fantsec-docmost-cli 2.2.1 → 2.2.2

package/build/__tests__/mcp.test.js

@@ -0,0 +1,28 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { resolveToolAuthContext } from "../mcp.js";
+const ORIGINAL_ENV = { ...process.env };
+beforeEach(() => {
+    process.env = {
+        ...ORIGINAL_ENV,
+        DOCMOST_API_URL: "https://docs.example.com/api",
+    };
+});
+afterEach(() => {
+    process.env = { ...ORIGINAL_ENV };
+});
+describe("docmost MCP auth resolution", () => {
+    it("falls back to env auth for local stdio calls without request headers", () => {
+        expect(resolveToolAuthContext(undefined)).toBeUndefined();
+    });
+    it("parses bearer token headers for remote calls", () => {
+        expect(resolveToolAuthContext({
+            authorization: "Bearer token-123",
+        })).toEqual({
+            apiUrl: process.env.DOCMOST_API_URL,
+            token: "token-123",
+        });
+    });
+    it("rejects remote calls that omit authorization headers", () => {
+        expect(() => resolveToolAuthContext({})).toThrow("Authorization header is required for remote Docmost tool calls.");
+    });
+});

package/build/mcp.js

@@ -74,11 +74,7 @@ export function createMcpServer() {
             inputSchema: tool.inputSchema,
             annotations: tool.annotations,
         }, async (args, extra) => {
-            const authHeader = getAuthorizationHeader(extra?.requestInfo?.headers);
-            if (!authHeader) {
-                throw new Error("Authorization header is required for Docmost tool calls.");
-            }
-            const auth = parseDocmostBearer(extractBearerToken(authHeader));
+            const auth = resolveToolAuthContext(extra?.requestInfo?.headers);
             const result = await executeTool(tool, args, auth);
             return {
                 content: [
@@ -93,6 +89,18 @@ export function createMcpServer() {
     }
     return server;
 }
+export function resolveToolAuthContext(headers) {
+    const authHeader = getAuthorizationHeader(headers);
+    if (authHeader) {
+        return parseDocmostBearer(extractBearerToken(authHeader));
+    }
+    // Local stdio MCP calls do not provide request headers. In that case we
+    // intentionally fall back to DOCMOST_* env vars so local client configs work.
+    if (!headers) {
+        return undefined;
+    }
+    throw new Error("Authorization header is required for remote Docmost tool calls.");
+}
 function getAuthorizationHeader(headers) {
     if (!headers) {
         return undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fantsec-docmost-cli",
-  "version": "2.2.1",
+  "version": "2.2.2",
   "description": "A Docmost CLI and standard MCP server for documentation automation.",
   "main": "build/index.js",
   "bin": {