@sodiumhq/mcp-pm 0.1.0-beta.4424 → 0.1.0-beta.4445

package/README.md

@@ -62,6 +62,8 @@ Only enable write mode with an AI client you trust — it hands the client the a
 - **`get_practice_dashboard`** — one-call "state of the practice right now": overdue/blocked/due-soon work, what clients are sitting on, unassigned steps, unbilled time, open proposal pipeline. *"Give me my morning briefing."*
 - **`get_practice_details`** — consolidated practice overview (counts, connections, settings)
 - **`whoami`** — show the authenticated user (name, email, code), tenant (name, code, status), and practice name. Useful for verifying which account is connected.
+- **`list_practices`** — list the practices you belong to, marking the active one. *"Which practices can I access?"*
+- **`set_active_practice`** — choose which practice to work in, or switch mid-session. *"Switch to Oceans."* Needed when you belong to more than one practice.
 
 **Clients**
 - **`list_clients`** — list and filter clients by search, status, type, assignee, services, saved filters

package/dist/http.js

@@ -0,0 +1,291 @@
+#!/usr/bin/env node
+import { t as buildServer } from "./src-BRf2g74U.mjs";
+import { createRequire } from "node:module";
+import { createHash, randomUUID } from "node:crypto";
+import { createServer } from "node:http";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+//#region src/obo.ts
+const EXPIRY_MARGIN_MS = 6e4;
+const cache = /* @__PURE__ */ new Map();
+function loadOboConfig(issuer) {
+	const clientId = process.env.AUTH0_OBO_CLIENT_ID;
+	const clientSecret = process.env.AUTH0_OBO_CLIENT_SECRET;
+	if (!clientId || !clientSecret) return null;
+	return {
+		tokenEndpoint: `${issuer}oauth/token`,
+		clientId,
+		clientSecret,
+		targetAudience: process.env.SODIUM_API_AUDIENCE ?? "https://api.sodiumhq.com"
+	};
+}
+function cacheKey(subjectToken, audience) {
+	return createHash("sha256").update(`${audience}:${subjectToken}`).digest("hex");
+}
+async function getDownstreamToken(config, subjectToken) {
+	const key = cacheKey(subjectToken, config.targetAudience);
+	const cached = cache.get(key);
+	if (cached && cached.expiresAt > Date.now()) return cached.accessToken;
+	const body = new URLSearchParams({
+		grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+		subject_token: subjectToken,
+		subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
+		requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
+		audience: config.targetAudience,
+		client_id: config.clientId,
+		client_secret: config.clientSecret
+	});
+	const response = await fetch(config.tokenEndpoint, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (!response.ok) {
+		const detail = await response.text();
+		throw new Error(`On-behalf-of token exchange failed (HTTP ${response.status}): ${detail.slice(0, 300)}`);
+	}
+	const payload = await response.json();
+	if (!payload.access_token) throw new Error("On-behalf-of token exchange returned no access_token.");
+	cache.set(key, {
+		accessToken: payload.access_token,
+		expiresAt: resolveExpiry(payload.access_token, payload.expires_in)
+	});
+	return payload.access_token;
+}
+function resolveExpiry(accessToken, expiresIn) {
+	try {
+		const exp = decodeJwt(accessToken).exp;
+		if (exp) return exp * 1e3 - EXPIRY_MARGIN_MS;
+	} catch {}
+	const seconds = expiresIn ?? 300;
+	return Date.now() + seconds * 1e3 - EXPIRY_MARGIN_MS;
+}
+//#endregion
+//#region src/auth.ts
+var AuthError = class extends Error {
+	constructor(status, code, message) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+};
+function loadAuthConfig() {
+	const resourceUrl = process.env.MCP_RESOURCE_URL;
+	const issuer = process.env.AUTH0_ISSUER;
+	if (!resourceUrl || !issuer) return null;
+	return {
+		resourceUrl: resourceUrl.replace(/\/+$/, ""),
+		issuer: issuer.endsWith("/") ? issuer : `${issuer}/`,
+		scopes: {
+			read: process.env.MCP_SCOPE_READ ?? "mcp:read",
+			write: process.env.MCP_SCOPE_WRITE ?? "mcp:write"
+		}
+	};
+}
+function protectedResourceMetadata(config) {
+	return {
+		resource: config.resourceUrl,
+		authorization_servers: [config.issuer],
+		scopes_supported: [config.scopes.read, config.scopes.write],
+		bearer_methods_supported: ["header"]
+	};
+}
+function metadataUrl(config) {
+	const url = new URL(config.resourceUrl);
+	const suffix = url.pathname === "/" ? "" : url.pathname;
+	return `${url.origin}/.well-known/oauth-protected-resource${suffix}`;
+}
+function buildChallenge(config, scope) {
+	const parts = [`Bearer resource_metadata="${metadataUrl(config)}"`];
+	if (scope) parts.push(`scope="${scope}"`);
+	return parts.join(", ");
+}
+const jwksCache = /* @__PURE__ */ new Map();
+function getJwks(issuer) {
+	let jwks = jwksCache.get(issuer);
+	if (!jwks) {
+		jwks = createRemoteJWKSet(new URL(`${issuer}.well-known/jwks.json`));
+		jwksCache.set(issuer, jwks);
+	}
+	return jwks;
+}
+async function verifyAccessToken(config, token) {
+	let payload;
+	try {
+		payload = (await jwtVerify(token, getJwks(config.issuer), {
+			issuer: config.issuer,
+			audience: config.resourceUrl
+		})).payload;
+	} catch (error) {
+		throw new AuthError(401, "invalid_token", `Access token is not valid: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!payload.sub) throw new AuthError(401, "invalid_token", "Access token has no subject claim.");
+	const scopes = (typeof payload.scope === "string" ? payload.scope : "").split(" ").filter(Boolean);
+	if (!scopes.includes(config.scopes.read)) throw new AuthError(403, "insufficient_scope", `Access token is missing the ${config.scopes.read} scope.`);
+	return {
+		token,
+		subject: payload.sub,
+		scopes
+	};
+}
+//#endregion
+//#region src/http.ts
+const VERSION = createRequire(import.meta.url)("../package.json").version;
+const BASE_URL = process.env.SODIUM_API_URL ?? "https://api.sodiumhq.com";
+const PORT = Number(process.env.PORT ?? 3960);
+const HOST = process.env.HOST ?? "127.0.0.1";
+const writesRaw = (process.env.SODIUM_ENABLE_WRITES ?? "").trim().toLowerCase();
+const WRITES_ENABLED = writesRaw === "true" || writesRaw === "1";
+const AUTH = loadAuthConfig();
+const OBO = AUTH ? loadOboConfig(AUTH.issuer) : null;
+const ENDPOINT_PATH = AUTH ? new URL(AUTH.resourceUrl).pathname : process.env.MCP_ENDPOINT_PATH ?? "/mcp";
+const sessions = /* @__PURE__ */ new Map();
+const SESSION_IDLE_MS = Number(process.env.MCP_SESSION_IDLE_MS ?? 30 * 6e4);
+const SWEEP_INTERVAL_MS = 6e4;
+function touch(sessionId) {
+	const session = sessions.get(sessionId);
+	if (session) session.lastActivity = Date.now();
+}
+async function sweepIdleSessions() {
+	const cutoff = Date.now() - SESSION_IDLE_MS;
+	for (const [sessionId, session] of sessions) {
+		if (session.lastActivity > cutoff) continue;
+		sessions.delete(sessionId);
+		console.error(`[sodium-pm-mcp-http] session ${sessionId} swept (idle)`);
+		try {
+			await session.transport.close();
+		} catch (error) {
+			console.error(`[sodium-pm-mcp-http] error closing swept session: ${String(error)}`);
+		}
+	}
+}
+const MAX_BODY_BYTES = 4 * 1024 * 1024;
+async function readJsonBody(req) {
+	const chunks = [];
+	let total = 0;
+	for await (const chunk of req) {
+		total += chunk.length;
+		if (total > MAX_BODY_BYTES) throw new Error("Request body too large");
+		chunks.push(chunk);
+	}
+	const raw = Buffer.concat(chunks).toString("utf8");
+	return raw.length > 0 ? JSON.parse(raw) : void 0;
+}
+function sendJsonError(res, status, message) {
+	res.writeHead(status, { "Content-Type": "application/json" }).end(JSON.stringify({
+		jsonrpc: "2.0",
+		error: {
+			code: -32e3,
+			message
+		},
+		id: null
+	}));
+}
+async function createSession(req) {
+	const authHeader = req.headers.authorization;
+	if (!authHeader?.startsWith("Bearer ")) throw new HttpError(401, "Authorization: Bearer <token> header is required.");
+	const bearerToken = authHeader.slice(7).trim();
+	let writesAllowed = WRITES_ENABLED;
+	let apiToken = bearerToken;
+	if (AUTH) {
+		const verified = await verifyAccessToken(AUTH, bearerToken);
+		writesAllowed = WRITES_ENABLED && verified.scopes.includes(AUTH.scopes.write);
+		if (OBO) apiToken = await getDownstreamToken(OBO, bearerToken);
+	}
+	const tenantHeader = req.headers["x-sodium-tenant"];
+	const tenant = (Array.isArray(tenantHeader) ? tenantHeader[0] : tenantHeader) ?? process.env.SODIUM_TENANT;
+	const server = await buildServer({
+		context: {
+			bearerToken: apiToken,
+			tenant,
+			baseUrl: BASE_URL,
+			writesEnabled: writesAllowed
+		},
+		serverName: "Sodium Practice Management",
+		serverVersion: VERSION
+	});
+	const transport = new StreamableHTTPServerTransport({
+		sessionIdGenerator: () => randomUUID(),
+		onsessioninitialized: (sessionId) => {
+			sessions.set(sessionId, {
+				transport,
+				lastActivity: Date.now()
+			});
+			console.error(`[sodium-pm-mcp-http] session ${sessionId} started (tenant: ${tenant}, live: ${sessions.size})`);
+		}
+	});
+	transport.onclose = () => {
+		if (transport.sessionId) {
+			sessions.delete(transport.sessionId);
+			console.error(`[sodium-pm-mcp-http] session ${transport.sessionId} closed`);
+		}
+	};
+	await server.connect(transport);
+	return transport;
+}
+var HttpError = class extends Error {
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+async function handle(req, res) {
+	const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+	if (req.method === "GET" && url.pathname === "/health") {
+		res.writeHead(200, { "Content-Type": "application/json" }).end(JSON.stringify({
+			status: "ok",
+			version: VERSION,
+			sessions: sessions.size
+		}));
+		return;
+	}
+	if (AUTH && req.method === "GET" && url.pathname.startsWith("/.well-known/oauth-protected-resource")) {
+		res.writeHead(200, { "Content-Type": "application/json" }).end(JSON.stringify(protectedResourceMetadata(AUTH)));
+		return;
+	}
+	if (url.pathname !== ENDPOINT_PATH) {
+		sendJsonError(res, 404, `Not found. MCP endpoint is ${ENDPOINT_PATH}.`);
+		return;
+	}
+	const sessionId = req.headers["mcp-session-id"];
+	const existing = typeof sessionId === "string" ? sessions.get(sessionId) : void 0;
+	if (existing && typeof sessionId === "string") {
+		touch(sessionId);
+		await existing.transport.handleRequest(req, res);
+		return;
+	}
+	if (req.method !== "POST") {
+		sendJsonError(res, 400, "No valid MCP session. Send an initialize request first.");
+		return;
+	}
+	const body = await readJsonBody(req);
+	if (!isInitializeRequest(body)) {
+		sendJsonError(res, 400, "No valid MCP session. Send an initialize request first.");
+		return;
+	}
+	await (await createSession(req)).handleRequest(req, res, body);
+}
+const httpServer = createServer((req, res) => {
+	handle(req, res).catch((error) => {
+		const message = error instanceof Error ? error.message : String(error);
+		console.error(`[sodium-pm-mcp-http] ${req.method} ${req.url} failed: ${message}`);
+		if (res.headersSent) return;
+		if (AUTH && error instanceof AuthError) {
+			const scope = error.code === "insufficient_scope" ? AUTH.scopes.write : void 0;
+			res.setHeader("WWW-Authenticate", buildChallenge(AUTH, scope));
+			sendJsonError(res, error.status, message);
+			return;
+		}
+		if (AUTH && error instanceof HttpError && error.status === 401) res.setHeader("WWW-Authenticate", buildChallenge(AUTH));
+		sendJsonError(res, error instanceof HttpError ? error.status : 500, message);
+	});
+});
+setInterval(() => {
+	sweepIdleSessions();
+}, SWEEP_INTERVAL_MS).unref();
+httpServer.listen(PORT, HOST, () => {
+	console.error(`[sodium-pm-mcp-http] v${VERSION} listening on http://${HOST}:${PORT}${ENDPOINT_PATH} (api: ${BASE_URL}, writes: ${WRITES_ENABLED ? "enabled" : "disabled"})`);
+});
+//#endregion
+export {};