formlab-mcp 0.4.1 → 0.4.2

package/cloud.js

@@ -13,6 +13,10 @@
 
 import { createClient } from '@supabase/supabase-js';
 import { setStoreFromDb } from './data.js';
+// Supabase rotates the refresh token on every use, and this client runs with
+// persistSession:false — see token-store.js for why we bank the rotated token
+// ourselves and what breaks when we don't.
+import { readStoredToken as _readStoredToken, saveToken as _saveToken } from './token-store.js';
 
 // Supabase table → db array key (mirrors the app's ENT.ENTITIES + db.js arrays).
 // Safety/regulatory ride the ingredient record's `data`, so they come for free.
@@ -85,12 +89,37 @@ export async function startCloud({ url, anonKey, refreshToken, workspaceId, refr
   const supabase = createClient(url, anonKey, {
     auth: { persistSession: false, autoRefreshToken: true, detectSessionInUrl: false },
   });
+
   // refreshSession with a bare refresh token mints a fresh session and sets it on
   // the client, so all subsequent queries carry the user's JWT (→ RLS).
-  const { data: sess, error: sErr } = await supabase.auth.refreshSession({ refresh_token: refreshToken });
-  if (sErr || !(sess && sess.session && sess.session.user)) {
-    throw new Error(`auth failed: ${(sErr && sErr.message) || 'could not start a session from the refresh token — it may have expired; reconnect from FormLab.'}`);
+  //
+  // Try the PERSISTED token first (the live end of the rotation chain from our
+  // last run), then fall back to the configured one. The fallback matters: after
+  // the user reconnects from FormLab, the env token is the fresh one and any
+  // stored descendant is dead.
+  const stored = _readStoredToken(refreshToken);
+  const candidates = stored && stored !== refreshToken ? [stored, refreshToken] : [refreshToken];
+  let sess = null, lastErr = null;
+  for (const token of candidates) {
+    const { data, error } = await supabase.auth.refreshSession({ refresh_token: token });
+    if (!error && data && data.session && data.session.user) { sess = data; break; }
+    lastErr = error;
+  }
+  if (!sess) {
+    throw new Error(`auth failed: ${(lastErr && lastErr.message) || 'could not start a session from the refresh token'} — the refresh token is single-use and may already be spent. Reconnect from FormLab → Settings → Account → AI tools (MCP) → Connect, and paste the new FORMLAB_REFRESH_TOKEN into your MCP config.`);
   }
+  // Bank the rotated token so the NEXT start has a live one.
+  _saveToken(sess.session.refresh_token, refreshToken);
+  // autoRefreshToken keeps rotating while we run — persist each new one too, so a
+  // long-running server still leaves a usable token behind when it exits.
+  try {
+    supabase.auth.onAuthStateChange((event, session) => {
+      if (event === 'TOKEN_REFRESHED' && session && session.refresh_token) {
+        _saveToken(session.refresh_token, refreshToken);
+      }
+    });
+  } catch (_) {}
+
   const userId = sess.session.user.id;
   const ws = await _resolveWorkspace(supabase, userId, workspaceId);
 

package/index.js

@@ -113,7 +113,7 @@ const TOOLS = [
 ];
 
 const server = new Server(
-  { name: 'formlab-mcp', version: '0.4.0' },
+  { name: 'formlab-mcp', version: '0.4.2' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "formlab-mcp",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "mcpName": "io.github.juliu1980/formlab-mcp",
   "description": "Read-only Model Context Protocol server for FormLab — lets Claude (and other MCP clients) read and analyze your FormLab data, from a local export file OR your live cloud workspace.",
   "type": "module",

package/token-store.js

@@ -0,0 +1,58 @@
+// ============================================================
+// ROTATED-REFRESH-TOKEN STORE
+// ------------------------------------------------------------
+// Supabase ROTATES the refresh token on every use: refreshSession() invalidates
+// the token you passed and issues a new one. cloud.js creates its client with
+// persistSession:false, so before this module existed that new token only lived
+// in memory — and the next process start re-read the SAME (now spent) token from
+// the env and died with "auth failed", which Claude Desktop surfaces as
+// "Server disconnected". Net effect: the configured token worked exactly ONCE.
+//
+// So we bank the rotated token and prefer it on the next start. Entries are keyed
+// by a fingerprint of the ENV token: when the user reconnects from FormLab and
+// pastes a new token, the fingerprint changes and we drop the stale chain rather
+// than clinging to a dead descendant of the old one.
+//
+// The file holds a live account session — the same sensitivity as the Desktop
+// config that already stores it in plaintext — so it lives under the user's home,
+// dir 0700 / file 0600. Never log the token itself.
+// ============================================================
+
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+
+export const tokenFile = () => join(homedir(), '.formlab-mcp', 'session.json');
+
+// Short, non-reversible tag for "which configured token is this chain from".
+export const fingerprint = (t) => createHash('sha256').update(String(t || '')).digest('hex').slice(0, 16);
+
+// The live end of the rotation chain for `envToken`, or null when there isn't a
+// usable one (no file, unreadable, or it belongs to a different env token).
+export function readStoredToken(envToken) {
+  try {
+    const s = JSON.parse(readFileSync(tokenFile(), 'utf8'));
+    if (!s || !s.refreshToken) return null;
+    if (s.source !== fingerprint(envToken)) return null;
+    return s.refreshToken;
+  } catch (_) { return null; }
+}
+
+// Persistence is an optimisation, not a hard requirement: a read-only home must
+// not take the server down — worst case we're back to single-use behaviour.
+export function saveToken(refreshToken, envToken) {
+  if (!refreshToken) return false;
+  try {
+    const f = tokenFile();
+    mkdirSync(dirname(f), { recursive: true, mode: 0o700 });
+    writeFileSync(f, JSON.stringify({
+      refreshToken, source: fingerprint(envToken), updatedAt: new Date().toISOString(),
+    }, null, 2), { mode: 0o600 });
+    chmodSync(f, 0o600);   // enforce even if the file already existed
+    return true;
+  } catch (e) {
+    process.stderr.write(`[formlab-mcp] could not persist refresh token: ${e.message}\n`);
+    return false;
+  }
+}