@upstash/context7-mcp 3.0.0 → 3.1.0

package/dist/lib/jwt.js

@@ -1,17 +1,71 @@
 import * as jose from "jose";
-import { CLERK_DOMAIN } from "./constants.js";
-const JWKS_URL = `https://${CLERK_DOMAIN}/.well-known/jwks.json`;
-const ISSUER = `https://${CLERK_DOMAIN}`;
-const jwks = jose.createRemoteJWKSet(new URL(JWKS_URL));
+import { CLERK_DOMAIN, CONTEXT7_API_BASE_URL } from "./constants.js";
+const CLERK_ISSUER = `https://${CLERK_DOMAIN}`;
+const clerkJwks = jose.createRemoteJWKSet(new URL(`https://${CLERK_DOMAIN}/.well-known/jwks.json`));
+const ENTRA_V2_ISSUER_RE = /^https:\/\/login\.microsoftonline\.com\/[0-9a-f-]{36}\/v2\.0$/;
+const jwksByTenant = new Map();
+function entraJwks(tenantId) {
+    let jwks = jwksByTenant.get(tenantId);
+    if (!jwks) {
+        jwks = jose.createRemoteJWKSet(new URL(`https://login.microsoftonline.com/${tenantId}/discovery/v2.0/keys`));
+        jwksByTenant.set(tenantId, jwks);
+    }
+    return jwks;
+}
+const CONFIG_TTL_MS = 5 * 60 * 1000;
+const configByAudience = new Map();
+async function fetchEntraConfig(audience) {
+    const now = Date.now();
+    const cached = configByAudience.get(audience);
+    if (cached && cached.expiresAt > now)
+        return cached.value;
+    try {
+        const res = await fetch(`${CONTEXT7_API_BASE_URL}/v2/entra/config/${encodeURIComponent(audience)}`);
+        if (res.ok) {
+            const value = (await res.json());
+            configByAudience.set(audience, { value, expiresAt: now + CONFIG_TTL_MS });
+            return value;
+        }
+        if (res.status === 404) {
+            // Authoritative "not configured" response — safe to cache the miss so we
+            // don't hammer the app on every token verification.
+            configByAudience.set(audience, { value: null, expiresAt: now + CONFIG_TTL_MS });
+            return null;
+        }
+    }
+    catch {
+        // Network or JSON parse error: transient. Fall through without caching so
+        // the next request retries.
+    }
+    return null;
+}
 export function isJWT(token) {
-    const parts = token.split(".");
-    return parts.length === 3;
+    return token.split(".").length === 3;
 }
 export async function validateJWT(token) {
     try {
-        await jose.jwtVerify(token, jwks, {
-            issuer: ISSUER,
-        });
+        const decoded = jose.decodeJwt(token);
+        const iss = typeof decoded.iss === "string" ? decoded.iss : "";
+        if (ENTRA_V2_ISSUER_RE.test(iss)) {
+            const audience = typeof decoded.aud === "string" ? decoded.aud : "";
+            if (!audience)
+                return { valid: false, error: "Missing audience" };
+            const config = await fetchEntraConfig(audience);
+            if (!config)
+                return { valid: false, error: "Unknown audience" };
+            const { payload } = await jose.jwtVerify(token, entraJwks(config.tenantId), {
+                issuer: `https://login.microsoftonline.com/${config.tenantId}/v2.0`,
+                audience,
+            });
+            if (config.requiredScope) {
+                const scopes = String(payload.scp ?? "").split(" ");
+                if (!scopes.includes(config.requiredScope)) {
+                    return { valid: false, error: "Missing required scope" };
+                }
+            }
+            return { valid: true };
+        }
+        await jose.jwtVerify(token, clerkJwks, { issuer: CLERK_ISSUER });
         return { valid: true };
     }
     catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upstash/context7-mcp",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "mcpName": "io.github.upstash/context7",
   "description": "MCP server for Context7",
   "repository": {