formlab-mcp 0.4.2 → 0.5.0

package/cloud.js

@@ -1,133 +1,77 @@
 // ============================================================
-// CLOUD MODE — read the LIVE FormLab workspace from Supabase instead of a
-// static export file. The tools are unchanged: we assemble the same `db` shape
-// (each synced table stores the full record in a `data` JSONB column) and set it
-// via data.js setStoreFromDb, then re-fetch on an interval so it stays "live".
+// CLOUD MODE — read the LIVE FormLab workspace via the `mcp-data` Edge Function.
+// ------------------------------------------------------------
+// v2 (formlab-mcp ≥0.5.0). The old v1 flow authenticated with the user's account
+// REFRESH TOKEN directly against Supabase — which was broken by design: the
+// refresh token is the full account session AND Supabase rotates it on every
+// use, so the browser and this server fought over one rotation chain and the
+// configured token worked exactly once ("Server disconnected" on the next start).
 //
-// v1 auth: the user's session REFRESH TOKEN (from FormLab's "Connect to MCP"
-// panel). Read-only by usage; RLS scopes every query to the user's own
-// workspaces. The refresh token is the full account session, though — a
-// dedicated, revocable, read-only MCP token is the planned hardening (needs a
-// small backend: a tokens table + an Edge Function to mint/validate).
+// Now we send a dedicated, revocable, READ-ONLY token (`flmcp_…`, minted from
+// FormLab → Connect to MCP) to the `mcp-data` Edge Function, which:
+//   * connects to Postgres as the SELECT-only `mcp_readonly` role (read-only
+//     enforced by the DB, not by trust),
+//   * authenticates the token and scopes every query to the bound workspace via
+//     the existing RLS,
+//   * returns the same `db` shape we then feed to setStoreFromDb.
+//
+// The token is STATIC — it never rotates — so there is nothing to persist and no
+// way for this server to invalidate itself. Revoke it from FormLab if needed.
 // ============================================================
 
-import { createClient } from '@supabase/supabase-js';
 import { setStoreFromDb } from './data.js';
-// Supabase rotates the refresh token on every use, and this client runs with
-// persistSession:false — see token-store.js for why we bank the rotated token
-// ourselves and what breaks when we don't.
-import { readStoredToken as _readStoredToken, saveToken as _saveToken } from './token-store.js';
-
-// Supabase table → db array key (mirrors the app's ENT.ENTITIES + db.js arrays).
-// Safety/regulatory ride the ingredient record's `data`, so they come for free.
-const TABLES = [
-  ['projects',            'projects'],
-  ['ingredients',         'ingredients'],
-  ['formulations',        'formulations'],
-  ['batches',             'batches'],
-  ['samples',             'samples'],
-  ['test_results',        'testResults'],
-  ['templates',           'templates'],
-  ['procedure_templates', 'procedureTemplates'],
-  ['parameters',          'parameters'],
-  ['equipment',           'equipment'],
-  ['stock_movements',     'stockMovements'],
-  ['lots',                'lots'],
-  ['formula_versions',    'formulaVersions'],
-  ['attachments',         'attachments'],
-  ['notebook_entries',    'notebookEntries'],
-];
-
-const PAGE = 1000;
-
-async function _fetchAll(supabase, table, workspaceId) {
-  const out = [];
-  for (let from = 0; ; from += PAGE) {
-    const { data, error } = await supabase
-      .from(table)
-      .select('data')
-      .eq('workspace_id', workspaceId)
-      .is('deleted_at', null)
-      .range(from, from + PAGE - 1);
-    if (error) {
-      // A table the backend hasn't migrated yet shouldn't sink the whole load.
-      if (/relation|does not exist|schema cache|find the table/i.test(error.message || '')) return out;
-      throw new Error(`${table}: ${error.message}`);
-    }
-    const rows = data || [];
-    for (const r of rows) if (r && r.data) out.push(r.data);
-    if (rows.length < PAGE) break;
-  }
-  return out;
-}
-
-async function _resolveWorkspace(supabase, userId, preferred) {
-  if (preferred) return preferred;
-  const { data, error } = await supabase
-    .from('workspace_members')
-    .select('workspace_id, role')
-    .eq('user_id', userId);
-  if (error) throw new Error(`workspace_members: ${error.message}`);
-  const rows = data || [];
-  if (!rows.length) throw new Error('No workspaces found for this account.');
-  const owned = rows.find(r => r.role === 'owner');
-  return (owned || rows[0]).workspace_id;   // default to your OWN workspace
-}
 
-async function _loadDb(supabase, workspaceId) {
-  const db = {};
-  for (const [table, key] of TABLES) db[key] = await _fetchAll(supabase, table, workspaceId);
-  return db;
-}
+// Public defaults — same values the app ships in its client (js/supabase.js).
+// Overridable via env for a self-hosted / preview backend.
+export const DEFAULT_SUPABASE_URL = 'https://ufizhypibwqqpavhxdwt.supabase.co';
+export const DEFAULT_ANON_KEY = 'sb_publishable_z83O_XZCXsHo9wghb4o3aw_6Qf4ikMP';
 
-// Bootstrap a session from the refresh token, do an initial load, then refresh on
-// an interval. Returns { workspaceId, userId, refresh, stop }.
-export async function startCloud({ url, anonKey, refreshToken, workspaceId, refreshSeconds = 60, onReload } = {}) {
-  if (!url || !anonKey || !refreshToken) {
-    throw new Error('Cloud mode needs FORMLAB_SUPABASE_URL, FORMLAB_SUPABASE_ANON_KEY and FORMLAB_REFRESH_TOKEN (copy them from FormLab → Connect to MCP).');
+// One fetch of the workspace `db` from the Edge Function.
+async function _fetchDb({ url, anonKey, token }) {
+  const endpoint = `${url.replace(/\/+$/, '')}/functions/v1/mcp-data`;
+  let res;
+  try {
+    res = await fetch(endpoint, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        // The gateway still wants a project apikey; OUR credential is the token
+        // in the body, which the function checks itself (deployed --no-verify-jwt).
+        'apikey': anonKey,
+        'Authorization': `Bearer ${anonKey}`,
+      },
+      body: JSON.stringify({ token }),
+    });
+  } catch (e) {
+    throw new Error(`could not reach the FormLab MCP endpoint (${endpoint}): ${e.message}`);
   }
-  const supabase = createClient(url, anonKey, {
-    auth: { persistSession: false, autoRefreshToken: true, detectSessionInUrl: false },
-  });
-
-  // refreshSession with a bare refresh token mints a fresh session and sets it on
-  // the client, so all subsequent queries carry the user's JWT (→ RLS).
-  //
-  // Try the PERSISTED token first (the live end of the rotation chain from our
-  // last run), then fall back to the configured one. The fallback matters: after
-  // the user reconnects from FormLab, the env token is the fresh one and any
-  // stored descendant is dead.
-  const stored = _readStoredToken(refreshToken);
-  const candidates = stored && stored !== refreshToken ? [stored, refreshToken] : [refreshToken];
-  let sess = null, lastErr = null;
-  for (const token of candidates) {
-    const { data, error } = await supabase.auth.refreshSession({ refresh_token: token });
-    if (!error && data && data.session && data.session.user) { sess = data; break; }
-    lastErr = error;
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON error page */ }
+  if (res.status === 401) {
+    throw new Error('the MCP token was rejected (missing, revoked, or malformed). Reconnect from FormLab → Settings → Account → AI tools (MCP) → Connect, and paste the new FORMLAB_MCP_TOKEN.');
   }
-  if (!sess) {
-    throw new Error(`auth failed: ${(lastErr && lastErr.message) || 'could not start a session from the refresh token'} — the refresh token is single-use and may already be spent. Reconnect from FormLab → Settings → Account → AI tools (MCP) → Connect, and paste the new FORMLAB_REFRESH_TOKEN into your MCP config.`);
+  if (!res.ok || !body || body.ok !== true || !body.db) {
+    throw new Error(`MCP endpoint error (HTTP ${res.status})${body && body.error ? ': ' + body.error : ''}`);
   }
-  // Bank the rotated token so the NEXT start has a live one.
-  _saveToken(sess.session.refresh_token, refreshToken);
-  // autoRefreshToken keeps rotating while we run — persist each new one too, so a
-  // long-running server still leaves a usable token behind when it exits.
-  try {
-    supabase.auth.onAuthStateChange((event, session) => {
-      if (event === 'TOKEN_REFRESHED' && session && session.refresh_token) {
-        _saveToken(session.refresh_token, refreshToken);
-      }
-    });
-  } catch (_) {}
+  return body;
+}
 
-  const userId = sess.session.user.id;
-  const ws = await _resolveWorkspace(supabase, userId, workspaceId);
+// Bootstrap: one load up front, then refresh on an interval. Returns
+// { workspaceId, refresh, stop } to mirror the old v1 signature.
+export async function startCloud({ url, anonKey, token, refreshSeconds = 60, onReload } = {}) {
+  url = url || DEFAULT_SUPABASE_URL;
+  anonKey = anonKey || DEFAULT_ANON_KEY;
+  if (!token) {
+    throw new Error('Cloud mode needs FORMLAB_MCP_TOKEN (mint it from FormLab → Connect to MCP).');
+  }
 
+  let workspaceId = null;
   const refresh = async () => {
-    const db = await _loadDb(supabase, ws);
-    setStoreFromDb(db, { source: 'cloud', workspaceId: ws, schemaName: 'formlab-live', loadedAt: new Date().toISOString() });
-    if (onReload) { try { onReload(db); } catch (_) {} }
-    return db;
+    const body = await _fetchDb({ url, anonKey, token });
+    workspaceId = body.workspaceId || workspaceId;
+    setStoreFromDb(body.db, { source: 'cloud', workspaceId, schemaName: 'formlab-live', loadedAt: body.loadedAt || new Date().toISOString() });
+    if (onReload) { try { onReload(body.db); } catch (_) {} }
+    return body.db;
   };
 
   await refresh();   // initial synchronous load before tools accept calls
@@ -137,7 +81,7 @@ export async function startCloud({ url, anonKey, refreshToken, workspaceId, refr
     timer = setInterval(() => {
       refresh().catch(e => process.stderr.write(`[formlab-mcp] cloud refresh failed: ${e.message}\n`));
     }, refreshSeconds * 1000);
-    if (timer.unref) timer.unref();   // don't keep the process alive just for the timer
+    if (timer.unref) timer.unref();
   }
-  return { workspaceId: ws, userId, refresh, stop: () => { if (timer) clearInterval(timer); } };
+  return { workspaceId, refresh, stop: () => { if (timer) clearInterval(timer); } };
 }

package/index.js

@@ -35,17 +35,18 @@ import * as projects     from './tools/projects.js';
 import * as notebook     from './tools/notebook.js';
 
 // ----- Data source: LIVE cloud workspace OR a static export file -----
-// Cloud mode kicks in when the Supabase env vars are present (copy them from
-// FormLab → Connect to MCP). Otherwise we fall back to the export-file mode.
-const CLOUD = process.env.FORMLAB_REFRESH_TOKEN && process.env.FORMLAB_SUPABASE_URL && process.env.FORMLAB_SUPABASE_ANON_KEY;
+// Cloud mode kicks in when a dedicated read-only MCP token is present (mint it
+// from FormLab → Connect to MCP). Otherwise we fall back to export-file mode.
+// FORMLAB_SUPABASE_URL / _ANON_KEY are optional overrides — cloud.js defaults to
+// the public production values, so the config only NEEDS FORMLAB_MCP_TOKEN.
+const CLOUD = !!process.env.FORMLAB_MCP_TOKEN;
 
 if (CLOUD) {
   try {
     const h = await startCloud({
-      url:           process.env.FORMLAB_SUPABASE_URL,
-      anonKey:       process.env.FORMLAB_SUPABASE_ANON_KEY,
-      refreshToken:  process.env.FORMLAB_REFRESH_TOKEN,
-      workspaceId:   process.env.FORMLAB_WORKSPACE_ID || null,
+      url:            process.env.FORMLAB_SUPABASE_URL || undefined,
+      anonKey:        process.env.FORMLAB_SUPABASE_ANON_KEY || undefined,
+      token:          process.env.FORMLAB_MCP_TOKEN,
       refreshSeconds: Number(process.env.FORMLAB_REFRESH_SECONDS || 60),
     });
     const s = getStore();
@@ -61,12 +62,12 @@ if (CLOUD) {
   const filePath = process.argv[2] || process.env.FORMLAB_EXPORT;
   if (!filePath) {
     process.stderr.write([
-      'Usage: formlab-mcp <path-to-export.json>           (file mode)',
-      '   or: set FORMLAB_SUPABASE_URL / FORMLAB_SUPABASE_ANON_KEY /',
-      '       FORMLAB_REFRESH_TOKEN (+ optional FORMLAB_WORKSPACE_ID)   (LIVE cloud mode)',
+      'Usage: formlab-mcp <path-to-export.json>   (file mode)',
+      '   or: set FORMLAB_MCP_TOKEN               (LIVE cloud mode)',
       '',
       'File mode: export via Settings → Import / Export → Export.',
-      'Cloud mode: copy the values from FormLab → Connect to MCP.',
+      'Cloud mode: mint a read-only token in FormLab → Settings → Account →',
+      '            AI tools (MCP) → Connect, and set it as FORMLAB_MCP_TOKEN.',
       '',
     ].join('\n'));
     process.exit(1);
@@ -113,7 +114,7 @@ const TOOLS = [
 ];
 
 const server = new Server(
-  { name: 'formlab-mcp', version: '0.4.2' },
+  { name: 'formlab-mcp', version: '0.5.0' },
   { capabilities: { tools: {} } }
 );
 

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "formlab-mcp",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "mcpName": "io.github.juliu1980/formlab-mcp",
-  "description": "Read-only Model Context Protocol server for FormLab — lets Claude (and other MCP clients) read and analyze your FormLab data, from a local export file OR your live cloud workspace.",
+  "description": "Read-only Model Context Protocol server for FormLab \u2014 lets Claude (and other MCP clients) read and analyze your FormLab data, from a local export file OR your live cloud workspace.",
   "type": "module",
   "bin": {
     "formlab-mcp": "./index.js"
@@ -16,8 +16,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.4",
-    "@supabase/supabase-js": "^2.45.0"
+    "@modelcontextprotocol/sdk": "^1.0.4"
   },
   "optionalDependencies": {
     "@rdkit/rdkit": "^2024.9.1"
@@ -39,4 +38,4 @@
     "url": "https://github.com/juliu1980/FormLab",
     "directory": "mcp"
   }
-}
+}

package/token-store.js

@@ -1,58 +0,0 @@
-// ============================================================
-// ROTATED-REFRESH-TOKEN STORE
-// ------------------------------------------------------------
-// Supabase ROTATES the refresh token on every use: refreshSession() invalidates
-// the token you passed and issues a new one. cloud.js creates its client with
-// persistSession:false, so before this module existed that new token only lived
-// in memory — and the next process start re-read the SAME (now spent) token from
-// the env and died with "auth failed", which Claude Desktop surfaces as
-// "Server disconnected". Net effect: the configured token worked exactly ONCE.
-//
-// So we bank the rotated token and prefer it on the next start. Entries are keyed
-// by a fingerprint of the ENV token: when the user reconnects from FormLab and
-// pastes a new token, the fingerprint changes and we drop the stale chain rather
-// than clinging to a dead descendant of the old one.
-//
-// The file holds a live account session — the same sensitivity as the Desktop
-// config that already stores it in plaintext — so it lives under the user's home,
-// dir 0700 / file 0600. Never log the token itself.
-// ============================================================
-
-import { createHash } from 'node:crypto';
-import { homedir } from 'node:os';
-import { join, dirname } from 'node:path';
-import { mkdirSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
-
-export const tokenFile = () => join(homedir(), '.formlab-mcp', 'session.json');
-
-// Short, non-reversible tag for "which configured token is this chain from".
-export const fingerprint = (t) => createHash('sha256').update(String(t || '')).digest('hex').slice(0, 16);
-
-// The live end of the rotation chain for `envToken`, or null when there isn't a
-// usable one (no file, unreadable, or it belongs to a different env token).
-export function readStoredToken(envToken) {
-  try {
-    const s = JSON.parse(readFileSync(tokenFile(), 'utf8'));
-    if (!s || !s.refreshToken) return null;
-    if (s.source !== fingerprint(envToken)) return null;
-    return s.refreshToken;
-  } catch (_) { return null; }
-}
-
-// Persistence is an optimisation, not a hard requirement: a read-only home must
-// not take the server down — worst case we're back to single-use behaviour.
-export function saveToken(refreshToken, envToken) {
-  if (!refreshToken) return false;
-  try {
-    const f = tokenFile();
-    mkdirSync(dirname(f), { recursive: true, mode: 0o700 });
-    writeFileSync(f, JSON.stringify({
-      refreshToken, source: fingerprint(envToken), updatedAt: new Date().toISOString(),
-    }, null, 2), { mode: 0o600 });
-    chmodSync(f, 0o600);   // enforce even if the file already existed
-    return true;
-  } catch (e) {
-    process.stderr.write(`[formlab-mcp] could not persist refresh token: ${e.message}\n`);
-    return false;
-  }
-}