@softeria/ms-365-mcp-server 0.149.1 → 0.150.1

package/dist/__tests__/graph-tools.test.js

@@ -2822,6 +2822,197 @@ describe("graph-tools", () => {
       expect(server.tools.get("destructive-tool").schema).toHaveProperty("confirm");
     });
   });
+  describe("$select projection", () => {
+    const untrimmed = {
+      value: [
+        {
+          id: "MSo",
+          subject: "Standup",
+          joinWebUrl: "https://teams/x",
+          joinInformation: { content: "<div>invite</div>" },
+          joinMeetingIdSettings: { passcode: "123456" }
+        }
+      ]
+    };
+    async function run(args, responses, outputFormat = "json") {
+      mockEndpoints.push(makeEndpoint());
+      mockEndpointsJson = [makeConfig()];
+      const graphClient = createMockGraphClient(
+        responses ?? [{ content: [{ type: "text", text: JSON.stringify(untrimmed) }] }],
+        outputFormat
+      );
+      const server = createMockServer();
+      const { registerGraphTools } = await loadModule();
+      registerGraphTools(server, graphClient);
+      const result = await server.tools.get("test-tool").handler(args);
+      return { result, graphClient };
+    }
+    it("narrows the body to the requested fields when Graph ignored $select", async () => {
+      const { result } = await run({ select: "id,subject,joinWebUrl" });
+      expect(JSON.parse(result.content[0].text).value[0]).toEqual({
+        id: "MSo",
+        subject: "Standup",
+        joinWebUrl: "https://teams/x"
+      });
+    });
+    it("leaves the body untouched when no select was passed", async () => {
+      const { result } = await run({});
+      expect(JSON.parse(result.content[0].text)).toEqual(untrimmed);
+    });
+    it("forces JSON so a --toon client still gets a trimmed body", async () => {
+      const { result, graphClient } = await run({ select: "id,subject" }, void 0, "toon");
+      expect(graphClient.graphRequest).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({ forceJsonOutput: true })
+      );
+      expect(result.content[0].text.startsWith("TOON:")).toBe(true);
+      expect(result.content[0].text).not.toContain("joinInformation");
+    });
+    it("still projects when --toon and fetchAllPages are combined", async () => {
+      const { result } = await run(
+        { select: "id,subject", fetchAllPages: true },
+        [
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "1", subject: "a", joinInformation: { content: "huge" } }],
+                  "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?$skip=1"
+                })
+              }
+            ]
+          },
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "2", subject: "b", joinInformation: { content: "huge" } }]
+                })
+              }
+            ]
+          }
+        ],
+        "toon"
+      );
+      expect(result.content[0].text.startsWith("TOON:")).toBe(true);
+      expect(result.content[0].text).not.toContain("joinInformation");
+      const merged = JSON.parse(result.content[0].text.slice("TOON:".length));
+      expect(merged.value).toEqual([
+        { id: "1", subject: "a" },
+        { id: "2", subject: "b" }
+      ]);
+    });
+    it("does not project a raw-text transport envelope", async () => {
+      const envelope = { message: "OK!", rawResponse: "WEBVTT\n\n00:00:01.000 --> 00:00:02.000" };
+      const { result } = await run({ select: "id" }, [
+        { content: [{ type: "text", text: JSON.stringify(envelope) }] }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(envelope);
+    });
+    it("does not project a binary transport envelope", async () => {
+      const envelope = {
+        message: "OK!",
+        contentType: "video/mp4",
+        encoding: "base64",
+        contentLength: 3,
+        contentBytes: "AAA"
+      };
+      const { result } = await run({ select: "id" }, [
+        { content: [{ type: "text", text: JSON.stringify(envelope) }] }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(envelope);
+    });
+    it("keeps an $expand-ed navigation property that was not selected", async () => {
+      const { result } = await run({ select: "subject", expand: "attachments" }, [
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({
+                id: "1",
+                subject: "a",
+                attachments: [{ id: "att1" }],
+                bodyPreview: "huge"
+              })
+            }
+          ]
+        }
+      ]);
+      const body = JSON.parse(result.content[0].text);
+      expect(body.attachments).toEqual([{ id: "att1" }]);
+      expect(body).not.toHaveProperty("bodyPreview");
+    });
+    it("returns the body untrimmed when no requested field is present", async () => {
+      const body = { id: "1", joinWebUrl: "u", joinInformation: { content: "huge" } };
+      const { result } = await run({ select: "joinUrl" }, [
+        { content: [{ type: "text", text: JSON.stringify(body) }] }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(body);
+    });
+    it("keeps the _etag that includeHeaders adds to a single resource", async () => {
+      const { result } = await run({ select: "subject", includeHeaders: true }, [
+        {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify({ id: "1", subject: "a", _etag: 'W/"1"', bodyPreview: "huge" })
+            }
+          ]
+        }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual({
+        id: "1",
+        subject: "a",
+        _etag: 'W/"1"'
+      });
+    });
+    it("does not arm projection when excludeResponse was requested", async () => {
+      const { result, graphClient } = await run({ select: "id", excludeResponse: true }, [
+        { content: [{ type: "text", text: JSON.stringify({ success: true }) }] }
+      ]);
+      expect(graphClient.graphRequest).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.not.objectContaining({ forceJsonOutput: true })
+      );
+      expect(JSON.parse(result.content[0].text)).toEqual({ success: true });
+    });
+    it("does not project an error body on the merge path", async () => {
+      const errorBody = { error: "Microsoft Graph API error: 403 Forbidden", code: "accessDenied" };
+      const { result } = await run({ select: "error", fetchAllPages: true }, [
+        { content: [{ type: "text", text: JSON.stringify(errorBody) }], isError: true }
+      ]);
+      expect(JSON.parse(result.content[0].text)).toEqual(errorBody);
+    });
+    it("leaves an error from a later page alone", async () => {
+      const errorBody = { error: "Microsoft Graph API error: 503 Service Unavailable" };
+      const { result } = await run(
+        { select: "error", fetchAllPages: true },
+        [
+          {
+            content: [
+              {
+                type: "text",
+                text: JSON.stringify({
+                  value: [{ id: "1", subject: "a" }],
+                  "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?$skip=1"
+                })
+              }
+            ]
+          },
+          { content: [{ type: "text", text: JSON.stringify(errorBody) }], isError: true }
+        ],
+        "toon"
+      );
+      expect(result.content[0].text.startsWith("TOON:")).toBe(false);
+      expect(JSON.parse(result.content[0].text)).toEqual(errorBody);
+    });
+    it("returns the body untrimmed when the only real field is a typo alongside id", async () => {
+      const { result } = await run({ select: "id,joinUrl" });
+      expect(JSON.parse(result.content[0].text)).toEqual(untrimmed);
+    });
+  });
   describe("isDestructiveOperation", () => {
     it("returns true for POST, PATCH, PUT, DELETE", async () => {
       const { isDestructiveOperation } = await loadModule();

package/dist/endpoints.json

@@ -2081,7 +2081,7 @@
     "toolName": "list-online-meetings",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access."
+    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select=id,subject,joinWebUrl unless you need more."
   },
   {
     "pathPattern": "/me/onlineMeetings/{onlineMeeting-id}",
@@ -2089,7 +2089,7 @@
     "toolName": "get-online-meeting",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID."
+    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select with the fields you came here for, e.g. select=id,chatInfo,participants."
   },
   {
     "pathPattern": "/me/onlineMeetings",

package/dist/graph-client.js

@@ -8,6 +8,7 @@ import {
   loadResilienceConfig
 } from "./lib/graph-resilience.js";
 import { applyMessageSignoffToRequest } from "./lib/message-signoff.js";
+import { TRANSPORT_OK_MESSAGE } from "./lib/select-projection.js";
 import { open, stat, unlink } from "fs/promises";
 import { pipeline } from "stream/promises";
 function isBinaryContentType(contentType) {
@@ -118,7 +119,7 @@ class GraphClient {
       if (isBinaryResponse) {
         const buffer = Buffer.from(await response.arrayBuffer());
         result = {
-          message: "OK!",
+          message: TRANSPORT_OK_MESSAGE,
           contentType: contentTypeHeader,
           encoding: "base64",
           contentLength: buffer.byteLength,
@@ -127,14 +128,14 @@ class GraphClient {
       } else {
         const text = await response.text();
         if (text === "") {
-          result = { message: "OK!" };
+          result = { message: TRANSPORT_OK_MESSAGE };
         } else if (options.rawResponse) {
-          result = { message: "OK!", rawResponse: text };
+          result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
         } else {
           try {
             result = JSON.parse(text);
           } catch {
-            result = { message: "OK!", rawResponse: text };
+            result = { message: TRANSPORT_OK_MESSAGE, rawResponse: text };
           }
         }
       }

package/dist/graph-tools.js

@@ -4,6 +4,12 @@ import logger from "./logger.js";
 import { auditLog, getUserIdentityForAudit } from "./audit-log.js";
 import { isDestructiveOperation } from "./lib/destructive-ops.js";
 import { describePathParam } from "./lib/path-params.js";
+import {
+  anyFieldPresent,
+  isTransportEnvelope,
+  parseSelectFields,
+  projectSelectedFields
+} from "./lib/select-projection.js";
 import {
   getEndpointScopeGroups,
   getMissingAllowedScopesForGroups,
@@ -1060,6 +1066,10 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       headers["Accept"] = config.acceptType;
       logger.info(`Setting custom Accept: ${config.acceptType}`);
     }
+    const requestedSelect = parseSelectFields(queryParams["$select"]);
+    const keepFields = [
+      .../* @__PURE__ */ new Set([...requestedSelect, ...parseSelectFields(queryParams["$expand"])])
+    ];
     if (Object.keys(queryParams).length > 0) {
       const queryString = Object.entries(queryParams).map(([key, value]) => `${key}=${encodeURIComponent(value).replace(/%2C/gi, ",")}`).join("&");
       path2 = `${path2}${path2.includes("?") ? "&" : "?"}${queryString}`;
@@ -1123,10 +1133,26 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
       );
     }
     const mergePages = fetchAllPages && paginationEnabled;
-    if (mergePages) {
+    const willProject = requestedSelect.length > 0 && params.excludeResponse !== true;
+    if (mergePages || willProject) {
       options.forceJsonOutput = true;
     }
     let response = await graphClient.graphRequest(path2, options);
+    const shouldProject = willProject && !response?.isError;
+    let projectionHandled = false;
+    const applyProjection = (body2) => {
+      if (isTransportEnvelope(body2)) {
+        logger.info("Skipping $select projection: body is a transport envelope, not a resource");
+        return body2;
+      }
+      if (!anyFieldPresent(body2, requestedSelect)) {
+        logger.warn(
+          `None of the requested $select fields (${requestedSelect.join(",")}) appear in the response; returning it untrimmed`
+        );
+        return body2;
+      }
+      return projectSelectedFields(body2, keepFields);
+    };
     if (mergePages && response?.content?.[0]?.text) {
       let combinedResponse;
       try {
@@ -1190,7 +1216,16 @@ async function executeGraphTool(tool, config, graphClient, params, authManager)
         logger.error(`Error during pagination: ${e}`);
       }
       if (combinedResponse !== void 0) {
-        response.content[0].text = graphClient.serialize(combinedResponse);
+        const merged = shouldProject ? applyProjection(combinedResponse) : combinedResponse;
+        projectionHandled = shouldProject;
+        response.content[0].text = graphClient.serialize(merged);
+      }
+    }
+    if (shouldProject && !projectionHandled && !response?.isError && response?.content?.[0]?.text) {
+      try {
+        const parsed = JSON.parse(response.content[0].text);
+        response.content[0].text = graphClient.serialize(applyProjection(parsed));
+      } catch {
       }
     }
     if (response?.content?.[0]?.text) {

package/dist/lib/microsoft-auth.js

@@ -114,6 +114,61 @@ function toOAuthErrorResponse(error) {
     }
   };
 }
+const PUBLIC_CLIENT_SECRET_REJECTED = 700025;
+function isPublicClientRejection(body) {
+  return Array.isArray(body?.error_codes) && body.error_codes.includes(PUBLIC_CLIENT_SECRET_REJECTED);
+}
+async function postTokenRequest(tokenUrl, params) {
+  const response = await fetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: params
+  });
+  if (response.ok) {
+    return { ok: true, json: await response.json() };
+  }
+  const raw = await response.text();
+  return { ok: false, status: response.status, raw, parsed: parseUpstreamOAuthError(raw) };
+}
+async function requestToken(tokenUrl, params, clientSecret, failureMessage) {
+  if (!clientSecret) {
+    return unwrapToken(await postTokenRequest(tokenUrl, params), failureMessage);
+  }
+  const withSecret = new URLSearchParams(params);
+  withSecret.append("client_secret", clientSecret);
+  let result = await postTokenRequest(tokenUrl, withSecret);
+  if (!result.ok && isPublicClientRejection(result.parsed)) {
+    logger.info(
+      "Upstream rejected client_secret as a public client (AADSTS700025) \u2014 retrying without it",
+      {
+        status: result.status,
+        error_codes: result.parsed?.error_codes,
+        correlation_id: result.parsed?.correlation_id
+      }
+    );
+    result = await postTokenRequest(tokenUrl, params);
+  }
+  return unwrapToken(result, failureMessage);
+}
+function unwrapToken(result, failureMessage) {
+  if (result.ok) {
+    return result.json;
+  }
+  if (result.parsed) {
+    logger.warn(`Token endpoint upstream OAuth error: ${result.parsed.error}`, {
+      status: result.status,
+      error: result.parsed.error,
+      suberror: result.parsed.suberror,
+      error_codes: result.parsed.error_codes,
+      correlation_id: result.parsed.correlation_id
+    });
+    throw new OAuthUpstreamError(result.status, result.raw, result.parsed);
+  }
+  logger.error(`${failureMessage}: ${result.raw}`);
+  throw new Error(`${failureMessage}: ${result.raw}`);
+}
 async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, tenantId = "common", codeVerifier, cloudType = "global") {
   const cloudEndpoints = getCloudEndpoints(cloudType);
   const params = new URLSearchParams({
@@ -122,36 +177,15 @@ async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, t
     redirect_uri: redirectUri,
     client_id: clientId
   });
-  if (clientSecret) {
-    params.append("client_secret", clientSecret);
-  }
   if (codeVerifier) {
     params.append("code_verifier", codeVerifier);
   }
-  const response = await fetch(`${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: params
-  });
-  if (!response.ok) {
-    const raw = await response.text();
-    const parsed = parseUpstreamOAuthError(raw);
-    if (parsed) {
-      logger.warn(`Token endpoint upstream OAuth error: ${parsed.error}`, {
-        status: response.status,
-        error: parsed.error,
-        suberror: parsed.suberror,
-        error_codes: parsed.error_codes,
-        correlation_id: parsed.correlation_id
-      });
-      throw new OAuthUpstreamError(response.status, raw, parsed);
-    }
-    logger.error(`Failed to exchange code for token: ${raw}`);
-    throw new Error(`Failed to exchange code for token: ${raw}`);
-  }
-  return response.json();
+  return requestToken(
+    `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`,
+    params,
+    clientSecret,
+    "Failed to exchange code for token"
+  );
 }
 async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId = "common", cloudType = "global") {
   const cloudEndpoints = getCloudEndpoints(cloudType);
@@ -160,33 +194,12 @@ async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId
     refresh_token: refreshToken,
     client_id: clientId
   });
-  if (clientSecret) {
-    params.append("client_secret", clientSecret);
-  }
-  const response = await fetch(`${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: params
-  });
-  if (!response.ok) {
-    const raw = await response.text();
-    const parsed = parseUpstreamOAuthError(raw);
-    if (parsed) {
-      logger.warn(`Token endpoint upstream OAuth error: ${parsed.error}`, {
-        status: response.status,
-        error: parsed.error,
-        suberror: parsed.suberror,
-        error_codes: parsed.error_codes,
-        correlation_id: parsed.correlation_id
-      });
-      throw new OAuthUpstreamError(response.status, raw, parsed);
-    }
-    logger.error(`Failed to refresh token: ${raw}`);
-    throw new Error(`Failed to refresh token: ${raw}`);
-  }
-  return response.json();
+  return requestToken(
+    `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`,
+    params,
+    clientSecret,
+    "Failed to refresh token"
+  );
 }
 export {
   OAuthUpstreamError,

package/dist/lib/select-projection.js

@@ -0,0 +1,82 @@
+function splitTopLevel(value) {
+  const parts = [];
+  let depth = 0;
+  let current = "";
+  for (const char of value) {
+    if (char === "(") depth++;
+    else if (char === ")") depth = Math.max(0, depth - 1);
+    if (char === "," && depth === 0) {
+      parts.push(current);
+      current = "";
+    } else {
+      current += char;
+    }
+  }
+  parts.push(current);
+  return parts;
+}
+function parseSelectFields(value) {
+  if (!value) return [];
+  return [
+    ...new Set(
+      splitTopLevel(value).map((field) => field.trim().split(/[/()]/)[0].trim()).filter(Boolean)
+    )
+  ];
+}
+function isAlwaysKept(key) {
+  return key.toLowerCase() === "id" || key.startsWith("@") || key.startsWith("_");
+}
+const TRANSPORT_OK_MESSAGE = "OK!";
+function isTransportEnvelope(data) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return false;
+  const body = data;
+  if (body.message === TRANSPORT_OK_MESSAGE) return true;
+  return body.success === true && Object.keys(body).length === 1;
+}
+function candidateObjects(data) {
+  if (Array.isArray(data)) return data.filter(isPlainObject);
+  if (!isPlainObject(data)) return [];
+  if (Array.isArray(data.value)) return data.value.filter(isPlainObject);
+  return [data];
+}
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function anyFieldPresent(data, fields) {
+  const checkable = fields.filter((field) => !isAlwaysKept(field));
+  if (checkable.length === 0) return true;
+  const wanted = new Set(checkable.map((field) => field.toLowerCase()));
+  const objects = candidateObjects(data);
+  if (objects.length === 0) return true;
+  return objects.some((item) => Object.keys(item).some((key) => wanted.has(key.toLowerCase())));
+}
+function projectObject(item, wanted) {
+  if (!isPlainObject(item)) return item;
+  const projected = {};
+  for (const [key, value] of Object.entries(item)) {
+    if (isAlwaysKept(key) || wanted.has(key.toLowerCase())) {
+      projected[key] = value;
+    }
+  }
+  return projected;
+}
+function projectSelectedFields(data, fields) {
+  if (fields.length === 0) return data;
+  if (!data || typeof data !== "object") return data;
+  const wanted = new Set(fields.map((field) => field.toLowerCase()));
+  if (Array.isArray(data)) {
+    return data.map((item) => projectObject(item, wanted));
+  }
+  const body = data;
+  if (Array.isArray(body.value)) {
+    return { ...body, value: body.value.map((item) => projectObject(item, wanted)) };
+  }
+  return projectObject(body, wanted);
+}
+export {
+  TRANSPORT_OK_MESSAGE,
+  anyFieldPresent,
+  isTransportEnvelope,
+  parseSelectFields,
+  projectSelectedFields
+};

package/dist/server.js

@@ -45,6 +45,7 @@ function parseHttpOption(httpOption) {
   const port = parseInt(httpString) || 3e3;
   return { host: void 0, port };
 }
+const PKCE_MAX_AGE_MS = 60 * 60 * 1e3;
 class MicrosoftGraphServer {
   constructor(authManager, options = {}) {
     this.version = "0.0.0";
@@ -318,17 +319,18 @@ class MicrosoftGraphServer {
             microsoftAuthUrl.searchParams.set(param, value);
           }
         });
-        if (clientCodeChallenge && state) {
-          const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
-          const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+        if (clientCodeChallenge) {
           const now = Date.now();
-          const maxAge = 10 * 60 * 1e3;
-          const maxEntries = 1e3;
           for (const [key, value] of this.pkceStore) {
-            if (now - value.createdAt > maxAge) {
+            if (now - value.createdAt > PKCE_MAX_AGE_MS || value.clientCodeChallenge === clientCodeChallenge) {
               this.pkceStore.delete(key);
             }
           }
+        }
+        if (clientCodeChallenge && state) {
+          const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
+          const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+          const maxEntries = 1e3;
           if (this.pkceStore.size >= maxEntries) {
             logger.warn(
               `PKCE store at capacity (${maxEntries} entries) \u2014 rejecting new authorization request`
@@ -341,7 +343,6 @@ class MicrosoftGraphServer {
           }
           this.pkceStore.set(state, {
             clientCodeChallenge,
-            clientCodeChallengeMethod: clientCodeChallengeMethod || "S256",
             serverCodeVerifier,
             createdAt: Date.now()
           });
@@ -405,14 +406,15 @@ class MicrosoftGraphServer {
               tenantId,
               hasClientSecret: !!clientSecret
             });
-            let serverCodeVerifier;
+            let matchedPkceState;
+            let matchedPkceEntry;
             if (body.code_verifier) {
               const clientVerifier = body.code_verifier;
               const clientChallengeComputed = crypto.createHash("sha256").update(clientVerifier).digest("base64url");
               for (const [state, pkceData] of this.pkceStore) {
                 if (pkceData.clientCodeChallenge === clientChallengeComputed) {
-                  serverCodeVerifier = pkceData.serverCodeVerifier;
-                  this.pkceStore.delete(state);
+                  matchedPkceState = state;
+                  matchedPkceEntry = pkceData;
                   logger.info("Two-leg PKCE: matched client verifier, using server verifier", {
                     state: state.substring(0, 8) + "..."
                   });
@@ -426,9 +428,12 @@ class MicrosoftGraphServer {
               clientId,
               clientSecret,
               tenantId,
-              serverCodeVerifier || body.code_verifier,
+              matchedPkceEntry?.serverCodeVerifier || body.code_verifier,
               this.secrets.cloudType
             );
+            if (matchedPkceState && this.pkceStore.get(matchedPkceState) === matchedPkceEntry) {
+              this.pkceStore.delete(matchedPkceState);
+            }
             res.json(result);
           } else if (body.grant_type === "refresh_token") {
             const tenantId = this.secrets?.tenantId || "common";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.149.1",
+  "version": "0.150.1",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json

@@ -2081,7 +2081,7 @@
     "toolName": "list-online-meetings",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access."
+    "llmTip": "Look up a meeting with $filter=JoinWebUrl eq '{url}', using the joinUrl from an event's onlineMeeting property. This filter is required: the collection cannot be listed or paged, and $search/$orderby are not supported. Without it Graph returns 400 InvalidArgument ('One of the required parameters to lookup meeting by QueryOptions is null or empty'). Returns the meeting ID needed for transcript access. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select=id,subject,joinWebUrl unless you need more."
   },
   {
     "pathPattern": "/me/onlineMeetings/{onlineMeeting-id}",
@@ -2089,7 +2089,7 @@
     "toolName": "get-online-meeting",
     "presets": ["teams", "work"],
     "workScopes": ["OnlineMeetings.Read"],
-    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID."
+    "llmTip": "Gets a specific online meeting by ID. Returns full details including subject, startDateTime, endDateTime, joinWebUrl, chatInfo (threadId for meeting chat), participants (organizer, attendees), lobbyBypassSettings, and videoTeleconferenceId. Use list-online-meetings first to find the meeting ID. The full meeting object is large and can include the invite HTML and the meeting passcode, so pass select with the fields you came here for, e.g. select=id,chatInfo,participants."
   },
   {
     "pathPattern": "/me/onlineMeetings",