@snokam/mcp-api 0.110.1 → 0.111.0

package/dist/auth.d.ts

@@ -1,16 +1,15 @@
 /**
  * Token acquisition for Snokam backend APIs.
  *
- * Supports three modes (auto-detected):
+ * Modes (auto-detected, in order):
  *
- * 1. **OBO (On-Behalf-Of):** When SNOKAM_USER_JWT is set, exchanges the user
- *    JWT for a service-specific token via Azure AD OBO flow.
- *    Requires AZURE_AD_CLIENT_ID, AZURE_AD_TENANT_ID, and either
- *    AZURE_AD_SECRET (client secret) or managed identity.
+ * 1. **SNOKAM_ACCESS_TOKEN_FILE:** path to a bearer the host refreshes (every
+ *    ~30 min via the VM managed identity). Read fresh per call so a rotated
+ *    token is picked up without restarting. Preferred for egress-isolated
+ *    containers that can't reach IMDS.
+ * 2. **SNOKAM_ACCESS_TOKEN:** a pre-minted bearer injected directly.
+ * 3. **DefaultAzureCredential:** Azure CLI (local dev) or managed identity (Azure).
  *
- * 2. **DefaultAzureCredential:** When no user JWT is present, falls back to
- *    Azure CLI (local dev), managed identity (Azure), etc.
- *
- * 3. **No auth:** Endpoints without a scope get no Authorization header.
+ * Endpoints without a scope get no Authorization header.
  */
 export declare function getAccessToken(scope: string | null): Promise<string | null>;

package/dist/auth.js

@@ -1,68 +1,40 @@
 /**
  * Token acquisition for Snokam backend APIs.
  *
- * Supports three modes (auto-detected):
+ * Modes (auto-detected, in order):
  *
- * 1. **OBO (On-Behalf-Of):** When SNOKAM_USER_JWT is set, exchanges the user
- *    JWT for a service-specific token via Azure AD OBO flow.
- *    Requires AZURE_AD_CLIENT_ID, AZURE_AD_TENANT_ID, and either
- *    AZURE_AD_SECRET (client secret) or managed identity.
+ * 1. **SNOKAM_ACCESS_TOKEN_FILE:** path to a bearer the host refreshes (every
+ *    ~30 min via the VM managed identity). Read fresh per call so a rotated
+ *    token is picked up without restarting. Preferred for egress-isolated
+ *    containers that can't reach IMDS.
+ * 2. **SNOKAM_ACCESS_TOKEN:** a pre-minted bearer injected directly.
+ * 3. **DefaultAzureCredential:** Azure CLI (local dev) or managed identity (Azure).
  *
- * 2. **DefaultAzureCredential:** When no user JWT is present, falls back to
- *    Azure CLI (local dev), managed identity (Azure), etc.
- *
- * 3. **No auth:** Endpoints without a scope get no Authorization header.
+ * Endpoints without a scope get no Authorization header.
  */
-import { DefaultAzureCredential, OnBehalfOfCredential, } from "@azure/identity";
-// Cache credentials per scope to avoid re-creating them
-const credentialCache = new Map();
-function getOboCredential(userJwt, clientId, tenantId) {
-    const clientSecret = process.env.AZURE_AD_SECRET;
-    if (clientSecret) {
-        return new OnBehalfOfCredential({
-            tenantId,
-            clientId,
-            clientSecret,
-            userAssertionToken: userJwt,
-        });
-    }
-    // Managed identity as client assertion (federated identity)
-    const mi = new DefaultAzureCredential();
-    return new OnBehalfOfCredential({
-        tenantId,
-        clientId,
-        userAssertionToken: userJwt,
-        getAssertion: async () => {
-            const token = await mi.getToken("api://AzureADTokenExchange");
-            return token.token;
-        },
-    });
-}
+import { readFileSync } from "fs";
+import { DefaultAzureCredential } from "@azure/identity";
+let defaultCredential = null;
 export async function getAccessToken(scope) {
     if (!scope)
         return null;
-    const userJwt = process.env.SNOKAM_USER_JWT;
-    const clientId = process.env.AZURE_AD_CLIENT_ID ?? "";
-    const tenantId = process.env.AZURE_AD_TENANT_ID ?? "";
-    let credential;
-    if (userJwt && clientId && tenantId) {
-        // OBO mode
-        const cacheKey = `obo:${scope}`;
-        if (!credentialCache.has(cacheKey)) {
-            credentialCache.set(cacheKey, getOboCredential(userJwt, clientId, tenantId));
+    const tokenFile = process.env.SNOKAM_ACCESS_TOKEN_FILE;
+    if (tokenFile) {
+        try {
+            const fromFile = readFileSync(tokenFile, "utf8").trim();
+            if (fromFile)
+                return fromFile;
         }
-        credential = credentialCache.get(cacheKey);
-    }
-    else {
-        // Default credential (Azure CLI locally, managed identity in Azure)
-        const cacheKey = "default";
-        if (!credentialCache.has(cacheKey)) {
-            credentialCache.set(cacheKey, new DefaultAzureCredential());
+        catch {
+            // fall through to the other modes
         }
-        credential = credentialCache.get(cacheKey);
     }
+    const preMinted = process.env.SNOKAM_ACCESS_TOKEN;
+    if (preMinted)
+        return preMinted;
     try {
-        const token = await credential.getToken(scope);
+        defaultCredential ??= new DefaultAzureCredential();
+        const token = await defaultCredential.getToken(scope);
         return token?.token ?? null;
     }
     catch (error) {

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  * Snokam MCP Server
  *
  * Exposes Snokam backend APIs as MCP tools by reading bundled OpenAPI specs.
- * Auth is handled via @azure/identity — supports Azure CLI (local),
- * managed identity (Azure), and OBO (when SNOKAM_USER_JWT is set).
+ * Auth: a pre-minted SNOKAM_ACCESS_TOKEN when present, else @azure/identity
+ * (Azure CLI locally, managed identity in Azure).
  */
 export {};

package/dist/index.js

@@ -3,8 +3,8 @@
  * Snokam MCP Server
  *
  * Exposes Snokam backend APIs as MCP tools by reading bundled OpenAPI specs.
- * Auth is handled via @azure/identity — supports Azure CLI (local),
- * managed identity (Azure), and OBO (when SNOKAM_USER_JWT is set).
+ * Auth: a pre-minted SNOKAM_ACCESS_TOKEN when present, else @azure/identity
+ * (Azure CLI locally, managed identity in Azure).
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snokam/mcp-api",
-  "version": "0.110.1",
+  "version": "0.111.0",
   "description": "MCP server exposing Snokam backend APIs as tools for Claude Code and other MCP clients",
   "type": "module",
   "bin": {