drupal-mcp-connector 2.23.1 → 2.23.2

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.23.2] - 2026-09-28
+
+### Fixed
+- **Adapter-neutral `drupal_list_translations` fallback.** When Sentinel's
+  translation inventory is unavailable, the tool reads `langcode` from
+  `backend.getEntity` instead of a JSON:API `rawQuery` path. GraphQL
+  backends can report the one observable language; `FALLBACK_NOTE` is
+  unchanged.
+- **Inbound IdP HTTP timeouts.** RFC 8414 / OIDC discovery, JWKS retrieval,
+  and RFC 7662 introspection abort after 30s (`AbortSignal.timeout`), matching
+  outbound Drupal HTTP. A hung issuer fails closed (discovery throw on HTTPS
+  bring-up; 401 on `/mcp` auth) instead of stalling the process.
+
 ## [2.23.1] - 2026-09-23
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drupal-mcp-connector",
-  "version": "2.23.1",
+  "version": "2.23.2",
   "description": "Drupal MCP Connector — multi-site MCP server for Drupal with JSON:API and GraphQL, governed writes, draft translations, content tools, audit reports, and an SSH Drush bridge.",
   "type": "module",
   "main": "src/index.js",

package/src/lib/http-auth.js

@@ -6,13 +6,29 @@
  *   - OAuth resource server (`createResourceAuthenticator`) — network-facing
  *     HTTPS. JWT via issuer discovery + JWKS, optional RFC 7662 introspection,
  *     and a hot-reloaded revocation file. Caller-supplied identity headers
- *     never become the principal.
+ *     never become the principal. IdP HTTP (discovery, JWKS, introspection)
+ *     aborts after `INBOUND_IDP_TIMEOUT_MS` (30s).
  */
 
 import { timingSafeEqual } from "crypto";
 import { readFileSync, statSync, writeFileSync } from "fs";
 import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
 
+/** Inbound IdP HTTP timeout. Matches Drupal/Drush outbound HTTP. */
+export const INBOUND_IDP_TIMEOUT_MS = 30_000;
+
+/**
+ * Attach the inbound IdP abort timeout. A caller `signal` wins.
+ * @param {RequestInit} [options]
+ * @returns {RequestInit}
+ */
+function withInboundTimeout(options = {}) {
+  return {
+    ...options,
+    signal: options.signal ?? AbortSignal.timeout(INBOUND_IDP_TIMEOUT_MS),
+  };
+}
+
 /** Header names that must never become identity. */
 export const SPOOFABLE_IDENTITY_HEADERS = Object.freeze([
   "x-mcp-subject",
@@ -361,7 +377,7 @@ export async function discoverAuthorizationServer(issuer, fetchFn = fetch) {
   for (const url of authorizationServerDiscoveryUrls(issuer)) {
     let res;
     try {
-      res = await fetchFn(url, { headers: { accept: "application/json" } });
+      res = await fetchFn(url, withInboundTimeout({ headers: { accept: "application/json" } }));
     } catch {
       continue;
     }
@@ -393,7 +409,7 @@ export async function introspectToken(token, {
   fetchFn = fetch,
 }) {
   const creds = Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
-  const res = await fetchFn(url, {
+  const res = await fetchFn(url, withInboundTimeout({
     method: "POST",
     headers: {
       authorization: `Basic ${creds}`,
@@ -401,7 +417,7 @@ export async function introspectToken(token, {
       accept: "application/json",
     },
     body: new URLSearchParams({ token }).toString(),
-  });
+  }));
   if (!res.ok) return null;
   const body = await res.json();
   if (body.active !== true) return null;
@@ -608,8 +624,11 @@ export async function createInboundHttpsAuth({ inboundCfg, fetchFn = fetch }) {
   const asMeta = await discoverAuthorizationServer(issuer, fetchFn);
   const advertisedIssuer = asMeta.issuer || issuer;
   // JWKS retrieval goes through the same injectable fetch as issuer
-  // discovery; with the default global fetch the behavior is unchanged.
-  const jwks = createRemoteJWKSet(new URL(asMeta.jwks_uri), { [customFetch]: fetchFn });
+  // discovery, with jose's timeoutDuration aligned to the inbound budget.
+  const jwks = createRemoteJWKSet(new URL(asMeta.jwks_uri), {
+    timeoutDuration: INBOUND_IDP_TIMEOUT_MS,
+    [customFetch]: (url, options) => fetchFn(url, withInboundTimeout(options)),
+  });
   const resourceMetadataUrl = resourceMetadataUrlFor(resource);
   const revocationStore = inboundCfg.revocationFile
     ? createRevocationStore({ filePath: inboundCfg.revocationFile })

package/src/tools/translations.js

@@ -97,16 +97,15 @@ async function listTranslations({ site: siteName, entityType = "node", type, id
     }
   }
 
-  const res = await backend.rawQuery({ path: `/jsonapi/${entityType}/${type}/${id}` });
-  const data = res?.data;
-  if (!data) return null;
+  const entity = await backend.getEntity({ entityType, bundle: type, id });
+  if (!entity) return null;
 
-  const defaultLangcode = data.attributes?.langcode ?? null;
+  const defaultLangcode = entity.langcode ?? null;
   const langcodes = defaultLangcode ? [defaultLangcode] : [];
   const translations = langcodes.map((lc) => ({ langcode: lc, default: lc === defaultLangcode }));
 
   return {
-    id: data.id,
+    id: entity.id,
     entityType,
     bundle: type,
     defaultLangcode,