@softeria/ms-365-mcp-server 0.169.2 → 0.169.3

package/dist/lib/user-field-policy.js

@@ -3,10 +3,29 @@ const USER_ENTITY_PATH = /^\/users(?:\/[^/]+)?\/?$/i;
 const DIRECTORY_NAVIGATION_PATH = /^(?:\/me|\/users\/[^/]+)\/(?:manager|directReports)\/?$|^\/groups\/[^/]+\/(?:members|owners)\/?$/i;
 const EXPAND_USER_PATH = /^\/me\/?$|^\/groups(?:\/[^/]+)?\/?$/i;
 function normalizePath(path) {
-  const withoutQuery = path.split("?")[0];
+  let withoutQuery = path.split("?")[0];
+  for (let i = 0; i < 4; i++) {
+    const next = withoutQuery.replace(
+      /%([0-9a-f]{2})/gi,
+      (_, hex) => String.fromCharCode(parseInt(hex, 16))
+    );
+    if (next === withoutQuery) break;
+    withoutQuery = next;
+  }
   return withoutQuery.startsWith("/") ? withoutQuery : `/${withoutQuery}`;
 }
+const ENCODED_SEPARATOR = /%(?:25)*(?:2f|5c)/i;
+function deleteOdataOption(params, name) {
+  const values = [];
+  for (const key of [...new Set(params.keys())]) {
+    if (key.replace(/^\$/, "").toLowerCase() !== name) continue;
+    values.push(...params.getAll(key));
+    params.delete(key);
+  }
+  return values;
+}
 function userFieldEnforcement(path) {
+  if (ENCODED_SEPARATOR.test(path.split("?")[0])) return "request-and-response";
   const normalized = normalizePath(path);
   if (USER_ENTITY_PATH.test(normalized)) return "request-and-response";
   if (DIRECTORY_NAVIGATION_PATH.test(normalized)) return "response-only";
@@ -23,8 +42,7 @@ function stripUserFieldExpandFromUrl(url) {
   const [path, query = ""] = url.split("?");
   if (!shouldStripUserFieldExpand(path) || query === "") return url;
   const params = new URLSearchParams(query);
-  if (!params.has("$expand")) return url;
-  params.delete("$expand");
+  if (deleteOdataOption(params, "expand").length === 0) return url;
   const rebuilt = params.toString();
   if (rebuilt === "") return path;
   return `${path}?${rebuilt.replace(/%24/gi, "$").replace(/%2C/gi, ",")}`;
@@ -46,14 +64,15 @@ function restrictUserFieldQuery(queryParams, allowlist, enforcement) {
 function restrictUserFieldUrl(url, allowlist, enforcement) {
   const [path, query = ""] = url.split("?");
   const params = new URLSearchParams(query);
+  const requested = enforcement === "request-and-response" ? deleteOdataOption(params, "select") : params.getAll("$select");
   const fields = effectiveUserFields(
-    parseSelectFields(params.get("$select") ?? void 0),
+    parseSelectFields(requested.join(",") || void 0),
     allowlist
   );
   if (enforcement === "request-and-response") {
     params.set("$select", fields.join(","));
   }
-  params.delete("$expand");
+  deleteOdataOption(params, "expand");
   const rebuilt = params.toString();
   if (rebuilt === "") return { url: path, fields };
   return { url: `${path}?${rebuilt.replace(/%24/gi, "$").replace(/%2C/gi, ",")}`, fields };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@softeria/ms-365-mcp-server",
   "mcpName": "io.github.Softeria/ms-365-mcp-server",
-  "version": "0.169.2",
+  "version": "0.169.3",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",