@softeria/ms-365-mcp-server 0.63.1 → 0.63.2

package/dist/server.js

@@ -17,6 +17,7 @@ import {
 import { getSecrets } from "./secrets.js";
 import { getCloudEndpoints } from "./cloud-config.js";
 import { requestContext } from "./request-context.js";
+import crypto from "node:crypto";
 function parseHttpOption(httpOption) {
   if (typeof httpOption === "boolean") {
     return { host: void 0, port: 3e3 };
@@ -36,6 +37,8 @@ class MicrosoftGraphServer {
     this.version = "0.0.0";
     this.multiAccount = false;
     this.accountNames = [];
+    // Two-leg PKCE: stores client's code_challenge and server's code_verifier, keyed by OAuth state
+    this.pkceStore = /* @__PURE__ */ new Map();
     this.authManager = authManager;
     this.options = options;
     this.graphClient = null;
@@ -189,14 +192,15 @@ class MicrosoftGraphServer {
         const microsoftAuthUrl = new URL(
           `${cloudEndpoints.authority}/${tenantId}/oauth2/v2.0/authorize`
         );
+        const clientCodeChallenge = url.searchParams.get("code_challenge");
+        const clientCodeChallengeMethod = url.searchParams.get("code_challenge_method");
+        const state = url.searchParams.get("state");
         const allowedParams = [
           "response_type",
           "redirect_uri",
           "scope",
           "state",
           "response_mode",
-          "code_challenge",
-          "code_challenge_method",
           "prompt",
           "login_hint",
           "domain_hint"
@@ -207,6 +211,32 @@ class MicrosoftGraphServer {
             microsoftAuthUrl.searchParams.set(param, value);
           }
         });
+        if (clientCodeChallenge && state) {
+          const serverCodeVerifier = crypto.randomBytes(32).toString("base64url");
+          const serverCodeChallenge = crypto.createHash("sha256").update(serverCodeVerifier).digest("base64url");
+          this.pkceStore.set(state, {
+            clientCodeChallenge,
+            clientCodeChallengeMethod: clientCodeChallengeMethod || "S256",
+            serverCodeVerifier,
+            createdAt: Date.now()
+          });
+          const now = Date.now();
+          for (const [key, value] of this.pkceStore) {
+            if (now - value.createdAt > 10 * 60 * 1e3) {
+              this.pkceStore.delete(key);
+            }
+          }
+          microsoftAuthUrl.searchParams.set("code_challenge", serverCodeChallenge);
+          microsoftAuthUrl.searchParams.set("code_challenge_method", "S256");
+          logger.info("Two-leg PKCE: stored client challenge, generated server challenge", {
+            state: state.substring(0, 8) + "..."
+          });
+        } else if (clientCodeChallenge) {
+          microsoftAuthUrl.searchParams.set("code_challenge", clientCodeChallenge);
+          if (clientCodeChallengeMethod) {
+            microsoftAuthUrl.searchParams.set("code_challenge_method", clientCodeChallengeMethod);
+          }
+        }
         microsoftAuthUrl.searchParams.set("client_id", clientId);
         if (!microsoftAuthUrl.searchParams.get("scope")) {
           microsoftAuthUrl.searchParams.set("scope", "User.Read Files.Read Mail.Read");
@@ -250,13 +280,28 @@ class MicrosoftGraphServer {
               tenantId,
               hasClientSecret: !!clientSecret
             });
+            let serverCodeVerifier;
+            if (body.code_verifier) {
+              const clientVerifier = body.code_verifier;
+              const clientChallengeComputed = crypto.createHash("sha256").update(clientVerifier).digest("base64url");
+              for (const [state, pkceData] of this.pkceStore) {
+                if (pkceData.clientCodeChallenge === clientChallengeComputed) {
+                  serverCodeVerifier = pkceData.serverCodeVerifier;
+                  this.pkceStore.delete(state);
+                  logger.info("Two-leg PKCE: matched client verifier, using server verifier", {
+                    state: state.substring(0, 8) + "..."
+                  });
+                  break;
+                }
+              }
+            }
             const result = await exchangeCodeForToken(
               body.code,
               body.redirect_uri,
               clientId,
               clientSecret,
               tenantId,
-              body.code_verifier,
+              serverCodeVerifier || body.code_verifier,
               this.secrets.cloudType
             );
             res.json(result);

package/logs/mcp-server.log

@@ -1,10 +1,10 @@
-2026-04-05 08:41:23 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 08:41:23 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 08:41:23 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
-2026-04-05 08:41:23 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
-2026-04-05 08:41:23 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
-2026-04-05 08:41:25 INFO: Using environment variables for secrets
-2026-04-05 08:41:25 INFO: Using environment variables for secrets
-2026-04-05 08:41:25 INFO: Using environment variables for secrets
-2026-04-05 08:41:25 INFO: Using environment variables for secrets
-2026-04-05 08:41:25 INFO: Using environment variables for secrets
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/messages
+2026-04-05 08:47:40 INFO: [GRAPH CLIENT] Final URL being sent to Microsoft: https://graph.microsoft.com/v1.0/me/calendar
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets
+2026-04-05 08:47:42 INFO: Using environment variables for secrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.63.1",
+  "version": "0.63.2",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",