@softeria/ms-365-mcp-server 0.146.0 → 0.146.2

package/dist/__tests__/graph-tools.test.js

@@ -419,6 +419,246 @@ describe("graph-tools", () => {
       expect(payload.recipient_domains).toEqual(["example.com"]);
       expect(JSON.stringify(payload)).not.toContain("confidential.name");
     });
+    it("rejects a tail that is not a plain hostname", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        toRecipients: [
+          { emailAddress: { address: "a@example.com/path" } },
+          { emailAddress: { address: "b@evil<script" } },
+          { emailAddress: { address: "c@example.com,comment" } },
+          { emailAddress: { address: "d@[IPv6:2001:db8::1]" } },
+          { emailAddress: { address: "e@good.example" } }
+        ]
+      });
+      expect(payload.recipient_count).toBe(5);
+      expect(payload.recipient_domains).toEqual(["good.example"]);
+    });
+    it("drops a domain longer than a hostname can be", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        toRecipients: [
+          { emailAddress: { address: `a@${"x".repeat(300)}.example` } },
+          { emailAddress: { address: "b@ext.com" } }
+        ]
+      });
+      expect(payload.recipient_count).toBe(2);
+      expect(payload.recipient_domains).toEqual(["ext.com"]);
+    });
+    it("counts an entry that names someone without an address", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        recipients: [{ alias: "finance-team" }, { objectId: "abc-123" }]
+      });
+      expect(payload.recipient_count).toBe(2);
+      expect(payload).not.toHaveProperty("recipient_domains");
+    });
+    it("walks a body forwarded to Graph as a raw JSON string", async () => {
+      mockEndpoints.push(
+        makeEndpoint({
+          method: "post",
+          path: "/me/sendMail",
+          alias: "send-mail",
+          parameters: [
+            {
+              name: "body",
+              type: "Body",
+              schema: z.object({ message: z.object({}).passthrough() })
+            }
+          ]
+        })
+      );
+      mockEndpointsJson = [
+        makeConfig({ pathPattern: "/me/sendMail", method: "post", toolName: "send-mail" })
+      ];
+      const graphClient = createMockGraphClient([
+        {
+          content: [{ type: "text", text: JSON.stringify({ ok: true }) }],
+          _meta: { http_status: 202 }
+        }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(
+        server,
+        graphClient
+      );
+      await server.tools.get("send-mail").handler({
+        body: JSON.stringify({
+          message: { toRecipients: [{ emailAddress: { address: "a@ext.com" } }] }
+        })
+      });
+      const payload = auditLogMock.mock.calls[0][0];
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("leaves a base64 upload body alone instead of warning on every upload", async () => {
+      mockEndpoints.push(
+        makeEndpoint({
+          method: "put",
+          path: "/me/photo/$value",
+          alias: "upload-my-profile-photo",
+          requestFormat: "binary",
+          parameters: [{ name: "body", type: "Body", schema: z.string() }]
+        })
+      );
+      mockEndpointsJson = [
+        makeConfig({
+          pathPattern: "/me/photo/$value",
+          method: "put",
+          toolName: "upload-my-profile-photo"
+        })
+      ];
+      const graphClient = createMockGraphClient([
+        { content: [{ type: "text", text: "{}" }], _meta: { http_status: 200 } }
+      ]);
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(
+        server,
+        graphClient
+      );
+      await server.tools.get("upload-my-profile-photo").handler({
+        body: "iVBORw0KGgoAAAANSUhEUgAAAAEAAAAB"
+      });
+      const payload = auditLogMock.mock.calls[0][0];
+      expect(payload).not.toHaveProperty("recipient_count");
+      expect(loggerMock.warn).not.toHaveBeenCalledWith(
+        expect.stringContaining("Skipped recipient audit metadata")
+      );
+    });
+    it("records driveItem invite recipients, which use email rather than emailAddress", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        recipients: [{ email: "outsider@ext.com" }],
+        roles: ["read"],
+        sendInvitation: true
+      });
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("records meeting participants, which use upn", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        participants: { attendees: [{ upn: "guest@ext.com" }] }
+      });
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("survives a deeply nested array without blowing the stack", async () => {
+      draftEndpoint();
+      let nested = [{ toRecipients: [{ emailAddress: { address: "deep@ext.com" } }] }];
+      for (let i = 0; i < 500; i++) nested = [nested];
+      const payload = await runDraft({ requests: nested });
+      expect(payload).not.toHaveProperty("recipient_count");
+      expect(payload.status).toBe("success");
+    });
+    it("still audits a call whose params cannot be serialised for the log", async () => {
+      draftEndpoint();
+      const circular = { subject: "loop" };
+      circular.self = circular;
+      const payload = await runDraft(circular);
+      expect(auditLogMock).toHaveBeenCalledTimes(1);
+      expect(payload).toMatchObject({ tool: "create-draft-email", status: "error" });
+    });
+    it("still records recipients when the request throws", async () => {
+      draftEndpoint();
+      const graphClient = {
+        graphRequest: vi.fn().mockRejectedValue(new Error("socket hang up"))
+      };
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(
+        server,
+        graphClient
+      );
+      await server.tools.get("create-draft-email").handler({
+        body: { toRecipients: [{ emailAddress: { address: "a@ext.com" } }] }
+      });
+      const payload = auditLogMock.mock.calls[0][0];
+      expect(payload.status).toBe("error");
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("walks recipients nested inside a graph-batch sub-request", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        requests: [
+          { id: "1", method: "GET", url: "/me/messages?$top=5" },
+          {
+            id: "2",
+            method: "POST",
+            url: "/me/sendMail",
+            body: { message: { toRecipients: [{ emailAddress: { address: "a@ext.com" } }] } }
+          }
+        ]
+      });
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("reaches an itemAttachment nested inside a graph-batch sub-request", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        requests: [
+          {
+            id: "1",
+            method: "POST",
+            url: "/me/sendMail",
+            body: {
+              message: {
+                toRecipients: [{ emailAddress: { address: "direct@ext.com" } }],
+                attachments: [
+                  {
+                    "@odata.type": "#microsoft.graph.itemAttachment",
+                    item: {
+                      toRecipients: [{ emailAddress: { address: "forwarded@deeper.example" } }]
+                    }
+                  }
+                ]
+              }
+            }
+          }
+        ]
+      });
+      expect(payload.recipient_count).toBe(2);
+      expect(payload.recipient_domains).toEqual(["deeper.example", "ext.com"]);
+    });
+    it("reads a bare string entry, malformed though it is", async () => {
+      draftEndpoint();
+      const payload = await runDraft({ toRecipients: ["a@ext.com"] });
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("reads an all-PascalCase recipient entry, as Graph accepts it", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        ToRecipients: [{ EmailAddress: { Address: "a@ext.com" } }]
+      });
+      expect(payload).toMatchObject({ recipient_count: 1, recipient_domains: ["ext.com"] });
+    });
+    it("normalises a display-name address down to the bare domain", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        toRecipients: [
+          { emailAddress: { address: "Bob <bob@ext.com>" } },
+          { emailAddress: { address: "a@ext.com " } },
+          { emailAddress: { address: "c@ext.com note" } }
+        ]
+      });
+      expect(payload.recipient_domains).toEqual(["ext.com"]);
+      expect(payload.recipient_count).toBe(3);
+    });
+    it("caps the domain list but keeps recipient_count exact", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        toRecipients: Array.from({ length: 60 }, (_, i) => ({
+          emailAddress: { address: `user@d${String(i).padStart(2, "0")}.example` }
+        }))
+      });
+      expect(payload.recipient_count).toBe(60);
+      expect(payload.recipient_domains).toHaveLength(50);
+      expect(payload.recipient_domains_truncated).toBe(true);
+    });
+    it("does not flag truncation when the domain list fits", async () => {
+      draftEndpoint();
+      const payload = await runDraft({
+        toRecipients: [{ emailAddress: { address: "a@example.com" } }]
+      });
+      expect(payload).not.toHaveProperty("recipient_domains_truncated");
+    });
     it("omits both fields when a request has no recipients", async () => {
       draftEndpoint();
       const payload = await runDraft({ subject: "a draft with no recipients yet" });

package/dist/auth-tools.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import logger from "./logger.js";
 import { getRequestTokens } from "./request-context.js";
 function registerAuthTools(server, authManager) {
   server.tool(
@@ -41,7 +42,10 @@ function registerAuthTools(server, authManager) {
           };
         }
         const text = await new Promise((resolve, reject) => {
-          authManager.acquireTokenByDeviceCode(resolve).catch(reject);
+          authManager.acquireTokenByDeviceCode(resolve).catch((error) => {
+            logger.error(`Device code login failed after the code was issued: ${error.message}`);
+            reject(error);
+          });
         });
         return {
           content: [

package/dist/auth.js

@@ -5,6 +5,9 @@ import { fileURLToPath } from "url";
 import path from "path";
 import { getSecrets } from "./secrets.js";
 import { getCloudEndpoints, getDefaultClientId } from "./cloud-config.js";
+import {
+  dedupeRefreshTokens
+} from "./lib/cache-dedupe.js";
 import {
   createTokenCacheStorage,
   DefaultTokenCacheStorage,
@@ -31,13 +34,104 @@ function createMsalConfig(secrets) {
     }
   };
 }
+const warnedDuplicateRefreshTokens = /* @__PURE__ */ new Set();
+let unresolvedDuplicateAccounts = /* @__PURE__ */ new Set();
+function resetRefreshTokenWarningsForTests() {
+  warnedDuplicateRefreshTokens.clear();
+  unresolvedDuplicateAccounts = /* @__PURE__ */ new Set();
+}
+function canonicalKeyResolver(tokenCache) {
+  const storage = tokenCache?.storage;
+  const generate = storage?.generateCredentialKey;
+  if (typeof generate !== "function") return void 0;
+  return (entity) => {
+    if (!entity.home_account_id || !entity.environment || !entity.client_id) return void 0;
+    try {
+      const key = generate.call(storage, {
+        homeAccountId: entity.home_account_id,
+        environment: entity.environment,
+        credentialType: "RefreshToken",
+        clientId: entity.client_id,
+        ...entity.family_id ? { familyId: entity.family_id } : {},
+        // Each of these owns a segment of the key. MSAL does not put them on refresh tokens
+        // today, but a serialized entity can carry them, and dropping them would map two
+        // different credentials onto one key - and then this deletes a live one
+        ...entity.realm ? { realm: entity.realm } : {},
+        ...entity.target ? { target: entity.target } : {},
+        ...entity.token_type ? { tokenType: entity.token_type } : {},
+        secret: entity.secret ?? ""
+      });
+      return typeof key === "string" ? key : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+}
+function pruneDuplicateRefreshTokens(data, tokenCache) {
+  const result = dedupeRefreshTokens(
+    data,
+    tokenCache === void 0 ? void 0 : canonicalKeyResolver(tokenCache)
+  );
+  for (const drop of result.dropped) {
+    const signature = `${drop.environment}->${drop.keptEnvironment}`;
+    if (warnedDuplicateRefreshTokens.has(signature)) continue;
+    warnedDuplicateRefreshTokens.add(signature);
+    logger.warn(
+      `Dropped a stale refresh token cached under ${drop.environment}, keeping the one under ${drop.keptEnvironment}. MSAL treats those as the same account and spends whichever it finds first, which is what strands a sign-in on a months-old token (issue #648).`
+    );
+  }
+  unresolvedDuplicateAccounts = new Set(result.ambiguousAccounts);
+  if (result.ambiguous > 0 && !warnedDuplicateRefreshTokens.has("ambiguous")) {
+    warnedDuplicateRefreshTokens.add("ambiguous");
+    logger.warn(
+      `The auth cache holds ${result.ambiguous} set(s) of duplicate refresh tokens with nothing to say which is current, so they were left alone. If silent refresh keeps failing for an account, log out and sign in again to clear them.`
+    );
+  }
+  return result;
+}
+function dropFromKVStore(tokenCache, dropped) {
+  if (dropped.length === 0) return;
+  const store = tokenCache.getKVStore?.();
+  if (!store) return;
+  for (const drop of dropped) {
+    delete store[drop.key];
+  }
+}
+const PERSISTENCE_RECHECK_MS = 150;
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function persistedRefreshTokens(cacheJson, homeAccountId) {
+  let refreshTokens;
+  try {
+    const parsed = JSON.parse(cacheJson);
+    if (typeof parsed !== "object" || parsed === null) return void 0;
+    refreshTokens = parsed.RefreshToken;
+  } catch {
+    return void 0;
+  }
+  const secrets = /* @__PURE__ */ new Set();
+  if (typeof refreshTokens !== "object" || refreshTokens === null) return secrets;
+  for (const entity of Object.values(refreshTokens)) {
+    if (typeof entity !== "object" || entity === null) continue;
+    const credential = entity;
+    if (credential.home_account_id !== homeAccountId) continue;
+    if (credential.secret) secrets.add(credential.secret);
+  }
+  return secrets;
+}
 function buildDiskCoherencyCachePlugin(storage) {
   return {
     beforeCacheAccess: async (context) => {
       try {
         const cacheRaw = await storage.load("token-cache");
         if (cacheRaw) {
-          context.tokenCache.deserialize(unwrapCache(cacheRaw).data);
+          const pruned = pruneDuplicateRefreshTokens(
+            unwrapCache(cacheRaw).data,
+            context.tokenCache
+          );
+          context.tokenCache.deserialize(pruned.data);
+          dropFromKVStore(context.tokenCache, pruned.dropped);
         }
       } catch (error) {
         logger.error(`Error reloading token cache: ${error.message}`);
@@ -334,6 +428,12 @@ function describeAuthError(error) {
   }
   return error.message;
 }
+function duplicateRefreshTokenHint(account, unresolvedAccounts) {
+  if (!account || !unresolvedAccounts.has(account.homeAccountId)) {
+    return null;
+  }
+  return "The auth cache holds more than one refresh token for this account and nothing indicates which is current, so a stale one may be winning. Logging in again will not clear it - run logout first, then log in.";
+}
 const MSA_HOME_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
 function consumersAuthorityHint(error, account, authority) {
   if (error instanceof AuthError && error.errorCode === "invalid_grant" && account?.tenantId === MSA_HOME_TENANT_ID && (!authority || /\/common\/?$/i.test(authority))) {
@@ -358,6 +458,7 @@ class AuthManager {
     this.tokenExpiry = null;
     this.selectedAccountId = null;
     this.useInteractiveAuth = false;
+    this.loginPersistence = null;
     this.expectedUsername = this.normalizeExpectedUsername(expectedAccount?.expectedUsername);
     this.expectedHomeAccountId = this.normalizeExpectedHomeAccountId(
       expectedAccount?.expectedHomeAccountId
@@ -380,7 +481,10 @@ class AuthManager {
     try {
       const cacheRaw = await this.storage.load("token-cache");
       if (cacheRaw) {
-        this.msalApp.getTokenCache().deserialize(unwrapCache(cacheRaw).data);
+        const tokenCache = this.msalApp.getTokenCache();
+        const pruned = pruneDuplicateRefreshTokens(unwrapCache(cacheRaw).data, tokenCache);
+        tokenCache.deserialize(pruned.data);
+        dropFromKVStore(tokenCache, pruned.dropped);
       }
       await this.loadSelectedAccount();
     } catch (error) {
@@ -531,6 +635,115 @@ class AuthManager {
       `Microsoft login did not return an account. Expected Microsoft account '${this.expectedAccountLabel()}'. Login was not persisted.`
     );
   }
+  async readPersistedRefreshTokens(homeAccountId) {
+    const cacheRaw = await this.storage.load("token-cache");
+    return cacheRaw ? persistedRefreshTokens(unwrapCache(cacheRaw).data, homeAccountId) : /* @__PURE__ */ new Set();
+  }
+  /**
+   * The cache as it stood before a sign-in, so the check afterwards can tell a write that
+   * never happened from one a sibling overwrote. The account is not known until the sign-in
+   * returns, so keep the whole blob and filter later. Best-effort.
+   */
+  async snapshotPersistedCache() {
+    try {
+      const cacheRaw = await this.storage.load("token-cache");
+      return cacheRaw ? unwrapCache(cacheRaw).data : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Records why a sign-in could not be confirmed, then throws.
+   *
+   * The message has to outlive the throw. On the MCP `login` path the tool has already
+   * returned - it resolves as soon as there is a device code to show - so this rejection
+   * has nowhere to go, and `verify login` is where the user looks next. Clearing the
+   * in-memory token stops that check from answering out of memory and calling it a
+   * success (issue #648).
+   */
+  failLoginPersistence(account, reason) {
+    const message = `Signed in as '${this.describeAccount(account)}', but ${reason}`;
+    this.loginPersistence = { homeAccountId: account.homeAccountId, message };
+    this.accessToken = null;
+    this.tokenExpiry = null;
+    logger.error(message);
+    throw new Error(message);
+  }
+  /** Refresh token secrets MSAL holds for an account right now, before anything reloads. */
+  inMemoryRefreshTokens(homeAccountId) {
+    const secrets = /* @__PURE__ */ new Set();
+    const cache = this.msalApp.getTokenCache();
+    const store = cache.getKVStore?.();
+    if (!store) return secrets;
+    for (const entity of Object.values(store)) {
+      if (typeof entity !== "object" || entity === null) continue;
+      const credential = entity;
+      if (credential.credentialType !== "RefreshToken") continue;
+      if (credential.homeAccountId !== homeAccountId) continue;
+      if (credential.secret) secrets.add(credential.secret);
+    }
+    return secrets;
+  }
+  /**
+   * Confirms the refresh token MSAL just issued actually reached the cache.
+   *
+   * Persistence is best-effort by design: DefaultTokenCacheStorage is not fail-closed, so
+   * afterCacheAccess swallows a refused or failed write and the sign-in still reports
+   * success. The account then works for exactly one access token lifetime - the one held
+   * in memory - and every silent refresh afterwards falls back to whatever stale token is
+   * still on disk. Nothing surfaces that until it has been happening for weeks, by which
+   * point the stale token has aged past Entra's 90-day inactivity limit and the account is
+   * dead (issue #648). Cheaper to read the cache back once than to debug that later.
+   *
+   * `before` is the cache ahead of the sign-in. Demanding the issued token on disk is right
+   * until you remember the cache is last-writer-wins, not locked (issue #545): a sibling
+   * mid-refresh can rotate the same credential just after this one saved. That leaves a
+   * live token that isn't ours, which is a working account. The failure is a write that
+   * left no trace at all.
+   */
+  async assertLoginPersisted(account, before) {
+    this.loginPersistence = null;
+    if (!account) return;
+    const issued = this.inMemoryRefreshTokens(account.homeAccountId);
+    if (issued.size === 0) return;
+    let persisted;
+    try {
+      persisted = await this.readPersistedRefreshTokens(account.homeAccountId);
+      if (persisted && ![...issued].every((secret) => persisted.has(secret))) {
+        await delay(PERSISTENCE_RECHECK_MS);
+        persisted = await this.readPersistedRefreshTokens(account.homeAccountId);
+      }
+    } catch (error) {
+      this.failLoginPersistence(
+        account,
+        `the auth cache could not be read back (${error.message}), so the sign-in cannot be confirmed as saved. It would stop working when this access token expires. Fix the cache location, then log in again.`
+      );
+    }
+    if (persisted === void 0) {
+      this.failLoginPersistence(
+        account,
+        `the auth cache did not read back as a usable cache, so the sign-in cannot be confirmed as saved. It would stop working when this access token expires. Check the log for 'Not persisting token-cache'.`
+      );
+    }
+    if (![...issued].every((secret) => persisted.has(secret))) {
+      const beforeSecrets = before === void 0 ? void 0 : persistedRefreshTokens(before, account.homeAccountId);
+      const supersededByAnotherProcess = beforeSecrets !== void 0 && [...persisted].some((secret) => !beforeSecrets.has(secret));
+      if (!supersededByAnotherProcess) {
+        this.failLoginPersistence(
+          account,
+          `the refresh token was not written to the auth cache, so access would stop working when this access token expires. The log says why - look for 'Not persisting token-cache' or 'Error saving token cache'.`
+        );
+      }
+      logger.warn(
+        `Another process rewrote the auth cache for '${this.describeAccount(account)}' during sign-in. The refresh token on disk is not the one just issued, but it was not there before this sign-in either, so something wrote a live credential and the sign-in counts as saved (issue #545).`
+      );
+    }
+    if (persisted.size > 1) {
+      logger.warn(
+        `The auth cache holds ${persisted.size} refresh tokens for '${this.describeAccount(account)}'. MSAL spends whichever it finds first, so a stale one can win (issue #648). Log out and sign in again if silent refresh starts failing.`
+      );
+    }
+  }
   async setOAuthToken(token) {
     this.oauthToken = token;
     this.isOAuthMode = true;
@@ -554,7 +767,10 @@ class AuthManager {
         this.tokenExpiry = response.expiresOn ? new Date(response.expiresOn).getTime() : null;
         return this.accessToken;
       } catch (error) {
-        const hint = consumersAuthorityHint(error, currentAccount, this.config.auth.authority);
+        const hint = [
+          consumersAuthorityHint(error, currentAccount, this.config.auth.authority),
+          duplicateRefreshTokenHint(currentAccount, unresolvedDuplicateAccounts)
+        ].filter(Boolean).join(" ") || null;
         logger.error(
           `Silent token acquisition failed: ${describeAuthError(error)}${hint ? ` ${hint}` : ""}`
         );
@@ -602,12 +818,14 @@ class AuthManager {
     try {
       logger.info("Requesting device code...");
       logger.info(`Requesting scopes: ${this.scopes.join(", ")}`);
+      const before = await this.snapshotPersistedCache();
       const response = await this.msalApp.acquireTokenByDeviceCode(deviceCodeRequest);
       logger.info(`Granted scopes: ${response?.scopes?.join(", ") || "none"}`);
       logger.info("Device code login successful");
       this.accessToken = response?.accessToken || null;
       this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
       await this.rejectUnexpectedLoginAccount(response?.account);
+      await this.assertLoginPersisted(response?.account, before);
       if (!this.selectedAccountId && response?.account) {
         this.selectedAccountId = response.account.homeAccountId;
         await this.saveSelectedAccount();
@@ -643,12 +861,14 @@ class AuthManager {
     try {
       logger.info("Requesting interactive browser login...");
       logger.info(`Requesting scopes: ${this.scopes.join(", ")}`);
+      const before = await this.snapshotPersistedCache();
       const response = await this.msalApp.acquireTokenInteractive(interactiveRequest);
       logger.info(`Granted scopes: ${response?.scopes?.join(", ") || "none"}`);
       logger.info("Interactive browser login successful");
       this.accessToken = response?.accessToken || null;
       this.tokenExpiry = response?.expiresOn ? new Date(response.expiresOn).getTime() : null;
       await this.rejectUnexpectedLoginAccount(response?.account);
+      await this.assertLoginPersisted(response?.account, before);
       if (!this.selectedAccountId && response?.account) {
         this.selectedAccountId = response.account.homeAccountId;
         await this.saveSelectedAccount();
@@ -660,9 +880,25 @@ class AuthManager {
       throw error;
     }
   }
+  /**
+   * Whether the recorded failure is about the account this check would test.
+   *
+   * An explicit selection is the only thing that says "not asking about that sign-in".
+   * Resolving the account is not: a failed sign-in never reaches the auto-select and its
+   * account is usually missing from the cache anyway, so getCurrentAccount falls back to
+   * whichever is first and gives the neighbour a clean bill of health (issue #648).
+   */
+  loginPersistenceAppliesToCurrentAccount() {
+    if (!this.loginPersistence) return false;
+    return this.selectedAccountId === null || this.selectedAccountId === this.loginPersistence.homeAccountId;
+  }
   async testLogin() {
     try {
       logger.info("Testing login...");
+      if (this.loginPersistence && this.loginPersistenceAppliesToCurrentAccount()) {
+        logger.error(`Login test failed - ${this.loginPersistence.message}`);
+        return { success: false, message: this.loginPersistence.message };
+      }
       const token = await this.getToken();
       if (!token) {
         logger.error("Login test failed - no token received");
@@ -723,6 +959,7 @@ class AuthManager {
       this.accessToken = null;
       this.tokenExpiry = null;
       this.selectedAccountId = null;
+      this.loginPersistence = null;
       await this.storage.delete("token-cache");
       await this.storage.delete("selected-account");
       return true;
@@ -746,6 +983,9 @@ class AuthManager {
     await this.saveSelectedAccount();
     this.accessToken = null;
     this.tokenExpiry = null;
+    if (this.loginPersistence && this.loginPersistence.homeAccountId !== account.homeAccountId) {
+      this.loginPersistence = null;
+    }
     logger.info(`Selected account: ${account.username} (${account.homeAccountId})`);
     return true;
   }
@@ -753,6 +993,9 @@ class AuthManager {
     const account = await this.resolveAccount(identifier);
     try {
       await this.msalApp.getTokenCache().removeAccount(account);
+      if (this.loginPersistence?.homeAccountId === account.homeAccountId) {
+        this.loginPersistence = null;
+      }
       if (this.selectedAccountId === account.homeAccountId) {
         this.selectedAccountId = null;
         await this.saveSelectedAccount();
@@ -891,6 +1134,7 @@ export {
   consumersAuthorityHint,
   auth_default as default,
   describeAuthError,
+  duplicateRefreshTokenHint,
   getEndpointRequiredScopes,
   getEndpointScopeGroups,
   getMissingAllowedScopes,
@@ -899,6 +1143,7 @@ export {
   getTokenCachePath,
   parseAllowedScopes,
   pickNewest,
+  resetRefreshTokenWarningsForTests,
   resolveAuthScopes,
   unwrapCache,
   wrapCache

package/dist/graph-tools.js

@@ -115,37 +115,84 @@ function graphResponseAuditFields(response) {
     ...graphBatchErrorCodeCounts !== void 0 ? { graph_batch_error_code_counts: graphBatchErrorCodeCounts } : {}
   };
 }
-const RECIPIENT_FIELDS = /* @__PURE__ */ new Set(["torecipients", "ccrecipients", "bccrecipients", "attendees"]);
-const NESTED_BODY_FIELDS = /* @__PURE__ */ new Set(["message"]);
-const MAX_BODY_DEPTH = 3;
+const RECIPIENT_FIELDS = /* @__PURE__ */ new Set([
+  "torecipients",
+  "ccrecipients",
+  "bccrecipients",
+  "attendees",
+  // driveItem /invite mails an outsider a link to the file
+  "recipients"
+]);
+const MAX_BODY_DEPTH = 8;
+const MAX_RECIPIENT_DOMAINS = 50;
+function lookupCaseInsensitive(node, lowerName) {
+  if (!node || typeof node !== "object") return void 0;
+  for (const [key, value] of Object.entries(node)) {
+    if (key.toLowerCase() === lowerName) return value;
+  }
+  return void 0;
+}
+function readAddress(entry) {
+  if (typeof entry === "string") return entry;
+  const emailAddress = lookupCaseInsensitive(entry, "emailaddress");
+  const candidates = [
+    typeof emailAddress === "string" ? emailAddress : lookupCaseInsensitive(emailAddress, "address"),
+    lookupCaseInsensitive(entry, "email"),
+    lookupCaseInsensitive(entry, "upn")
+  ];
+  for (const candidate of candidates) {
+    if (typeof candidate === "string" && candidate) return candidate;
+  }
+  return void 0;
+}
+const DOMAIN_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+const MAX_DOMAIN_LENGTH = 253;
+function addRecipient(entry, domains, counter) {
+  counter.count += 1;
+  const address = readAddress(entry);
+  if (address === void 0) return;
+  const at = address.lastIndexOf("@");
+  if (at <= 0 || at >= address.length - 1) return;
+  const domain = address.slice(at + 1).trim().split(/\s/)[0].replace(/[>.]+$/, "").toLowerCase();
+  if (domain.length <= MAX_DOMAIN_LENGTH && DOMAIN_PATTERN.test(domain)) domains.add(domain);
+}
 function collectRecipients(node, domains, counter, depth = 0) {
   if (!node || typeof node !== "object" || depth > MAX_BODY_DEPTH) return;
+  if (Array.isArray(node)) {
+    for (const item of node) collectRecipients(item, domains, counter, depth + 1);
+    return;
+  }
   for (const [key, value] of Object.entries(node)) {
-    const name = key.toLowerCase();
-    if (NESTED_BODY_FIELDS.has(name)) {
-      collectRecipients(value, domains, counter, depth + 1);
+    if (RECIPIENT_FIELDS.has(key.toLowerCase()) && Array.isArray(value)) {
+      for (const entry of value) addRecipient(entry, domains, counter);
       continue;
     }
-    if (!RECIPIENT_FIELDS.has(name) || !Array.isArray(value)) continue;
-    for (const entry of value) {
-      const address = entry?.emailAddress?.address;
-      if (typeof address !== "string") continue;
-      counter.count += 1;
-      const at = address.lastIndexOf("@");
-      if (at > 0 && at < address.length - 1) {
-        domains.add(address.slice(at + 1).toLowerCase());
-      }
-    }
+    collectRecipients(value, domains, counter, depth + 1);
   }
 }
+function bodyForRecipientWalk(body) {
+  if (typeof body !== "string") return body;
+  if (!/^\s*[{[]/.test(body)) return void 0;
+  return JSON.parse(body);
+}
 function recipientAuditFields(body) {
   const domains = /* @__PURE__ */ new Set();
   const counter = { count: 0 };
-  collectRecipients(body, domains, counter);
+  try {
+    collectRecipients(bodyForRecipientWalk(body), domains, counter);
+  } catch (error) {
+    logger.warn(
+      `Skipped recipient audit metadata: ${error instanceof Error ? error.message : "unknown error"}`
+    );
+    return {};
+  }
   if (counter.count === 0) return {};
+  const sorted = [...domains].sort();
+  const capped = sorted.slice(0, MAX_RECIPIENT_DOMAINS);
   return {
     recipient_count: counter.count,
-    ...domains.size > 0 ? { recipient_domains: [...domains].sort() } : {}
+    ...capped.length > 0 ? { recipient_domains: capped } : {},
+    ...sorted.length > capped.length ? { recipient_domains_truncated: true } : {}
   };
 }
 function thrownErrorAuditFields(error) {
@@ -778,8 +825,15 @@ function isPlainObject(value) {
 function hasOwn(obj, key) {
   return Object.prototype.hasOwnProperty.call(obj, key);
 }
+function describeParamsForLog(params) {
+  try {
+    return JSON.stringify(params);
+  } catch (error) {
+    return `[unserializable: ${error instanceof Error ? error.name : "unknown error"}]`;
+  }
+}
 async function executeGraphTool(tool, config, graphClient, params, authManager) {
-  logger.info(`Tool ${tool.alias} called with params: ${JSON.stringify(params)}`);
+  logger.info(`Tool ${tool.alias} called with params: ${describeParamsForLog(params)}`);
   if (isConfirmGateEnabled() && isDestructiveOperation(tool.method, config) && params.confirm !== true) {
     logger.warn(
       `Refusing destructive tool ${tool.alias} (${tool.method.toUpperCase()}): missing confirm: true`
@@ -805,6 +859,7 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
   const upn = getUserIdentityForAudit(getRequestTokens()?.accessToken);
   const httpMethod = tool.method.toUpperCase();
   let targetResource;
+  let body = null;
   try {
     const accountParam = params.account;
     const accountModeError = await checkAccountParamInBearerMode(accountParam, authManager);
@@ -834,7 +889,6 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
     let path2 = tool.path;
     const queryParams = {};
     const headers = {};
-    let body = null;
     const bodyShape = bodySchemaShape(
       parameterDefinitions.find((p) => p.type === "Body")?.schema
     );
@@ -1184,7 +1238,8 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       duration_ms: Date.now() - startTime,
       ...targetResource ? { target_resource: targetResource } : {},
       error_type: err?.name || "Error",
-      ...thrownErrorAuditFields(error)
+      ...thrownErrorAuditFields(error),
+      ...recipientAuditFields(body)
     });
     return {
       content: [

package/dist/lib/cache-dedupe.js

@@ -0,0 +1,126 @@
+function isDict(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isEntity(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function groupKey(homeAccountId, owner) {
+  return `${homeAccountId} ${owner}`;
+}
+function environmentPreferences(cache) {
+  const byOwner = /* @__PURE__ */ new Map();
+  if (isDict(cache.AccessToken)) {
+    for (const entity of Object.values(cache.AccessToken)) {
+      const home = entity?.home_account_id;
+      const environment = entity?.environment;
+      const client = entity?.client_id;
+      if (!home || !environment || !client) continue;
+      const cachedAt = Number(entity.cached_at);
+      if (!Number.isFinite(cachedAt)) continue;
+      const key = groupKey(home, client);
+      const best = byOwner.get(key);
+      if (!best || cachedAt > best.cachedAt) {
+        byOwner.set(key, { environment, cachedAt, tied: false });
+      } else if (cachedAt === best.cachedAt && environment !== best.environment) {
+        best.tied = true;
+      }
+    }
+  }
+  return byOwner;
+}
+function preferredEnvironment(preferences, group) {
+  const choice = preferences.get(groupKey(group.homeAccountId, group.owner));
+  if (!choice || choice.tied) return void 0;
+  return choice.environment;
+}
+function dropSupersededKeyFormats(refreshTokens, canonicalKeyFor) {
+  const byCanonical = /* @__PURE__ */ new Map();
+  for (const [key, entity] of Object.entries(refreshTokens)) {
+    if (!isEntity(entity)) continue;
+    const canonical = canonicalKeyFor(entity);
+    if (!canonical) continue;
+    byCanonical.set(canonical, [...byCanonical.get(canonical) ?? [], key]);
+  }
+  const dropped = [];
+  for (const [canonical, keys] of byCanonical) {
+    if (keys.length < 2 || !keys.includes(canonical)) continue;
+    for (const key of keys) {
+      if (key === canonical) continue;
+      dropped.push({
+        key,
+        environment: refreshTokens[key]?.environment ?? "unknown",
+        keptEnvironment: refreshTokens[canonical]?.environment ?? "unknown"
+      });
+    }
+  }
+  return dropped;
+}
+function dedupeRefreshTokens(cacheJson, canonicalKeyFor) {
+  const unchanged = {
+    data: cacheJson,
+    dropped: [],
+    ambiguous: 0,
+    ambiguousAccounts: []
+  };
+  let cache;
+  try {
+    const parsed = JSON.parse(cacheJson);
+    if (!isDict(parsed)) return unchanged;
+    cache = parsed;
+  } catch {
+    return unchanged;
+  }
+  const refreshTokens = cache.RefreshToken;
+  if (!isDict(refreshTokens)) return unchanged;
+  const supersededDrops = canonicalKeyFor ? dropSupersededKeyFormats(refreshTokens, canonicalKeyFor) : [];
+  for (const drop of supersededDrops) delete refreshTokens[drop.key];
+  const groups = /* @__PURE__ */ new Map();
+  for (const [key, entity] of Object.entries(refreshTokens)) {
+    if (!isEntity(entity)) continue;
+    const home = entity.home_account_id;
+    const owner = entity.family_id || entity.client_id;
+    if (!home || !owner) continue;
+    const group = groups.get(groupKey(home, owner));
+    if (group) group.keys.push(key);
+    else groups.set(groupKey(home, owner), { homeAccountId: home, owner, keys: [key] });
+  }
+  const duplicated = [...groups.values()].filter((group) => group.keys.length > 1);
+  if (duplicated.length === 0) {
+    return supersededDrops.length > 0 ? {
+      data: JSON.stringify(cache),
+      dropped: supersededDrops,
+      ambiguous: 0,
+      ambiguousAccounts: []
+    } : unchanged;
+  }
+  const preferences = environmentPreferences(cache);
+  const dropped = [...supersededDrops];
+  let ambiguous = 0;
+  const ambiguousAccounts = /* @__PURE__ */ new Set();
+  for (const group of duplicated) {
+    const keep = preferredEnvironment(preferences, group);
+    const winners = keep ? group.keys.filter((key) => refreshTokens[key]?.environment === keep) : [];
+    if (!keep || winners.length !== 1) {
+      ambiguous += 1;
+      ambiguousAccounts.add(group.homeAccountId);
+      continue;
+    }
+    for (const key of group.keys) {
+      if (key === winners[0]) continue;
+      dropped.push({
+        key,
+        environment: refreshTokens[key]?.environment ?? "unknown",
+        keptEnvironment: keep
+      });
+    }
+  }
+  const unranked = [...ambiguousAccounts];
+  if (dropped.length === 0) {
+    return { data: cacheJson, dropped, ambiguous, ambiguousAccounts: unranked };
+  }
+  for (const drop of dropped) delete refreshTokens[drop.key];
+  return { data: JSON.stringify(cache), dropped, ambiguous, ambiguousAccounts: unranked };
+}
+export {
+  dedupeRefreshTokens
+};

package/docs/deployment.md

@@ -213,7 +213,7 @@ The client automatically discovers OAuth endpoints and opens a browser for authe
 - **Tool filtering**: use `--enabled-tools <regex>` or `--preset <names>` to restrict available tools
 - **CORS**: configure `MS365_MCP_CORS_ORIGIN` to restrict allowed origins (defaults to `http://localhost:3000`); set explicitly when clients run on a different origin
 - **Disable Dynamic Client Registration**: when only a known client talks to the server, set `MS365_MCP_DISABLE_DCR=true` (or pass `--no-dynamic-registration`) to close the anonymous `/register` endpoint
-- **Structured audit log**: enabled by default. Every tool invocation emits one JSON line on stderr (captured by the container platform's log collector) and to `~/.ms-365-mcp-server/logs/audit.log` (mode `0o600`) with `{ event, request_id, user_principal_name, tool, http_method, status, duration_ms, target_resource?, error_type?, error_code? }`. Policy-blocked tool attempts emit `event: "tool.denied"` with `status: "denied"`, `reason` (`allowed_scopes` or `tool_allowlist`), and `missing_scopes` when applicable. When an audited generated Microsoft Graph tool targets a derivable resource through an ID-like path parameter such as `{message-id}` or `{driveItem-id}`, `target_resource` is `{ type, id }`, where `id` is the Graph path up to that resource ID. Later path parameters such as `{path}`, query values, tool parameters, returned content, and Graph response bodies are NEVER recorded, and error messages are reduced to `error_type` / `error_code` so upstream library errors do not leak token fragments or query-string PII. Forms the "who accessed what, when" trail required for GDPR / HIPAA / PIPEDA / SOC 2 audit. Opt-out: `MS365_MCP_AUDIT_LOG=false`
+- **Structured audit log**: enabled by default. Every tool invocation that reaches Microsoft Graph emits one JSON line on stderr (captured by the container platform's log collector) and to `~/.ms-365-mcp-server/logs/audit.log` (mode `0o600`, or under `MS365_MCP_LOG_DIR` when set) with `{ event, request_id, user_principal_name, tool, http_method, http_status?, status, duration_ms, recipient_count?, recipient_domains?, recipient_domains_truncated?, graph_batch_subrequest_count?, graph_batch_http_status_counts?, graph_batch_error_code_counts?, target_resource?, error_type?, error_code? }`. A few refusals short-circuit before that and emit nothing: a confirm-gate rejection, an `account` param that contradicts the bearer identity, and a failure to resolve an account token. Policy-blocked tool attempts emit `event: "tool.denied"` with `status: "denied"`, `reason` (`allowed_scopes` or `tool_allowlist`), and `missing_scopes` when applicable. When an audited generated Microsoft Graph tool targets a derivable resource through an ID-like path parameter such as `{message-id}` or `{driveItem-id}`, `target_resource` is `{ type, id }`, where `id` is the Graph path up to that resource ID. Later path parameters such as `{path}`, query values, returned content, and Graph response bodies are NEVER recorded, and error messages are reduced to `error_type` / `error_code` so upstream library errors do not leak token fragments or query-string PII. Two things derived from tool parameters **are** recorded, both deliberately. First, `target_resource.id` substitutes ID-like path parameters into the resource path, so a tool on `/users/{user-id}/...` records whatever identifier the caller passed, which may be a full email address. Second, a request whose body carries `toRecipients` / `ccRecipients` / `bccRecipients` / `attendees` / `recipients`, at any casing and several levels down, including inside a `graph-batch` sub-request, records `recipient_count`, the number of entries in those arrays, and `recipient_domains`, the **domain part only** of their addresses and only where it parses as a plain hostname, never the local part and never a subject or message body. An entry that names someone without an address (a `driveRecipient` given as `alias` or `objectId`) counts but contributes no domain. It keys on body shape rather than on the endpoint, so it covers sends, forwards, invites and file shares but equally draft creation and edits, event updates and `findMeetingTimes`, and it reads high rather than low: an attached message's own recipients are counted too. `recipient_domains` holds at most 50 **distinct domains**, alphabetically, and sets `recipient_domains_truncated: true` when there were more; `recipient_count` is unaffected by the cap. All three are absent when the body carries no recipient array at all. A request that fails after reaching Graph still records recipients, since a timeout is not proof of non-delivery. Gaps remain, so absence proves nothing: a draft composed outside this server and sent by id, the original thread's recipients on a reply (Graph resolves those server-side), and a body nesting recipients deeper than the walker descends. This describes the structured audit log only; the operational logger is separate and does log tool parameters. Forms the "who accessed what, when" trail required for GDPR / HIPAA / PIPEDA / SOC 2 audit. Opt-out: `MS365_MCP_AUDIT_LOG=false`
 - **Graph resilience**: every call to Microsoft Graph is wrapped with a fetch timeout (default 100 s via `MS365_MCP_GRAPH_TIMEOUT_MS`), retry-with-backoff on 429 / 503 / 504 / network errors (default 3 retries, full-jitter exponential backoff, honours `Retry-After`; 503 / 504 / network errors only retried for idempotent methods, 429 retried on all methods), and a process-wide circuit breaker that opens after 5 consecutive failures and cools down for 30 s (`MS365_MCP_GRAPH_CIRCUIT_THRESHOLD` / `MS365_MCP_GRAPH_CIRCUIT_COOLDOWN_MS`). Disable the breaker for trusted automation: `MS365_MCP_GRAPH_CIRCUIT_DISABLED=true`
 - **Confirm gate on destructive tools**: opt-in, **off by default**. Enable with `MS365_MCP_REQUIRE_CONFIRM=true`. When on, destructive tools (POST except `readOnly`, PATCH, PUT, DELETE — `delete-mail-message`, `send-mail`, `update-event`, etc.) return `{ "error": "confirmation_required" }` until the caller re-invokes them with `"confirm": true`. Mitigates accidental writes when an LLM misroutes a request or follows an injected instruction. Shipped opt-in so it is a non-breaking, additive layer that can coexist with client-side elicitation prompts (MCP Elicitation API) where the client supports them.
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.146.0",
+  "version": "0.146.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",