@softeria/ms-365-mcp-server 0.150.0 → 0.150.1

package/dist/lib/microsoft-auth.js

@@ -114,6 +114,61 @@ function toOAuthErrorResponse(error) {
     }
   };
 }
+const PUBLIC_CLIENT_SECRET_REJECTED = 700025;
+function isPublicClientRejection(body) {
+  return Array.isArray(body?.error_codes) && body.error_codes.includes(PUBLIC_CLIENT_SECRET_REJECTED);
+}
+async function postTokenRequest(tokenUrl, params) {
+  const response = await fetch(tokenUrl, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: params
+  });
+  if (response.ok) {
+    return { ok: true, json: await response.json() };
+  }
+  const raw = await response.text();
+  return { ok: false, status: response.status, raw, parsed: parseUpstreamOAuthError(raw) };
+}
+async function requestToken(tokenUrl, params, clientSecret, failureMessage) {
+  if (!clientSecret) {
+    return unwrapToken(await postTokenRequest(tokenUrl, params), failureMessage);
+  }
+  const withSecret = new URLSearchParams(params);
+  withSecret.append("client_secret", clientSecret);
+  let result = await postTokenRequest(tokenUrl, withSecret);
+  if (!result.ok && isPublicClientRejection(result.parsed)) {
+    logger.info(
+      "Upstream rejected client_secret as a public client (AADSTS700025) \u2014 retrying without it",
+      {
+        status: result.status,
+        error_codes: result.parsed?.error_codes,
+        correlation_id: result.parsed?.correlation_id
+      }
+    );
+    result = await postTokenRequest(tokenUrl, params);
+  }
+  return unwrapToken(result, failureMessage);
+}
+function unwrapToken(result, failureMessage) {
+  if (result.ok) {
+    return result.json;
+  }
+  if (result.parsed) {
+    logger.warn(`Token endpoint upstream OAuth error: ${result.parsed.error}`, {
+      status: result.status,
+      error: result.parsed.error,
+      suberror: result.parsed.suberror,
+      error_codes: result.parsed.error_codes,
+      correlation_id: result.parsed.correlation_id
+    });
+    throw new OAuthUpstreamError(result.status, result.raw, result.parsed);
+  }
+  logger.error(`${failureMessage}: ${result.raw}`);
+  throw new Error(`${failureMessage}: ${result.raw}`);
+}
 async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, tenantId = "common", codeVerifier, cloudType = "global") {
   const cloudEndpoints = getCloudEndpoints(cloudType);
   const params = new URLSearchParams({
@@ -122,36 +177,15 @@ async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, t
     redirect_uri: redirectUri,
     client_id: clientId
   });
-  if (clientSecret) {
-    params.append("client_secret", clientSecret);
-  }
   if (codeVerifier) {
     params.append("code_verifier", codeVerifier);
   }
-  const response = await fetch(`${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: params
-  });
-  if (!response.ok) {
-    const raw = await response.text();
-    const parsed = parseUpstreamOAuthError(raw);
-    if (parsed) {
-      logger.warn(`Token endpoint upstream OAuth error: ${parsed.error}`, {
-        status: response.status,
-        error: parsed.error,
-        suberror: parsed.suberror,
-        error_codes: parsed.error_codes,
-        correlation_id: parsed.correlation_id
-      });
-      throw new OAuthUpstreamError(response.status, raw, parsed);
-    }
-    logger.error(`Failed to exchange code for token: ${raw}`);
-    throw new Error(`Failed to exchange code for token: ${raw}`);
-  }
-  return response.json();
+  return requestToken(
+    `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`,
+    params,
+    clientSecret,
+    "Failed to exchange code for token"
+  );
 }
 async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId = "common", cloudType = "global") {
   const cloudEndpoints = getCloudEndpoints(cloudType);
@@ -160,33 +194,12 @@ async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId
     refresh_token: refreshToken,
     client_id: clientId
   });
-  if (clientSecret) {
-    params.append("client_secret", clientSecret);
-  }
-  const response = await fetch(`${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: params
-  });
-  if (!response.ok) {
-    const raw = await response.text();
-    const parsed = parseUpstreamOAuthError(raw);
-    if (parsed) {
-      logger.warn(`Token endpoint upstream OAuth error: ${parsed.error}`, {
-        status: response.status,
-        error: parsed.error,
-        suberror: parsed.suberror,
-        error_codes: parsed.error_codes,
-        correlation_id: parsed.correlation_id
-      });
-      throw new OAuthUpstreamError(response.status, raw, parsed);
-    }
-    logger.error(`Failed to refresh token: ${raw}`);
-    throw new Error(`Failed to refresh token: ${raw}`);
-  }
-  return response.json();
+  return requestToken(
+    `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`,
+    params,
+    clientSecret,
+    "Failed to refresh token"
+  );
 }
 export {
   OAuthUpstreamError,

package/dist/server.js

@@ -45,6 +45,7 @@ function parseHttpOption(httpOption) {
   const port = parseInt(httpString) || 3e3;
   return { host: void 0, port };
 }
+const PKCE_MAX_AGE_MS = 60 * 60 * 1e3;
 class MicrosoftGraphServer {
   constructor(authManager, options = {}) {
     this.version = "0.0.0";
@@ -318,17 +319,18 @@ class MicrosoftGraphServer {
             microsoftAuthUrl.searchParams.set(param, value);
           }
         });
-        if (clientCodeChallenge && state) {
-          const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
-          const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+        if (clientCodeChallenge) {
           const now = Date.now();
-          const maxAge = 10 * 60 * 1e3;
-          const maxEntries = 1e3;
           for (const [key, value] of this.pkceStore) {
-            if (now - value.createdAt > maxAge) {
+            if (now - value.createdAt > PKCE_MAX_AGE_MS || value.clientCodeChallenge === clientCodeChallenge) {
               this.pkceStore.delete(key);
             }
           }
+        }
+        if (clientCodeChallenge && state) {
+          const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
+          const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+          const maxEntries = 1e3;
           if (this.pkceStore.size >= maxEntries) {
             logger.warn(
               `PKCE store at capacity (${maxEntries} entries) \u2014 rejecting new authorization request`
@@ -341,7 +343,6 @@ class MicrosoftGraphServer {
           }
           this.pkceStore.set(state, {
             clientCodeChallenge,
-            clientCodeChallengeMethod: clientCodeChallengeMethod || "S256",
             serverCodeVerifier,
             createdAt: Date.now()
           });
@@ -405,14 +406,15 @@ class MicrosoftGraphServer {
               tenantId,
               hasClientSecret: !!clientSecret
             });
-            let serverCodeVerifier;
+            let matchedPkceState;
+            let matchedPkceEntry;
             if (body.code_verifier) {
               const clientVerifier = body.code_verifier;
               const clientChallengeComputed = crypto.createHash("sha256").update(clientVerifier).digest("base64url");
               for (const [state, pkceData] of this.pkceStore) {
                 if (pkceData.clientCodeChallenge === clientChallengeComputed) {
-                  serverCodeVerifier = pkceData.serverCodeVerifier;
-                  this.pkceStore.delete(state);
+                  matchedPkceState = state;
+                  matchedPkceEntry = pkceData;
                   logger.info("Two-leg PKCE: matched client verifier, using server verifier", {
                     state: state.substring(0, 8) + "..."
                   });
@@ -426,9 +428,12 @@ class MicrosoftGraphServer {
               clientId,
               clientSecret,
               tenantId,
-              serverCodeVerifier || body.code_verifier,
+              matchedPkceEntry?.serverCodeVerifier || body.code_verifier,
               this.secrets.cloudType
             );
+            if (matchedPkceState && this.pkceStore.get(matchedPkceState) === matchedPkceEntry) {
+              this.pkceStore.delete(matchedPkceState);
+            }
             res.json(result);
           } else if (body.grant_type === "refresh_token") {
             const tenantId = this.secrets?.tenantId || "common";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.150.0",
+  "version": "0.150.1",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",