@softeria/ms-365-mcp-server 0.165.0 → 0.166.0

package/README.md

@@ -735,6 +735,7 @@ Environment variables:
 - `MS365_MCP_BLOB_OUTPUT=true|1`: File download tools (`download-bytes`, `get-mail-message-mime`, `get-shared-mailbox-message-mime`, `get-mail-attachment-content`, `get-shared-mailbox-attachment-content`) answer a short JSON text block (`name`, `contentType`, `size`) and an MCP `EmbeddedResource` with `BlobResourceContents` (`uri`, `mimeType`, `blob`) instead of base64 JSON in text. The `uri`'s last segment is the optional `fileName` argument. Default: off. Alternative to the --blob-output flag.
 - `MS365_MCP_BLOB_MAX_BYTES=<n>`: With blob output on, the largest file a download tool reads (positive integer, default `5242880`). The server stops reading past it and answers an error naming the limit.
 - `MS365_MCP_BODY_FORMAT=html`: Return email bodies as HTML instead of plain text (default: text)
+- `MS365_MCP_OBO_ALLOWED_TENANTS=<ids>` / `MS365_MCP_OBO_ALLOWED_USERS=<ids>`: With `--obo`, only callers whose token `tid` (tenant id) / `oid` (user object id) is listed may use the server; others get 403 before any On-Behalf-Of exchange. Comma or space separated; unset = everyone. The claims are read without verifying the signature, which Entra verifies during the exchange, so a token that lies about them still gets no Graph token. A token Entra rejects at the exchange (bad signature, expired, wrong audience, consent needed) gets 401 with a `WWW-Authenticate` challenge so the client signs in again
 - `MS365_MCP_MESSAGE_SIGNOFF_PREFIX=<text>`: Signoff prepended to outgoing messages so recipients can tell they were agent-sent, e.g. `🤖`. Default: none. CLI equivalent: `--message-signoff-prefix <text>` (see Message Signoff below)
 - `MS365_MCP_MESSAGE_SIGNOFF_SUFFIX=<text>`: Signoff appended to outgoing messages. Default: none. CLI equivalent: `--message-signoff-suffix <text>`. `--no-message-signoff` disables both (see Message Signoff below)
 - `MS365_MCP_RATE_LIMIT_DISABLED=true|1`: Disable per-IP rate limiting in HTTP mode (default: enabled — 30 req/min on `/authorize`, `/token`, `/register`; 120 req/min on `/mcp`)

package/dist/lib/microsoft-auth.js

@@ -209,6 +209,7 @@ async function refreshAccessToken(refreshToken, clientId, clientSecret, tenantId
 }
 export {
   OAuthUpstreamError,
+  buildWwwAuthenticate,
   exchangeCodeForToken,
   microsoftBearerTokenAuthMiddleware,
   refreshAccessToken,

package/dist/lib/obo-access.js

@@ -0,0 +1,50 @@
+const splitList = (raw) => (raw ?? "").split(/[\s,]+/).map((s) => s.trim().toLowerCase()).filter(Boolean);
+function readOboAllowlist(env = process.env) {
+  return {
+    tenants: new Set(splitList(env.MS365_MCP_OBO_ALLOWED_TENANTS)),
+    users: new Set(splitList(env.MS365_MCP_OBO_ALLOWED_USERS))
+  };
+}
+function readClaims(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return void 0;
+  try {
+    const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+    return claims && typeof claims === "object" ? claims : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function oboAllowlistRefusal(token, allow) {
+  if (allow.tenants.size === 0 && allow.users.size === 0) return void 0;
+  const claims = readClaims(token);
+  if (!claims) return "The access token is not a JWT, so its tenant and user cannot be checked.";
+  const tid = typeof claims.tid === "string" ? claims.tid.toLowerCase() : "";
+  const oid = typeof claims.oid === "string" ? claims.oid.toLowerCase() : "";
+  if (allow.tenants.size > 0 && !allow.tenants.has(tid)) {
+    return "The caller's tenant is not allowed on this server.";
+  }
+  if (allow.users.size > 0 && !allow.users.has(oid)) {
+    return "The caller is not allowed on this server.";
+  }
+  return void 0;
+}
+const ASSERTION_ERROR_CODES = /* @__PURE__ */ new Set([
+  "invalid_grant",
+  "interaction_required",
+  "consent_required",
+  "login_required"
+]);
+const ASSERTION_AADSTS = /\bAADSTS(50013|500133|50027|50173|700082|65001|50076|50079)\b/;
+function isRejectedAssertion(error) {
+  if (!error || typeof error !== "object") return false;
+  const e = error;
+  if (typeof e.errorCode === "string" && ASSERTION_ERROR_CODES.has(e.errorCode)) return true;
+  const text = `${typeof e.errorMessage === "string" ? e.errorMessage : ""} ${typeof e.message === "string" ? e.message : ""}`;
+  return ASSERTION_AADSTS.test(text);
+}
+export {
+  isRejectedAssertion,
+  oboAllowlistRefusal,
+  readOboAllowlist
+};

package/dist/server.js

@@ -25,6 +25,7 @@ import { ATTACHMENT_ROUTE, loadAttachmentUrlConfig } from "./lib/attachment-url-
 import {
   exchangeCodeForToken,
   microsoftBearerTokenAuthMiddleware,
+  buildWwwAuthenticate,
   OAuthUpstreamError,
   refreshAccessToken,
   toOAuthErrorResponse
@@ -35,6 +36,7 @@ import { buildMcpServerInstructions } from "./mcp-instructions.js";
 import { installToolSchemaRefNormalization } from "./normalize-tool-schema.js";
 import { MicrosoftOAuthProvider } from "./oauth-provider.js";
 import OboClient from "./obo-client.js";
+import { isRejectedAssertion, oboAllowlistRefusal, readOboAllowlist } from "./lib/obo-access.js";
 import { requestContext } from "./request-context.js";
 import { getSecrets } from "./secrets.js";
 const LOOPBACK_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]"];
@@ -636,6 +638,12 @@ class MicrosoftGraphServer {
           issuerUrl: new URL(publicBase ?? `http://localhost:${port}`)
         })
       );
+      const oboAllowlist = this.oboClient ? readOboAllowlist() : null;
+      if (oboAllowlist && (oboAllowlist.tenants.size > 0 || oboAllowlist.users.size > 0)) {
+        logger.info(
+          `OBO allowlist: ${oboAllowlist.tenants.size} tenant(s), ${oboAllowlist.users.size} user(s)`
+        );
+      }
       const mcpAuth = microsoftBearerTokenAuthMiddleware({
         trustProxyAuth: this.options.trustProxyAuth,
         allowUnauthenticatedDiscovery: this.options.allowUnauthenticatedDiscovery,
@@ -674,7 +682,23 @@ class MicrosoftGraphServer {
             if (req.microsoftAuth) {
               let accessToken = req.microsoftAuth.accessToken;
               if (this.oboClient) {
-                accessToken = await this.oboClient.exchangeToken(accessToken);
+                const refusal = oboAllowlist && oboAllowlistRefusal(accessToken, oboAllowlist);
+                if (refusal) {
+                  logger.warn(`OBO caller refused by the allowlist: ${refusal}`);
+                  res.status(403).json({ error: "access_denied", error_description: refusal });
+                  return;
+                }
+                try {
+                  accessToken = await this.oboClient.exchangeToken(accessToken);
+                } catch (error) {
+                  if (!isRejectedAssertion(error)) throw error;
+                  const description = "The access token was rejected; sign in again";
+                  res.status(401).set(
+                    "WWW-Authenticate",
+                    buildWwwAuthenticate(req, "invalid_token", description, publicBase)
+                  ).json({ error: "invalid_token", error_description: description });
+                  return;
+                }
               }
               await requestContext.run({ accessToken }, handler);
             } else {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.165.0",
+  "version": "0.166.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",