@softeria/ms-365-mcp-server 0.128.1 → 0.128.2

package/dist/auth.js

@@ -31,6 +31,36 @@ function createMsalConfig(secrets) {
     }
   };
 }
+function buildDiskCoherencyCachePlugin(storage) {
+  return {
+    beforeCacheAccess: async (context) => {
+      try {
+        const cacheRaw = await storage.load("token-cache");
+        if (cacheRaw) {
+          context.tokenCache.deserialize(unwrapCache(cacheRaw).data);
+        }
+      } catch (error) {
+        logger.error(`Error reloading token cache: ${error.message}`);
+        if (storage.failClosed) {
+          throw error;
+        }
+      }
+    },
+    afterCacheAccess: async (context) => {
+      if (!context.cacheHasChanged) {
+        return;
+      }
+      try {
+        await storage.save("token-cache", wrapCache(context.tokenCache.serialize()));
+      } catch (error) {
+        logger.error(`Error saving token cache: ${error.message}`);
+        if (storage.failClosed) {
+          throw error;
+        }
+      }
+    }
+  };
+}
 const SCOPE_HIERARCHY = {
   "Mail.ReadWrite": ["Mail.Read"],
   "Calendars.ReadWrite": ["Calendars.Read"],
@@ -312,8 +342,15 @@ function consumersAuthorityHint(error, account, authority) {
 class AuthManager {
   constructor(config, scopes = [], expectedAccount, storage) {
     logger.info(`And scopes are ${scopes.join(", ")}`, scopes);
-    this.config = config;
     this.scopes = scopes;
+    this.storage = storage ?? new DefaultTokenCacheStorage();
+    this.config = {
+      ...config,
+      cache: {
+        ...config.cache,
+        cachePlugin: buildDiskCoherencyCachePlugin(this.storage)
+      }
+    };
     this.msalApp = new PublicClientApplication(this.config);
     this.accessToken = null;
     this.tokenExpiry = null;
@@ -323,7 +360,6 @@ class AuthManager {
     this.expectedHomeAccountId = this.normalizeExpectedHomeAccountId(
       expectedAccount?.expectedHomeAccountId
     );
-    this.storage = storage ?? new DefaultTokenCacheStorage();
     const oauthTokenFromEnv = process.env.MS365_MCP_OAUTH_TOKEN;
     this.oauthToken = oauthTokenFromEnv ?? null;
     this.isOAuthMode = oauthTokenFromEnv != null;
@@ -367,17 +403,6 @@ class AuthManager {
       }
     }
   }
-  async saveTokenCache() {
-    try {
-      const stamped = wrapCache(this.msalApp.getTokenCache().serialize());
-      await this.storage.save("token-cache", stamped);
-    } catch (error) {
-      logger.error(`Error saving token cache: ${error.message}`);
-      if (this.storage.failClosed) {
-        throw error;
-      }
-    }
-  }
   async saveSelectedAccount() {
     try {
       const stamped = wrapCache(JSON.stringify({ accountId: this.selectedAccountId }));
@@ -491,7 +516,10 @@ class AuthManager {
       try {
         await this.msalApp.getTokenCache().removeAccount(account);
       } catch (error) {
-        logger.warn(`Failed to remove unexpected account from cache: ${error.message}`);
+        logger.error(`Failed to remove unexpected account from cache: ${error.message}`);
+        throw new Error(
+          `Authenticated Microsoft account '${this.describeAccount(account)}' does not match expected Microsoft account '${this.expectedAccountLabel()}', and it could not be removed from the token cache (${error.message}). Its tokens may remain persisted - run --logout to clear the cache, then re-login.`
+        );
       }
       throw new Error(
         `Authenticated Microsoft account '${this.describeAccount(account)}' does not match expected Microsoft account '${this.expectedAccountLabel()}'. Login was not persisted.`
@@ -522,7 +550,6 @@ class AuthManager {
         const response = await this.msalApp.acquireTokenSilent(silentRequest);
         this.accessToken = response.accessToken;
         this.tokenExpiry = response.expiresOn ? new Date(response.expiresOn).getTime() : null;
-        await this.saveTokenCache();
         return this.accessToken;
       } catch (error) {
         const hint = consumersAuthorityHint(error, currentAccount, this.config.auth.authority);
@@ -584,7 +611,6 @@ class AuthManager {
         await this.saveSelectedAccount();
         logger.info(`Auto-selected new account: ${response.account.username}`);
       }
-      await this.saveTokenCache();
       return this.accessToken;
     } catch (error) {
       logger.error(`Error in device code flow: ${error.message}`);
@@ -626,7 +652,6 @@ class AuthManager {
         await this.saveSelectedAccount();
         logger.info(`Auto-selected new account: ${response.account.username}`);
       }
-      await this.saveTokenCache();
       return this.accessToken;
     } catch (error) {
       logger.error(`Error in interactive browser flow: ${error.message}`);
@@ -842,7 +867,6 @@ class AuthManager {
     };
     try {
       const response = await this.msalApp.acquireTokenSilent(silentRequest);
-      await this.saveTokenCache();
       return response.accessToken;
     } catch (error) {
       const hint = consumersAuthorityHint(error, targetAccount, this.config.auth.authority);
@@ -858,6 +882,7 @@ class AuthManager {
 var auth_default = AuthManager;
 export {
   buildAllowedScopeDiagnostics,
+  buildDiskCoherencyCachePlugin,
   buildScopeDiagnostics,
   buildScopesFromEndpoints,
   collapseScopeHierarchy,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.128.1",
+  "version": "0.128.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",