@softeria/ms-365-mcp-server 0.169.0 → 0.169.2

package/dist/attachment-route.js

@@ -46,6 +46,22 @@ function forceAttachment(header) {
   if (filename) return `attachment; filename=${filename}`;
   return "attachment";
 }
+const GENERIC_CONTENT_TYPES = /* @__PURE__ */ new Set(["application/octet-stream", "application/binary", ""]);
+const HEADER_SAFE_CHAR = /^[\t\x20-\x7e\x80-\xff]*$/;
+function dispositionForProbedName(name) {
+  const safe = name.replace(/[\r\n"\\]/g, "").replace(/[^\t\x20-\x7e\x80-\xff]/g, "").trim();
+  const extension = /(\.[A-Za-z0-9]{1,10})$/.exec(name)?.[1] ?? "";
+  const fallback = safe && safe !== extension ? safe : extension ? `attachment${extension}` : safe;
+  let value = `attachment; filename="${fallback || "attachment"}"`;
+  if (!HEADER_SAFE_CHAR.test(name)) {
+    const encoded = encodeURIComponent(name).replace(
+      /['()*]/g,
+      (char) => "%" + char.charCodeAt(0).toString(16).toUpperCase()
+    );
+    value += `; filename*=UTF-8''${encoded}`;
+  }
+  return value;
+}
 function refuse(res) {
   res.status(404).type("text/plain").send(NOT_FOUND_BODY);
 }
@@ -90,11 +106,18 @@ function createAttachmentHandler(deps) {
       return;
     }
     res.status(200);
-    res.setHeader("content-type", stream.contentType);
+    const probed = ticket.probedContentType && HEADER_SAFE_CHAR.test(ticket.probedContentType) ? ticket.probedContentType : void 0;
+    res.setHeader(
+      "content-type",
+      probed && GENERIC_CONTENT_TYPES.has(stream.contentType.split(";")[0].trim().toLowerCase()) ? probed : stream.contentType
+    );
     if (stream.contentLength !== null) {
       res.setHeader("content-length", String(stream.contentLength));
     }
-    res.setHeader("content-disposition", forceAttachment(stream.contentDisposition));
+    res.setHeader(
+      "content-disposition",
+      !stream.contentDisposition && ticket.probedName ? dispositionForProbedName(ticket.probedName) : forceAttachment(stream.contentDisposition)
+    );
     res.setHeader("cache-control", "no-store");
     res.setHeader("x-content-type-options", "nosniff");
     try {

package/dist/graph-tools.js

@@ -688,7 +688,23 @@ async function mintUploadUrl(target, name, contentType, accountParam, authManage
     ]
   };
 }
-async function mintDownloadUrl(target, accountParam, authManager) {
+const MAIL_EVENT_ATTACHMENT_VALUE = /^(?:\/me|\/users\/[^/]+|\/groups\/[^/]+)\/(?:messages|events)\/[^/]+\/attachments\/[^/]+\/\$value$/;
+async function probeAttachment(target, graphClient, accessToken) {
+  if (!MAIL_EVENT_ATTACHMENT_VALUE.test(target)) return {};
+  try {
+    const meta = await graphClient.makeRequest(
+      `${target.slice(0, -"/$value".length)}?$select=name,contentType`,
+      { accessToken }
+    );
+    return {
+      ...typeof meta?.contentType === "string" && { probedContentType: meta.contentType },
+      ...typeof meta?.name === "string" && { probedName: meta.name }
+    };
+  } catch {
+    return {};
+  }
+}
+async function mintDownloadUrl(target, accountParam, authManager, probeWith) {
   const minting = getAttachmentMinting();
   if (!minting) return null;
   const identityFromRequest = Boolean(authManager?.isOAuthModeEnabled() || getRequestTokens());
@@ -726,9 +742,14 @@ async function mintDownloadUrl(target, accountParam, authManager) {
       isError: true
     };
   }
+  const probe = probeWith ? await probeAttachment(
+    target,
+    probeWith,
+    requestToken ?? await authManager?.getTokenForAccount(accountParam).catch(() => void 0)
+  ) : {};
   let ticket;
   try {
-    ticket = requestToken ? minting.store.mintWithToken(target, requestToken) : minting.store.mint(target, accountParam);
+    ticket = requestToken ? minting.store.mintWithToken(target, requestToken, void 0, probe) : minting.store.mint(target, accountParam, void 0, probe);
   } catch (error) {
     if (error instanceof TicketStoreFullError) {
       return {
@@ -1380,7 +1401,7 @@ const UTILITY_TOOLS = [
             isError: true
           };
         }
-        const minted = await mintDownloadUrl(pathPart, accountParam, authManager);
+        const minted = await mintDownloadUrl(pathPart, accountParam, authManager, graphClient);
         if (minted) return minted;
         return {
           content: [

package/dist/lib/attachment-tickets.js

@@ -65,13 +65,19 @@ class AttachmentTicketStore {
     return { id, expiresAtMs };
   }
   /** Mint a ticket redeemed with this server's own token for `accountName`. */
-  mint(target, accountName, nowMs = Date.now()) {
-    return this.add(target, { kind: "server-account", accountName }, nowMs);
+  mint(target, accountName, nowMs = Date.now(), probe = {}) {
+    return this.add(target, { kind: "server-account", accountName }, nowMs, {
+      purpose: "download",
+      ...probe
+    });
   }
   /** Mint a ticket redeemed with `accessToken` and nothing else. */
-  mintWithToken(target, accessToken, nowMs = Date.now()) {
+  mintWithToken(target, accessToken, nowMs = Date.now(), probe = {}) {
     if (!accessToken) throw new Error("A request-token ticket needs a token");
-    return this.add(target, { kind: "request-token", accessToken }, nowMs);
+    return this.add(target, { kind: "request-token", accessToken }, nowMs, {
+      purpose: "download",
+      ...probe
+    });
   }
   /** Mint an upload ticket attached as this server's own token for `accountName`. */
   mintUpload(target, accountName, upload, nowMs = Date.now()) {

package/dist/lib/obo-access.js

@@ -35,7 +35,7 @@ const ASSERTION_ERROR_CODES = /* @__PURE__ */ new Set([
   "consent_required",
   "login_required"
 ]);
-const ASSERTION_AADSTS = /\bAADSTS(50013|500133|50027|50173|700082|65001|50076|50079)\b/;
+const ASSERTION_AADSTS = /\bAADSTS(50013|500133|50027|50173|700082|65001|50076|50079|5002723)\b/;
 function isRejectedAssertion(error) {
   if (!error || typeof error !== "object") return false;
   const e = error;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.169.0",
+  "version": "0.169.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",