ebay-mcp-remote-edition 2.0.14 → 2.0.16

package/build/auth/kv-store.js

@@ -88,7 +88,9 @@ export class CloudflareKVStore {
         await this.client.put(`/values/${encodeURIComponent(key)}`, JSON.stringify(value), { params });
         // Keep the in-memory cache consistent with what we wrote.
         // If the KV entry has its own TTL, honour it for the cache as well.
-        const cacheTtl = expirationTtl ? Math.min(expirationTtl * 1_000, this.cacheTtlMs) : this.cacheTtlMs;
+        const cacheTtl = expirationTtl
+            ? Math.min(expirationTtl * 1_000, this.cacheTtlMs)
+            : this.cacheTtlMs;
         this.cache.set(key, { value, expiresAt: Date.now() + cacheTtl });
     }
     async delete(key) {

package/build/auth/multi-user-store.js

@@ -118,6 +118,37 @@ export class MultiUserAuthStore {
         await this.kv.put(`client:${clientId}`, record);
         return record;
     }
+    /**
+     * Upserts a client record using a **caller-supplied** `clientId`.
+     *
+     * Used by the `/authorize` endpoint to auto-register trusted desktop MCP
+     * clients (VS Code, Cursor, Windsurf, localhost loopback) that arrive at
+     * `/authorize` without a prior `/register` call (e.g. because the in-memory
+     * registration was lost between requests, or the client drives `/authorize`
+     * directly).
+     *
+     * An existing record for `clientId` is overwritten only if the supplied
+     * `redirectUri` is not already listed (additive merge otherwise).
+     */
+    async registerClientWithId(clientId, redirectUris, clientName) {
+        const existing = await this.kv.get(`client:${clientId}`);
+        const now = new Date().toISOString();
+        if (existing) {
+            // Merge any new redirect URIs into the existing record
+            const merged = Array.from(new Set([...existing.redirectUris, ...redirectUris]));
+            const updated = { ...existing, redirectUris: merged };
+            await this.kv.put(`client:${clientId}`, updated);
+            return updated;
+        }
+        const record = {
+            clientId,
+            redirectUris,
+            clientName,
+            createdAt: now,
+        };
+        await this.kv.put(`client:${clientId}`, record);
+        return record;
+    }
     async getClient(clientId) {
         return await this.kv.get(`client:${clientId}`);
     }

package/build/server-http.js

@@ -30,10 +30,10 @@ function getServerBaseUrl() {
 }
 function htmlEscape(value) {
     return value
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
+        .replace(/&/g, '&')
+        .replace(/</g, '<')
+        .replace(/>/g, '>')
+        .replace(/"/g, '"')
         .replace(/'/g, '&#39;');
 }
 function requireAdmin(req, res, next) {
@@ -61,6 +61,36 @@ function requireOauthStartKey(req, res, next) {
     }
     next();
 }
+/**
+ * Returns true when a redirect URI belongs to a well-known desktop / IDE
+ * MCP client (VS Code, Cursor, Windsurf) or a localhost loopback.
+ *
+ * These clients drive the authorize flow directly and cannot always guarantee
+ * that their /register request was persisted before /authorize is called.
+ * We allow them to self-register on the fly so the flow doesn't hard-fail on
+ * a missing client_id when the user's eBay app credentials are already in env.
+ */
+function isTrustedDesktopRedirectUri(redirectUri) {
+    try {
+        const u = new URL(redirectUri);
+        // Desktop IDE callback schemes
+        if (u.protocol === 'vscode:' ||
+            u.protocol === 'cursor:' ||
+            u.protocol === 'windsurf:' ||
+            u.protocol === 'claude:') {
+            return true;
+        }
+        // Localhost loopback (any port)
+        if ((u.protocol === 'http:' || u.protocol === 'https:') &&
+            (u.hostname === 'localhost' || u.hostname === '127.0.0.1' || u.hostname === '::1')) {
+            return true;
+        }
+    }
+    catch {
+        // Malformed URI – treat as untrusted
+    }
+    return false;
+}
 async function createUserScopedApi(userId, environment) {
     const api = new EbaySellerApi(getEbayConfig(environment), { userId, environment });
     await api.initialize();
@@ -132,6 +162,10 @@ function createApp() {
         }
         const uris = redirectUris;
         const client = await authStore.registerClient(uris, clientName);
+        serverLogger.info('[register] MCP client registered', {
+            clientId: client.clientId,
+            redirectUris: client.redirectUris,
+        });
         res.status(201).json({
             client_id: client.clientId,
             redirect_uris: client.redirectUris,
@@ -151,22 +185,51 @@ function createApp() {
             const q = req.query;
             const { client_id: clientId, redirect_uri: redirectUri, response_type: responseType, state: mcpState, code_challenge: codeChallenge, code_challenge_method: codeChallengeMethod, } = q;
             const environment = q.env === 'sandbox' || q.env === 'production' ? q.env : getConfiguredEnvironment();
+            serverLogger.info('[authorize] Request received', {
+                clientId,
+                redirectUri,
+                responseType,
+                hasPkce: !!codeChallenge,
+                pkceMethod: codeChallengeMethod,
+                environment,
+                hasMcpState: !!mcpState,
+            });
             if (responseType !== 'code') {
+                serverLogger.warn('[authorize] Rejected: unsupported_response_type', { responseType });
                 res.status(400).json({ error: 'unsupported_response_type' });
                 return;
             }
             if (!clientId) {
+                serverLogger.warn('[authorize] Rejected: missing client_id');
                 res
                     .status(400)
                     .json({ error: 'invalid_request', error_description: 'client_id is required' });
                 return;
             }
-            const client = await authStore.getClient(clientId);
+            // Look up the MCP client. If unknown, auto-register it for trusted desktop
+            // redirect URIs (VS Code, Cursor, Windsurf, localhost) so that the flow
+            // continues even when /register state was not persisted (e.g. memory backend)
+            // or when the IDE drives /authorize directly without a prior /register call.
+            let client = await authStore.getClient(clientId);
             if (!client) {
-                res.status(400).json({ error: 'invalid_client', error_description: 'Unknown client_id' });
-                return;
+                if (redirectUri && isTrustedDesktopRedirectUri(redirectUri)) {
+                    serverLogger.info('[authorize] Auto-registering trusted desktop MCP client (client_id not in store)', { clientId, redirectUri });
+                    client = await authStore.registerClientWithId(clientId, [redirectUri]);
+                }
+                else {
+                    serverLogger.warn('[authorize] Rejected: unknown client_id (not a trusted desktop URI)', {
+                        clientId,
+                        redirectUri,
+                    });
+                    res.status(400).json({ error: 'invalid_client', error_description: 'Unknown client_id' });
+                    return;
+                }
             }
             if (!redirectUri || !client.redirectUris.includes(redirectUri)) {
+                serverLogger.warn('[authorize] Rejected: redirect_uri mismatch', {
+                    provided: redirectUri,
+                    registered: client.redirectUris,
+                });
                 res.status(400).json({
                     error: 'invalid_request',
                     error_description: 'redirect_uri not registered for this client',
@@ -174,6 +237,10 @@ function createApp() {
                 return;
             }
             if (!codeChallenge || codeChallengeMethod !== 'S256') {
+                serverLogger.warn('[authorize] Rejected: missing or invalid PKCE', {
+                    hasPkce: !!codeChallenge,
+                    method: codeChallengeMethod,
+                });
                 res.status(400).json({
                     error: 'invalid_request',
                     error_description: 'PKCE with S256 code_challenge is required',
@@ -182,6 +249,12 @@ function createApp() {
             }
             const ebayConfig = getEbayConfig(environment);
             if (!ebayConfig.clientId || !ebayConfig.clientSecret || !ebayConfig.redirectUri) {
+                serverLogger.error('[authorize] eBay app credentials missing in env', {
+                    hasClientId: !!ebayConfig.clientId,
+                    hasClientSecret: !!ebayConfig.clientSecret,
+                    hasRedirectUri: !!ebayConfig.redirectUri,
+                    environment,
+                });
                 res.status(500).json({
                     error: 'server_error',
                     error_description: `Missing eBay configuration for ${environment}`,
@@ -196,9 +269,17 @@ function createApp() {
                 mcpCodeChallengeMethod: codeChallengeMethod,
             });
             const oauthUrl = getOAuthAuthorizationUrl(ebayConfig.clientId, ebayConfig.redirectUri, environment, getHostedOauthScopes(environment), undefined, stateRecord.state);
+            serverLogger.info('[authorize] Redirecting to eBay OAuth', {
+                state: stateRecord.state,
+                environment,
+            });
             res.redirect(oauthUrl);
         }
         catch (error) {
+            serverLogger.error('[authorize] Unhandled error', {
+                error: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : undefined,
+            });
             res.status(500).json({
                 error: 'server_error',
                 error_description: error instanceof Error ? error.message : String(error),
@@ -210,9 +291,14 @@ function createApp() {
      * Exchanges a short-lived MCP authorization code (+ PKCE verifier) for a session token.
      */
     app.post('/token', async (req, res) => {
+        serverLogger.info('[token] Request received', {
+            contentType: req.headers['content-type'],
+            hasBody: !!req.body,
+        });
         // Body may be form-encoded (RFC 6749 §4.1.3) or JSON — both are parsed by middleware.
         // Guard against unparsed bodies (missing Content-Type header etc.)
         if (!req.body || typeof req.body !== 'object') {
+            serverLogger.warn('[token] Rejected: missing or unparseable body');
             res.status(400).json({
                 error: 'invalid_request',
                 error_description: 'Request body is missing or unparseable. Use application/x-www-form-urlencoded or application/json.',
@@ -221,31 +307,58 @@ function createApp() {
         }
         const body = req.body;
         const { grant_type: grantType, code, redirect_uri: redirectUri, client_id: clientId, code_verifier: codeVerifier, } = body;
+        serverLogger.info('[token] Parsed fields', {
+            grantType,
+            hasCode: !!code,
+            redirectUri,
+            clientId,
+            hasCodeVerifier: !!codeVerifier,
+        });
         if (grantType !== 'authorization_code') {
+            serverLogger.warn('[token] Rejected: unsupported_grant_type', { grantType });
             res.status(400).json({ error: 'unsupported_grant_type' });
             return;
         }
         if (!code) {
+            serverLogger.warn('[token] Rejected: missing code');
             res.status(400).json({ error: 'invalid_request', error_description: 'code is required' });
             return;
         }
         const authCode = await authStore.consumeAuthCode(code);
         if (!authCode) {
+            serverLogger.warn('[token] Rejected: invalid or expired authorization code', {
+                codePrefix: code.substring(0, 8),
+            });
             res.status(400).json({
                 error: 'invalid_grant',
                 error_description: 'Invalid or expired authorization code',
             });
             return;
         }
+        serverLogger.info('[token] Auth code found', {
+            storedClientId: authCode.clientId,
+            providedClientId: clientId,
+            storedRedirectUri: authCode.redirectUri,
+            providedRedirectUri: redirectUri,
+        });
         if (authCode.clientId !== clientId) {
+            serverLogger.warn('[token] Rejected: client_id mismatch', {
+                stored: authCode.clientId,
+                provided: clientId,
+            });
             res.status(400).json({ error: 'invalid_client', error_description: 'client_id mismatch' });
             return;
         }
         if (authCode.redirectUri !== redirectUri) {
+            serverLogger.warn('[token] Rejected: redirect_uri mismatch', {
+                stored: authCode.redirectUri,
+                provided: redirectUri,
+            });
             res.status(400).json({ error: 'invalid_grant', error_description: 'redirect_uri mismatch' });
             return;
         }
         if (!codeVerifier) {
+            serverLogger.warn('[token] Rejected: missing code_verifier');
             res
                 .status(400)
                 .json({ error: 'invalid_request', error_description: 'code_verifier is required' });
@@ -254,12 +367,21 @@ function createApp() {
         // Verify PKCE S256: BASE64URL(SHA256(code_verifier)) must equal code_challenge
         const expectedChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
         if (expectedChallenge !== authCode.codeChallenge) {
+            serverLogger.warn('[token] Rejected: PKCE verification failed', {
+                expected: authCode.codeChallenge,
+                computed: expectedChallenge,
+            });
             res
                 .status(400)
                 .json({ error: 'invalid_grant', error_description: 'PKCE verification failed' });
             return;
         }
         const session = await authStore.createSession(authCode.userId, authCode.environment);
+        serverLogger.info('[token] Session created, issuing access token', {
+            userId: authCode.userId,
+            environment: authCode.environment,
+            sessionTokenPrefix: session.sessionToken.substring(0, 8),
+        });
         res.json({
             access_token: session.sessionToken,
             token_type: 'bearer',
@@ -292,13 +414,23 @@ function createApp() {
             const envFromQuery = typeof req.query.env === 'string' ? req.query.env : undefined;
             const oauthError = typeof req.query.error === 'string' ? req.query.error : undefined;
             const errorDescription = typeof req.query.error_description === 'string' ? req.query.error_description : undefined;
+            serverLogger.info('[oauth/callback] Received', {
+                hasCode: !!code,
+                hasState: !!state,
+                oauthError,
+            });
             if (oauthError) {
+                serverLogger.warn('[oauth/callback] eBay returned OAuth error', {
+                    oauthError,
+                    errorDescription,
+                });
                 res
                     .status(400)
                     .send(`<h1>OAuth failed</h1><p>${htmlEscape(errorDescription ?? oauthError)}</p>`);
                 return;
             }
             if (!code) {
+                serverLogger.warn('[oauth/callback] Missing authorization code');
                 res.status(400).send('<h1>Missing authorization code</h1>');
                 return;
             }
@@ -307,10 +439,17 @@ function createApp() {
             if (state) {
                 stateRecord = await authStore.consumeOAuthState(state);
                 if (!stateRecord) {
+                    serverLogger.warn('[oauth/callback] OAuth state not found or expired', { state });
                     res.status(400).send('<h1>Invalid or expired OAuth state</h1>');
                     return;
                 }
                 environment = stateRecord.environment;
+                serverLogger.info('[oauth/callback] State resolved', {
+                    environment,
+                    isMcpFlow: !!(stateRecord.mcpClientId && stateRecord.mcpRedirectUri),
+                    mcpClientId: stateRecord.mcpClientId,
+                    mcpRedirectUri: stateRecord.mcpRedirectUri,
+                });
             }
             else {
                 environment =
@@ -322,7 +461,12 @@ function createApp() {
             const userId = randomUUID();
             const api = await createUserScopedApi(userId, environment);
             const oauthClient = api.getAuthClient().getOAuthClient();
+            serverLogger.info('[oauth/callback] Exchanging code for eBay tokens', { userId });
             const tokenData = await oauthClient.exchangeCodeForToken(code);
+            serverLogger.info('[oauth/callback] eBay token exchange successful', {
+                userId,
+                hasScope: !!tokenData.scope,
+            });
             // ── MCP OAuth flow: redirect back to the registered MCP client ─────────
             if (stateRecord?.mcpClientId && stateRecord.mcpRedirectUri && stateRecord.mcpCodeChallenge) {
                 const authCodeRecord = await authStore.createAuthCode(stateRecord.mcpClientId, stateRecord.mcpRedirectUri, stateRecord.mcpCodeChallenge, stateRecord.mcpCodeChallengeMethod ?? 'S256', userId, environment);
@@ -331,15 +475,18 @@ function createApp() {
                 if (stateRecord.mcpState) {
                     redirectUrl.searchParams.set('state', stateRecord.mcpState);
                 }
-                serverLogger.info('MCP OAuth flow complete, redirecting to client', {
+                serverLogger.info('[oauth/callback] MCP OAuth flow complete, redirecting to client', {
                     clientId: stateRecord.mcpClientId,
                     redirectUri: stateRecord.mcpRedirectUri,
                     userId,
+                    authCodePrefix: authCodeRecord.code.substring(0, 8),
+                    finalRedirectUrl: redirectUrl.toString().substring(0, 120),
                 });
                 res.redirect(redirectUrl.toString());
                 return;
             }
             // ── End MCP OAuth flow ─────────────────────────────────────────────────
+            serverLogger.info('[oauth/callback] Non-MCP flow: creating hosted session', { userId });
             const session = await authStore.createSession(userId, environment);
             res.status(200).send(`<!doctype html>
 <html>
@@ -403,6 +550,10 @@ function createApp() {
 </html>`);
         }
         catch (error) {
+            serverLogger.error('[oauth/callback] Unhandled error', {
+                error: error instanceof Error ? error.message : String(error),
+                stack: error instanceof Error ? error.stack : undefined,
+            });
             res
                 .status(500)
                 .send(`<h1>OAuth callback failed</h1><pre>${htmlEscape(error instanceof Error ? error.message : String(error))}</pre>`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ebay-mcp-remote-edition",
-  "version": "2.0.14",
+  "version": "2.0.16",
   "description": "Remote + Local MCP server for eBay APIs - provides access to eBay developer functionality through MCP (Model Context Protocol)",
   "type": "module",
   "main": "build/index.js",