npm - @softeria/ms-365-mcp-server - Versions diffs - 0.63.0 → 0.63.2 - Mend

@softeria/ms-365-mcp-server 0.63.0 → 0.63.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/endpoints.json CHANGED Viewed

@@ -398,7 +398,7 @@
   {
     "pathPattern": "/drives/{drive-id}/root",
     "method": "get",
-    "toolName": "get-root-folder",
+    "toolName": "get-drive-root-item",
     "scopes": ["Files.Read"]
   },
   {
@@ -571,14 +571,6 @@
     "contentType": "text/html",
     "llmTip": "Body must be a full HTML document (with <html><head><title>...</title></head><body>...</body></html>). Partial HTML fails silently."
   },
-  {
-    "pathPattern": "/me/onenote/pages/{onenotePage-id}/content",
-    "method": "patch",
-    "toolName": "update-onenote-page",
-    "scopes": ["Notes.ReadWrite"],
-    "contentType": "application/json",
-    "llmTip": "Updates page content using PATCH commands. Body is an array of patch actions: [{ target: 'body', action: 'append', content: '<p>New content</p>' }]. Actions: 'append' (add to end), 'replace' (replace target), 'insert' (insert after target). Target can be 'body', 'title', or a specific element ID."
-  },
   {
     "pathPattern": "/me/onenote/pages/{onenotePage-id}",
     "method": "delete",

package/dist/server.js CHANGED Viewed

@@ -17,6 +17,7 @@ import {
 import { getSecrets } from "./secrets.js";
 import { getCloudEndpoints } from "./cloud-config.js";
 import { requestContext } from "./request-context.js";
+import crypto from "node:crypto";
 function parseHttpOption(httpOption) {
   if (typeof httpOption === "boolean") {
     return { host: void 0, port: 3e3 };
@@ -36,6 +37,8 @@ class MicrosoftGraphServer {
     this.version = "0.0.0";
     this.multiAccount = false;
     this.accountNames = [];
+    // Two-leg PKCE: stores client's code_challenge and server's code_verifier, keyed by OAuth state
+    this.pkceStore = /* @__PURE__ */ new Map();
     this.authManager = authManager;
     this.options = options;
     this.graphClient = null;
@@ -189,14 +192,15 @@ class MicrosoftGraphServer {
         const microsoftAuthUrl = new URL(
           `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/authorize`
         );
+        const clientCodeChallenge = url.searchParams.get("code_challenge");
+        const clientCodeChallengeMethod = url.searchParams.get("code_challenge_method");
+        const state = url.searchParams.get("state");
         const allowedParams = [
           "response_type",
           "redirect_uri",
           "scope",
           "state",
           "response_mode",
-          "code_challenge",
-          "code_challenge_method",
           "prompt",
           "login_hint",
           "domain_hint"
@@ -207,6 +211,32 @@ class MicrosoftGraphServer {
             microsoftAuthUrl.searchParams.set(param, value);
           }
         });
+        if (clientCodeChallenge && state) {
+          const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
+          const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+          this.pkceStore.set(state, {
+            clientCodeChallenge,
+            clientCodeChallengeMethod: clientCodeChallengeMethod || "S256",
+            serverCodeVerifier,
+            createdAt: Date.now()
+          });
+          const now = Date.now();
+          for (const [key, value] of this.pkceStore) {
+            if (now - value.createdAt > 10 * 60 * 1e3) {
+              this.pkceStore.delete(key);
+            }
+          }
+          microsoftAuthUrl.searchParams.set("code_challenge", serverCodeChallenge);
+          microsoftAuthUrl.searchParams.set("code_challenge_method", "S256");
+          logger.info("Two-leg PKCE: stored client challenge, generated server challenge", {
+            state: state.substring(0, 8) + "..."
+          });
+        } else if (clientCodeChallenge) {
+          microsoftAuthUrl.searchParams.set("code_challenge", clientCodeChallenge);
+          if (clientCodeChallengeMethod) {
+            microsoftAuthUrl.searchParams.set("code_challenge_method", clientCodeChallengeMethod);
+          }
+        }
         microsoftAuthUrl.searchParams.set("client_id", clientId);
         if (!microsoftAuthUrl.searchParams.get("scope")) {
           microsoftAuthUrl.searchParams.set("scope", "User.Read Files.Read Mail.Read");
@@ -250,13 +280,28 @@ class MicrosoftGraphServer {
               tenantId,
               hasClientSecret: !!clientSecret
             });
+            let serverCodeVerifier;
+            if (body.code_verifier) {
+              const clientVerifier = body.code_verifier;
+              const clientChallengeComputed = crypto.createHash("sha256").update(clientVerifier).digest("base64url");
+              for (const [state, pkceData] of this.pkceStore) {
+                if (pkceData.clientCodeChallenge === clientChallengeComputed) {
+                  serverCodeVerifier = pkceData.serverCodeVerifier;
+                  this.pkceStore.delete(state);
+                  logger.info("Two-leg PKCE: matched client verifier, using server verifier", {
+                    state: state.substring(0, 8) + "..."
+                  });
+                  break;
+                }
+              }
+            }
             const result = await exchangeCodeForToken(
               body.code,
               body.redirect_uri,
               clientId,
               clientSecret,
               tenantId,
-              body.code_verifier,
+              serverCodeVerifier || body.code_verifier,
               this.secrets.cloudType
             );
             res.json(result);

package/logs/mcp-server.log CHANGED Viewed

@@ -1,10 +1,10 @@
-2026-04-05 07:58:04 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 07:58:04 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 07:58:04 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 07:58:04 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
-2026-04-05 07:58:04 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
-2026-04-05 07:58:05 INFO: Using environment variables for secrets
-2026-04-05 07:58:05 INFO: Using environment variables for secrets
-2026-04-05 07:58:05 INFO: Using environment variables for secrets
-2026-04-05 07:58:05 INFO: Using environment variables for secrets
-2026-04-05 07:58:05 INFO: Using environment variables for secrets
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.63.0",
+  "version": "0.63.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",

package/src/endpoints.json CHANGED Viewed

@@ -398,7 +398,7 @@
   {
     "pathPattern": "/drives/{drive-id}/root",
     "method": "get",
-    "toolName": "get-root-folder",
+    "toolName": "get-drive-root-item",
     "scopes": ["Files.Read"]
   },
   {
@@ -571,14 +571,6 @@
     "contentType": "text/html",
     "llmTip": "Body must be a full HTML document (with <html><head><title>...</title></head><body>...</body></html>). Partial HTML fails silently."
   },
-  {
-    "pathPattern": "/me/onenote/pages/{onenotePage-id}/content",
-    "method": "patch",
-    "toolName": "update-onenote-page",
-    "scopes": ["Notes.ReadWrite"],
-    "contentType": "application/json",
-    "llmTip": "Updates page content using PATCH commands. Body is an array of patch actions: [{ target: 'body', action: 'append', content: '<p>New content</p>' }]. Actions: 'append' (add to end), 'replace' (replace target), 'insert' (insert after target). Target can be 'body', 'title', or a specific element ID."
-  },
   {
     "pathPattern": "/me/onenote/pages/{onenotePage-id}",
     "method": "delete",