
-import { isHumanRequestableAdminTool } from './admin-tools.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+import { requestContext } from '../db.js';
 import { randomUUID } from 'node:crypto';
 import { approvalStore } from './tester-requests-store.js';
 /**
@@ -19,10 +20,11 @@ export function createHumanApprovalCallback(binding) {
             completed = true;
             const source = approvalStore();
             const client = typeof source.schema === 'function' ? source.schema('email') : source;
-            // #4308 / #4214: admin requests can only be decided in a human dashboard session.
             const { data: approval, error: loadError } = await client.from('action_approvals')
                 .select('action').eq('id', binding.approvalId).eq('project_id', binding.projectId).maybeSingle();
-            if (loadError || typeof approval?.action !== 'string' || !approval.action || isHumanRequestableAdminTool(approval.action))
+            if (loadError || typeof approval?.action !== 'string' || !approval.action ||
+                requestContext()?.actorId !== binding.userId ||
+                !await humanApprovalEligible(approval.action, binding.projectId))
                 return false;
             const now = new Date().toISOString();
             const { data, error } = await client.from('action_approvals')

package/build/lib/approval-human-eligibility.d.ts

@@ -0,0 +1,13 @@
+export type HumanDecisionIdentity = {
+    projectId?: string;
+    actorId?: string | null;
+    oauthTokenId?: string | null;
+    authKind?: string | null;
+    channelVerified?: boolean;
+    scopes?: readonly string[];
+};
+/** Shared transport boundary, never populated from tool arguments. Re-read the grant and
+ * (for admin requests) the project's org membership on every prompt and every decision.
+ * Missing connection_role is NOT a human grant: it must be exactly SQL NULL.
+ */
+export declare function humanApprovalEligible(action: string, projectId: string, identity?: HumanDecisionIdentity | undefined): Promise<boolean>;

package/build/lib/approval-human-eligibility.js

@@ -0,0 +1,39 @@
+import { requestContext } from '../db.js';
+import { approvalStore } from './tester-requests-store.js';
+import { isHumanRequestableAdminTool } from './admin-tools.js';
+/** Shared transport boundary, never populated from tool arguments. Re-read the grant and
+ * (for admin requests) the project's org membership on every prompt and every decision.
+ * Missing connection_role is NOT a human grant: it must be exactly SQL NULL.
+ */
+export async function humanApprovalEligible(action, projectId, identity = requestContext()) {
+    if (!identity || identity.channelVerified !== true || identity.authKind !== 'oauth' ||
+        !identity.actorId || !identity.oauthTokenId || identity.projectId !== projectId || !projectId ||
+        identity.scopes?.some(scope => scope === 'tester' || scope === 'agent'))
+        return false;
+    try {
+        const source = approvalStore();
+        const client = typeof source.schema === 'function' ? source.schema('email') : source;
+        const { data: grant, error } = await client.from('mcp_oauth_tokens')
+            .select('id, user_id, connection_role, scopes, revoked_at, expires_at')
+            .eq('id', identity.oauthTokenId).maybeSingle();
+        if (error || !grant || grant.id !== identity.oauthTokenId || grant.user_id !== identity.actorId ||
+            grant.connection_role !== null || grant.revoked_at !== null ||
+            !(Date.parse(grant.expires_at) > Date.now()) || !Array.isArray(grant.scopes) ||
+            grant.scopes.some((scope) => scope === 'tester' || scope === 'agent'))
+            return false;
+        if (!isHumanRequestableAdminTool(action))
+            return true;
+        // Same lookup as dashboard getProjectOrgRole: projects.org_id -> org_members.role.
+        // Unlike permissive mocks, PostgREST errors (including {data, error}) grant nothing.
+        const { data: project, error: projectError } = await client.from('projects')
+            .select('org_id').eq('id', projectId).maybeSingle();
+        if (projectError || !project?.org_id)
+            return false;
+        const { data: member, error: roleError } = await client.from('org_members')
+            .select('role').eq('org_id', project.org_id).eq('user_id', identity.actorId).maybeSingle();
+        return !roleError && (member?.role === 'owner' || member?.role === 'admin');
+    }
+    catch {
+        return false;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.119",
+  "version": "1.0.121",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",