ebay-mcp-remote-edition 2.0.10 → 2.0.12

package/build/auth/kv-store.js

@@ -1,9 +1,46 @@
 import axios from 'axios';
+/**
+ * Purely in-memory KV store with optional per-entry TTL.
+ * Useful for local development, single-user setups, or when
+ * EBAY_TOKEN_STORE_BACKEND=memory.
+ * All data is lost on process restart.
+ */
+export class InMemoryKVStore {
+    store = new Map();
+    async get(key) {
+        const entry = this.store.get(key);
+        if (!entry)
+            return null;
+        if (entry.expiresAt !== undefined && Date.now() > entry.expiresAt) {
+            this.store.delete(key);
+            return null;
+        }
+        return entry.value;
+    }
+    async put(key, value, expirationTtl) {
+        this.store.set(key, {
+            value,
+            expiresAt: expirationTtl !== undefined ? Date.now() + expirationTtl * 1_000 : undefined,
+        });
+    }
+    async delete(key) {
+        this.store.delete(key);
+    }
+}
+/**
+ * Cloudflare KV REST API backend with an in-memory read-through cache.
+ * Used when EBAY_TOKEN_STORE_BACKEND=cloudflare-kv (the default for hosted deployments).
+ */
 export class CloudflareKVStore {
     client;
     accountId;
     namespaceId;
-    constructor() {
+    /** In-memory read-through cache to avoid redundant Cloudflare KV API calls */
+    cache = new Map();
+    /** How long (ms) to hold a cached value before re-fetching from KV. Default: 5 minutes. */
+    cacheTtlMs;
+    constructor(cacheTtlMs = 5 * 60 * 1_000) {
+        this.cacheTtlMs = cacheTtlMs;
         this.accountId = process.env.CLOUDFLARE_ACCOUNT_ID || '';
         this.namespaceId = process.env.CLOUDFLARE_KV_NAMESPACE_ID || '';
         const apiToken = process.env.CLOUDFLARE_API_TOKEN || '';
@@ -16,15 +53,27 @@ export class CloudflareKVStore {
             timeout: 30000,
         });
     }
+    isCacheValid(entry) {
+        return Date.now() < entry.expiresAt;
+    }
     async get(key) {
+        // Serve from in-memory cache when still fresh
+        const cached = this.cache.get(key);
+        if (cached && this.isCacheValid(cached)) {
+            return cached.value;
+        }
         try {
             const response = await this.client.get(`/values/${encodeURIComponent(key)}`, {
                 responseType: 'text',
             });
-            return JSON.parse(response.data);
+            const value = JSON.parse(response.data);
+            this.cache.set(key, { value, expiresAt: Date.now() + this.cacheTtlMs });
+            return value;
         }
         catch (error) {
             if (axios.isAxiosError(error) && error.response?.status === 404) {
+                // Cache the miss so we don't hammer KV for non-existent keys either
+                this.cache.set(key, { value: null, expiresAt: Date.now() + this.cacheTtlMs });
                 return null;
             }
             throw error;
@@ -33,8 +82,44 @@ export class CloudflareKVStore {
     async put(key, value, expirationTtl) {
         const params = expirationTtl ? { expiration_ttl: expirationTtl } : undefined;
         await this.client.put(`/values/${encodeURIComponent(key)}`, JSON.stringify(value), { params });
+        // Keep the in-memory cache consistent with what we wrote.
+        // If the KV entry has its own TTL, honour it for the cache as well.
+        const cacheTtl = expirationTtl ? Math.min(expirationTtl * 1_000, this.cacheTtlMs) : this.cacheTtlMs;
+        this.cache.set(key, { value, expiresAt: Date.now() + cacheTtl });
     }
     async delete(key) {
         await this.client.delete(`/values/${encodeURIComponent(key)}`);
+        this.cache.delete(key);
+    }
+    /** Manually evict a single key from the local cache (e.g. after an external update). */
+    invalidate(key) {
+        this.cache.delete(key);
+    }
+    /** Flush the entire in-memory cache. */
+    flushCache() {
+        this.cache.clear();
+    }
+}
+// ── Factory ───────────────────────────────────────────────────────────────────
+/**
+ * Returns the appropriate KV store backend based on the EBAY_TOKEN_STORE_BACKEND
+ * environment variable:
+ *
+ *   memory        → InMemoryKVStore  (no external dependencies, data lost on restart)
+ *   cloudflare-kv → CloudflareKVStore (default; requires CLOUDFLARE_* env vars)
+ *
+ * If the variable is unset or unrecognised, defaults to cloudflare-kv so that
+ * existing hosted deployments continue to work without any config change.
+ */
+export function createKVStore() {
+    const backend = (process.env.EBAY_TOKEN_STORE_BACKEND ?? 'cloudflare-kv').toLowerCase().trim();
+    switch (backend) {
+        case 'memory':
+        case 'in-memory':
+            return new InMemoryKVStore();
+        case 'cloudflare-kv':
+        case 'cloudflare':
+        default:
+            return new CloudflareKVStore();
     }
 }

package/build/auth/multi-user-store.js

@@ -1,7 +1,14 @@
 import { randomUUID } from 'crypto';
-import { CloudflareKVStore } from '../auth/kv-store.js';
+import { createKVStore } from '../auth/kv-store.js';
 export class MultiUserAuthStore {
-    kv = new CloudflareKVStore();
+    kv = createKVStore();
+    /**
+     * In-memory map of sessionToken → timestamp of last KV write for touchSession.
+     * Prevents a KV PUT on every single authenticated request — we only persist
+     * `lastUsedAt` once per TOUCH_THROTTLE_MS (default: 1 hour).
+     */
+    sessionTouchCache = new Map();
+    static TOUCH_THROTTLE_MS = 60 * 60 * 1_000; // 1 hour
     stateKey(state) {
         return `oauth_state:${state}`;
     }
@@ -60,12 +67,21 @@ export class MultiUserAuthStore {
         return await this.kv.get(this.sessionKey(sessionToken));
     }
     async touchSession(sessionToken) {
+        const now = Date.now();
+        const lastTouched = this.sessionTouchCache.get(sessionToken);
+        // Skip the KV write entirely if we touched this session recently.
+        // The in-memory cache in CloudflareKVStore already keeps reads free,
+        // so the only cost we're avoiding here is the unnecessary KV PUT.
+        if (lastTouched !== undefined && now - lastTouched < MultiUserAuthStore.TOUCH_THROTTLE_MS) {
+            return;
+        }
         const record = await this.getSession(sessionToken);
         if (!record || record.revokedAt) {
             return;
         }
-        record.lastUsedAt = new Date().toISOString();
+        record.lastUsedAt = new Date(now).toISOString();
         await this.kv.put(this.sessionKey(sessionToken), record);
+        this.sessionTouchCache.set(sessionToken, now);
     }
     async revokeSession(sessionToken) {
         const record = await this.getSession(sessionToken);

package/build/server-http.js

@@ -405,7 +405,9 @@ function createApp() {
         }
     });
     app.get('/admin/session/:sessionToken', requireAdmin, async (req, res) => {
-        const session = await authStore.getSession(req.params.sessionToken);
+        const tokenParam = req.params.sessionToken;
+        const sessionToken = typeof tokenParam === 'string' ? tokenParam : tokenParam[0];
+        const session = await authStore.getSession(sessionToken);
         if (!session) {
             res.status(404).json({ error: 'not_found' });
             return;
@@ -433,11 +435,15 @@ function createApp() {
         });
     });
     app.post('/admin/session/:sessionToken/revoke', requireAdmin, async (req, res) => {
-        await authStore.revokeSession(req.params.sessionToken);
+        const tokenParam = req.params.sessionToken;
+        const sessionToken = typeof tokenParam === 'string' ? tokenParam : tokenParam[0];
+        await authStore.revokeSession(sessionToken);
         res.json({ ok: true, revoked: true });
     });
     app.delete('/admin/session/:sessionToken', requireAdmin, async (req, res) => {
-        await authStore.deleteSession(req.params.sessionToken);
+        const tokenParam = req.params.sessionToken;
+        const sessionToken = typeof tokenParam === 'string' ? tokenParam : tokenParam[0];
+        await authStore.deleteSession(sessionToken);
         res.json({ ok: true, deleted: true });
     });
     const transports = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ebay-mcp-remote-edition",
-  "version": "2.0.10",
+  "version": "2.0.12",
   "description": "Remote + Local MCP server for eBay APIs - provides access to eBay developer functionality through MCP (Model Context Protocol)",
   "type": "module",
   "main": "build/index.js",