@softeria/ms-365-mcp-server 0.157.0 → 0.157.1

package/dist/lib/microsoft-auth.js

@@ -169,7 +169,7 @@ function unwrapToken(result, failureMessage) {
   logger.error(`${failureMessage}: ${result.raw}`);
   throw new Error(`${failureMessage}: ${result.raw}`);
 }
-async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, tenantId = "common", codeVerifier, cloudType = "global") {
+async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, tenantId = "common", codeVerifier, cloudType = "global", scope) {
   const cloudEndpoints = getCloudEndpoints(cloudType);
   const params = new URLSearchParams({
     grant_type: "authorization_code",
@@ -180,6 +180,9 @@ async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, t
   if (codeVerifier) {
     params.append("code_verifier", codeVerifier);
   }
+  if (scope) {
+    params.append("scope", scope);
+  }
   return requestToken(
     `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`,
     params,
@@ -187,13 +190,16 @@ async function exchangeCodeForToken(code, redirectUri, clientId, clientSecret, t
     "Failed to exchange code for token"
   );
 }
-async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId = "common", cloudType = "global") {
+async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId = "common", cloudType = "global", scope) {
   const cloudEndpoints = getCloudEndpoints(cloudType);
   const params = new URLSearchParams({
     grant_type: "refresh_token",
     refresh_token: refreshToken,
     client_id: clientId
   });
+  if (scope) {
+    params.append("scope", scope);
+  }
   return requestToken(
     `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/token`,
     params,

package/dist/server.js

@@ -217,6 +217,17 @@ class MicrosoftGraphServer {
     installToolSchemaRefNormalization(server);
     return server;
   }
+  /**
+   * Under --obo the token Entra issues to the MCP client is for this app
+   * itself (`<clientId>/access_as_user`). Personal Microsoft accounts refuse
+   * to redeem a code or refresh token for that audience unless the request
+   * names the scope (AADSTS70011), so both /token grants send it in OBO mode.
+   * Outside OBO the request is unchanged.
+   */
+  oboRedemptionScope() {
+    if (!this.options.obo || !this.secrets?.clientId) return void 0;
+    return `${this.secrets.clientId}/access_as_user offline_access`;
+  }
   async initialize(version) {
     this.secrets = await getSecrets();
     this.version = version;
@@ -582,7 +593,8 @@ class MicrosoftGraphServer {
               clientSecret,
               tenantId,
               matchedPkceEntry?.serverCodeVerifier || body.code_verifier,
-              this.secrets.cloudType
+              this.secrets.cloudType,
+              this.oboRedemptionScope()
             );
             if (matchedPkceState && this.pkceStore.get(matchedPkceState) === matchedPkceEntry) {
               this.pkceStore.delete(matchedPkceState);
@@ -602,7 +614,8 @@ class MicrosoftGraphServer {
               clientId,
               clientSecret,
               tenantId,
-              this.secrets.cloudType
+              this.secrets.cloudType,
+              this.oboRedemptionScope()
             );
             res.json(result);
           } else {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.157.0",
+  "version": "0.157.1",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",