@softeria/ms-365-mcp-server 0.169.1 → 0.169.3

package/dist/attachment-route.js

@@ -46,6 +46,22 @@ function forceAttachment(header) {
   if (filename) return `attachment; filename=${filename}`;
   return "attachment";
 }
+const GENERIC_CONTENT_TYPES = /* @__PURE__ */ new Set(["application/octet-stream", "application/binary", ""]);
+const HEADER_SAFE_CHAR = /^[\t\x20-\x7e\x80-\xff]*$/;
+function dispositionForProbedName(name) {
+  const safe = name.replace(/[\r\n"\\]/g, "").replace(/[^\t\x20-\x7e\x80-\xff]/g, "").trim();
+  const extension = /(\.[A-Za-z0-9]{1,10})$/.exec(name)?.[1] ?? "";
+  const fallback = safe && safe !== extension ? safe : extension ? `attachment${extension}` : safe;
+  let value = `attachment; filename="${fallback || "attachment"}"`;
+  if (!HEADER_SAFE_CHAR.test(name)) {
+    const encoded = encodeURIComponent(name).replace(
+      /['()*]/g,
+      (char) => "%" + char.charCodeAt(0).toString(16).toUpperCase()
+    );
+    value += `; filename*=UTF-8''${encoded}`;
+  }
+  return value;
+}
 function refuse(res) {
   res.status(404).type("text/plain").send(NOT_FOUND_BODY);
 }
@@ -90,11 +106,18 @@ function createAttachmentHandler(deps) {
       return;
     }
     res.status(200);
-    res.setHeader("content-type", stream.contentType);
+    const probed = ticket.probedContentType && HEADER_SAFE_CHAR.test(ticket.probedContentType) ? ticket.probedContentType : void 0;
+    res.setHeader(
+      "content-type",
+      probed && GENERIC_CONTENT_TYPES.has(stream.contentType.split(";")[0].trim().toLowerCase()) ? probed : stream.contentType
+    );
     if (stream.contentLength !== null) {
       res.setHeader("content-length", String(stream.contentLength));
     }
-    res.setHeader("content-disposition", forceAttachment(stream.contentDisposition));
+    res.setHeader(
+      "content-disposition",
+      !stream.contentDisposition && ticket.probedName ? dispositionForProbedName(ticket.probedName) : forceAttachment(stream.contentDisposition)
+    );
     res.setHeader("cache-control", "no-store");
     res.setHeader("x-content-type-options", "nosniff");
     try {

package/dist/graph-tools.js

@@ -688,7 +688,23 @@ async function mintUploadUrl(target, name, contentType, accountParam, authManage
     ]
   };
 }
-async function mintDownloadUrl(target, accountParam, authManager) {
+const MAIL_EVENT_ATTACHMENT_VALUE = /^(?:\/me|\/users\/[^/]+|\/groups\/[^/]+)\/(?:messages|events)\/[^/]+\/attachments\/[^/]+\/\$value$/;
+async function probeAttachment(target, graphClient, accessToken) {
+  if (!MAIL_EVENT_ATTACHMENT_VALUE.test(target)) return {};
+  try {
+    const meta = await graphClient.makeRequest(
+      `${target.slice(0, -"/$value".length)}?$select=name,contentType`,
+      { accessToken }
+    );
+    return {
+      ...typeof meta?.contentType === "string" && { probedContentType: meta.contentType },
+      ...typeof meta?.name === "string" && { probedName: meta.name }
+    };
+  } catch {
+    return {};
+  }
+}
+async function mintDownloadUrl(target, accountParam, authManager, probeWith) {
   const minting = getAttachmentMinting();
   if (!minting) return null;
   const identityFromRequest = Boolean(authManager?.isOAuthModeEnabled() || getRequestTokens());
@@ -726,9 +742,14 @@ async function mintDownloadUrl(target, accountParam, authManager) {
       isError: true
     };
   }
+  const probe = probeWith ? await probeAttachment(
+    target,
+    probeWith,
+    requestToken ?? await authManager?.getTokenForAccount(accountParam).catch(() => void 0)
+  ) : {};
   let ticket;
   try {
-    ticket = requestToken ? minting.store.mintWithToken(target, requestToken) : minting.store.mint(target, accountParam);
+    ticket = requestToken ? minting.store.mintWithToken(target, requestToken, void 0, probe) : minting.store.mint(target, accountParam, void 0, probe);
   } catch (error) {
     if (error instanceof TicketStoreFullError) {
       return {
@@ -1380,7 +1401,7 @@ const UTILITY_TOOLS = [
             isError: true
           };
         }
-        const minted = await mintDownloadUrl(pathPart, accountParam, authManager);
+        const minted = await mintDownloadUrl(pathPart, accountParam, authManager, graphClient);
         if (minted) return minted;
         return {
           content: [

package/dist/lib/attachment-tickets.js

@@ -65,13 +65,19 @@ class AttachmentTicketStore {
     return { id, expiresAtMs };
   }
   /** Mint a ticket redeemed with this server's own token for `accountName`. */
-  mint(target, accountName, nowMs = Date.now()) {
-    return this.add(target, { kind: "server-account", accountName }, nowMs);
+  mint(target, accountName, nowMs = Date.now(), probe = {}) {
+    return this.add(target, { kind: "server-account", accountName }, nowMs, {
+      purpose: "download",
+      ...probe
+    });
   }
   /** Mint a ticket redeemed with `accessToken` and nothing else. */
-  mintWithToken(target, accessToken, nowMs = Date.now()) {
+  mintWithToken(target, accessToken, nowMs = Date.now(), probe = {}) {
     if (!accessToken) throw new Error("A request-token ticket needs a token");
-    return this.add(target, { kind: "request-token", accessToken }, nowMs);
+    return this.add(target, { kind: "request-token", accessToken }, nowMs, {
+      purpose: "download",
+      ...probe
+    });
   }
   /** Mint an upload ticket attached as this server's own token for `accountName`. */
   mintUpload(target, accountName, upload, nowMs = Date.now()) {

package/dist/lib/user-field-policy.js

@@ -3,10 +3,29 @@ const USER_ENTITY_PATH = /^\/users(?:\/[^/]+)?\/?$/i;
 const DIRECTORY_NAVIGATION_PATH = /^(?:\/me|\/users\/[^/]+)\/(?:manager|directReports)\/?$|^\/groups\/[^/]+\/(?:members|owners)\/?$/i;
 const EXPAND_USER_PATH = /^\/me\/?$|^\/groups(?:\/[^/]+)?\/?$/i;
 function normalizePath(path) {
-  const withoutQuery = path.split("?")[0];
+  let withoutQuery = path.split("?")[0];
+  for (let i = 0; i < 4; i++) {
+    const next = withoutQuery.replace(
+      /%([0-9a-f]{2})/gi,
+      (_, hex) => String.fromCharCode(parseInt(hex, 16))
+    );
+    if (next === withoutQuery) break;
+    withoutQuery = next;
+  }
   return withoutQuery.startsWith("/") ? withoutQuery : `/${withoutQuery}`;
 }
+const ENCODED_SEPARATOR = /%(?:25)*(?:2f|5c)/i;
+function deleteOdataOption(params, name) {
+  const values = [];
+  for (const key of [...new Set(params.keys())]) {
+    if (key.replace(/^\$/, "").toLowerCase() !== name) continue;
+    values.push(...params.getAll(key));
+    params.delete(key);
+  }
+  return values;
+}
 function userFieldEnforcement(path) {
+  if (ENCODED_SEPARATOR.test(path.split("?")[0])) return "request-and-response";
   const normalized = normalizePath(path);
   if (USER_ENTITY_PATH.test(normalized)) return "request-and-response";
   if (DIRECTORY_NAVIGATION_PATH.test(normalized)) return "response-only";
@@ -23,8 +42,7 @@ function stripUserFieldExpandFromUrl(url) {
   const [path, query = ""] = url.split("?");
   if (!shouldStripUserFieldExpand(path) || query === "") return url;
   const params = new URLSearchParams(query);
-  if (!params.has("$expand")) return url;
-  params.delete("$expand");
+  if (deleteOdataOption(params, "expand").length === 0) return url;
   const rebuilt = params.toString();
   if (rebuilt === "") return path;
   return `${path}?${rebuilt.replace(/%24/gi, "$").replace(/%2C/gi, ",")}`;
@@ -46,14 +64,15 @@ function restrictUserFieldQuery(queryParams, allowlist, enforcement) {
 function restrictUserFieldUrl(url, allowlist, enforcement) {
   const [path, query = ""] = url.split("?");
   const params = new URLSearchParams(query);
+  const requested = enforcement === "request-and-response" ? deleteOdataOption(params, "select") : params.getAll("$select");
   const fields = effectiveUserFields(
-    parseSelectFields(params.get("$select") ?? void 0),
+    parseSelectFields(requested.join(",") || void 0),
     allowlist
   );
   if (enforcement === "request-and-response") {
     params.set("$select", fields.join(","));
   }
-  params.delete("$expand");
+  deleteOdataOption(params, "expand");
   const rebuilt = params.toString();
   if (rebuilt === "") return { url: path, fields };
   return { url: `${path}?${rebuilt.replace(/%24/gi, "$").replace(/%2C/gi, ",")}`, fields };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.169.1",
+  "version": "0.169.3",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",