mcp-creatio 0.3.10 → 0.4.1

package/dist/services/session-context.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionContext = void 0;
+const crypto_1 = __importDefault(require("crypto"));
 const log_1 = __importDefault(require("../log"));
 class SessionContext {
     static _instance;
@@ -18,8 +19,8 @@ class SessionContext {
         return SessionContext._instance;
     }
     _generateState() {
-        return (Math.random().toString(36).substring(2, 15) +
-            Math.random().toString(36).substring(2, 15));
+        // Cryptographically secure, unguessable CSRF/state token (CWE-330).
+        return crypto_1.default.randomBytes(32).toString('base64url');
     }
     createSession(sessionId, userKey, remoteIp) {
         const session = {
@@ -102,10 +103,11 @@ class SessionContext {
     async deleteTokensForUser(userKey) {
         this._userTokens.delete(userKey);
     }
-    createOAuthState(userKey) {
+    createOAuthState(userKey, sessionId) {
         const state = this._generateState();
         const stateInfo = {
             userKey,
+            sessionId,
             createdAt: Date.now(),
             expiresAt: Date.now() + 10 * 60 * 1000,
         };
@@ -122,18 +124,10 @@ class SessionContext {
             return null;
         }
         this._oauthStates.delete(state);
-        return { userKey: stateInfo.userKey };
+        return { userKey: stateInfo.userKey, sessionId: stateInfo.sessionId };
     }
     validateAndConsumeOAuthState(state) {
-        const result = this.validateOAuthState(state);
-        return result?.userKey;
-    }
-    setSessionUserKey(sessionId, userKey) {
-        const session = this._sessions.get(sessionId);
-        if (session) {
-            session.userKey = userKey;
-            log_1.default.info('session_mapping.set', { sessionId, userKey });
-        }
+        return this.validateOAuthState(state) ?? undefined;
     }
     cleanupExpiredOAuthStates() {
         const now = Date.now();
@@ -156,20 +150,6 @@ class SessionContext {
         const session = this.createSession(sessionId, userKey, remoteIp);
         return session;
     }
-    mapAllSessionsToUser(userKey) {
-        const sessionIds = [];
-        for (const [sessionId, session] of this._sessions.entries()) {
-            if (session.transport) {
-                session.userKey = userKey;
-                sessionIds.push(sessionId);
-            }
-        }
-        log_1.default.info('mapping_all_sessions', {
-            userKey,
-            sessionCount: sessionIds.length,
-            sessionIds,
-        });
-    }
     getStats() {
         return {
             sessionsCount: this._sessions.size,

package/dist/services/session-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-context.js","sourceRoot":"","sources":["../../src/services/session-context.ts"],"names":[],"mappings":";;;;;;AAEA,iDAAyB;AAuBzB,MAAa,cAAc;IAClB,MAAM,CAAC,SAAS,CAA6B;IACpC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,MAAM,KAAK,QAAQ;QACzB,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC/B,cAAc,CAAC,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC;IACjC,CAAC;IAEO,cAAc;QACrB,OAAO,CACN,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAC3C,CAAC;IACH,CAAC;IAEM,aAAa,CAAC,SAAiB,EAAE,OAAgB,EAAE,QAAiB;QAC1E,MAAM,OAAO,GAAgB;YAC5B,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;SACrB,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,mBAAmB,CAAC,SAAiB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,mBAAmB,CAAC,SAAiB,EAAE,SAAwC;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;IACF,CAAC;IAEM,gBAAgB,CAAC,SAAiB,EAAE,OAAe;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;YAC1B,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IAEM,aAAa,CAAC,SAAiB;QACrC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,cAAc;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,kBAAkB,CAAC,OAAe;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACjF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,MAAkB;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,OAAe;QAC/C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAEM,gBAAgB,CAAC,OAAe;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,SAAS,GAAe;YAC7B,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SACtC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,kBAAkB,CAAC,KAAa;QAGtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,CAAC;IACvC,CAAC;IAEM,4BAA4B,CAAC,KAAa;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,MAAM,EAAE,OAAO,CAAC;IACxB,CAAC;IAEM,iBAAiB,CAAC,SAAiB,EAAE,OAAe;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;YAC1B,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IAEM,yBAAyB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACF,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC9B,SAAkB,EAClB,OAAgB;QAEhB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,qBAAqB,CACjC,SAAiB,EACjB,OAAe,EACf,QAAiB;QAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,oBAAoB,CAAC,OAAe;QAC1C,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACvB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;gBAC1B,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACF,CAAC;QACD,aAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAChC,OAAO;YACP,YAAY,EAAE,UAAU,CAAC,MAAM;YAC/B,UAAU;SACV,CAAC,CAAC;IACJ,CAAC;IAEM,QAAQ;QACd,OAAO;YACN,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAClC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACxC,CAAC;IACH,CAAC;CACD;AA9MD,wCA8MC"}
+{"version":3,"file":"session-context.js","sourceRoot":"","sources":["../../src/services/session-context.ts"],"names":[],"mappings":";;;;;;AAAA,oDAA4B;AAI5B,iDAAyB;AA6BzB,MAAa,cAAc;IAClB,MAAM,CAAC,SAAS,CAA6B;IACpC,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC7C,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhD,MAAM,KAAK,QAAQ;QACzB,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;YAC/B,cAAc,CAAC,SAAS,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,SAAS,CAAC;IACjC,CAAC;IAEO,cAAc;QACrB,oEAAoE;QACpE,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IAEM,aAAa,CAAC,SAAiB,EAAE,OAAgB,EAAE,QAAiB;QAC1E,MAAM,OAAO,GAAgB;YAC5B,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;SACrB,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,UAAU,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEM,mBAAmB,CAAC,SAAiB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,mBAAmB,CAAC,SAAiB,EAAE,SAAwC;QACrF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,CAAC;IACF,CAAC;IAEM,gBAAgB,CAAC,SAAiB,EAAE,OAAe;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC;YAC1B,aAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;IACF,CAAC;IAEM,aAAa,CAAC,SAAiB;QACrC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3C,OAAO;QACR,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACJ,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,aAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAEM,cAAc;QACpB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEM,kBAAkB,CAAC,OAAe;QACxC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACjF,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,SAAiB;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAe;QAC5C,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAe,EAAE,MAAkB;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAEM,KAAK,CAAC,mBAAmB,CAAC,OAAe;QAC/C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAEM,gBAAgB,CAAC,OAAe,EAAE,SAAkB;QAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,SAAS,GAAe;YAC7B,OAAO;YACP,SAAS;YACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SACtC,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC;IACd,CAAC;IAEM,kBAAkB,CAAC,KAAa;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;IACvE,CAAC;IAEM,4BAA4B,CAAC,KAAa;QAChD,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC;IACpD,CAAC;IAEM,yBAAyB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9D,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACF,CAAC;IACF,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC9B,SAAkB,EAClB,OAAgB;QAEhB,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAEM,KAAK,CAAC,qBAAqB,CACjC,SAAiB,EACjB,OAAe,EACf,QAAiB;QAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjE,OAAO,OAAO,CAAC;IAChB,CAAC;IAEM,QAAQ;QACd,OAAO;YACN,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;YAClC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI;YAClC,gBAAgB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACxC,CAAC;IACH,CAAC;CACD;AAnLD,wCAmLC"}

package/package.json

@@ -1,12 +1,17 @@
 {
   "name": "mcp-creatio",
-  "version": "0.3.10",
+  "version": "0.4.1",
   "main": "dist/index.js",
   "bin": {
     "mcp-creatio": "dist/cli.js"
   },
+  "files": [
+    "dist"
+  ],
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
     "clean": "rimraf ./dist",
     "prebuild": "npm run clean",
     "build": "tsc",
@@ -46,22 +51,26 @@
   "description": "MCP server for Creatio CRM. Connect Claude Desktop, ChatGPT, and GitHub Copilot to Creatio via Model Context Protocol and OData v4.",
   "devDependencies": {
     "@types/express": "5.0.6",
-    "@types/node": "^25.3.0",
-    "@typescript-eslint/eslint-plugin": "^8.56.0",
-    "@typescript-eslint/parser": "^8.56.0",
-    "eslint": "^9.39.3",
+    "@types/node": "^25.9.1",
+    "@types/supertest": "^7.2.0",
+    "@typescript-eslint/eslint-plugin": "^8.59.4",
+    "@typescript-eslint/parser": "^8.59.4",
+    "@vitest/coverage-v8": "^4.1.9",
+    "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-prettier": "^5.5.5",
-    "prettier": "^3.8.1",
+    "prettier": "^3.8.3",
     "rimraf": "^6.1.3",
+    "supertest": "^7.2.2",
     "ts-node": "^10.9.2",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.9"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.26.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "fast-xml-parser": "^5.3.7",
+    "fast-xml-parser": "^5.8.0",
     "jsonwebtoken": "^9.0.3"
   }
 }

package/.dockerignore

@@ -1,12 +0,0 @@
-node_modules
-npm-debug.log
-Dockerfile*
-.dockerignore
-.git
-.gitignore
-.vscode
-coverage
-dist
-*.tsbuildinfo
-.eslintcache
-.cache

package/.editorconfig

@@ -1,14 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = crlf
-insert_final_newline = true
-indent_style = tab
-indent_size = 4
-tab_width = 4
-
-[*.{ts,tsx,js,jsx,json,md,html,css}]
-indent_style = tab
-indent_size = 4
-tab_width = 4

package/.eslintrc.cjs

@@ -1,18 +0,0 @@
-module.exports = {
-  root: true,
-  parser: '@typescript-eslint/parser',
-  parserOptions: {
-    project: ['./tsconfig.json'],
-    tsconfigRootDir: __dirname,
-    sourceType: 'module',
-  },
-  plugins: ['@typescript-eslint', 'prettier'],
-  extends: [
-    'eslint:recommended',
-    'plugin:@typescript-eslint/recommended',
-    'plugin:prettier/recommended',
-  ],
-  rules: {
-    'prettier/prettier': 'error',
-  },
-};

package/.gitattributes

@@ -1,8 +0,0 @@
-# Ensure CRLF in repository for these files
-* text=auto eol=crlf
-*.ts text eol=crlf
-*.tsx text eol=crlf
-*.js text eol=crlf
-*.jsx text eol=crlf
-*.json text eol=crlf
-*.md text eol=crlf

package/.github/workflows/docker-publish.yml

@@ -1,50 +0,0 @@
-name: Docker Build and Publish
-
-on:
-    push:
-        branches: ['main']
-        tags: ['v*.*.*']
-    workflow_dispatch:
-
-jobs:
-    docker:
-        runs-on: ubuntu-latest
-
-        permissions:
-            contents: read
-            packages: write
-
-        steps:
-            - name: Checkout
-              uses: actions/checkout@v4
-
-            - name: Set up QEMU
-              uses: docker/setup-qemu-action@v3
-
-            - name: Set up Docker Buildx
-              uses: docker/setup-buildx-action@v3
-
-            - name: Docker Hub login
-              uses: docker/login-action@v3
-              with:
-                  username: ${{ secrets.DOCKER_USERNAME }}
-                  password: ${{ secrets.DOCKER_PASSWORD }}
-
-            - name: Compute Docker tags from package.json
-              id: vars
-              shell: bash
-              run: |
-                  VERSION=$(jq -r .version package.json)
-                  if [[ -z "$VERSION" || "$VERSION" == "null" ]]; then
-                    echo "Package version is empty" >&2
-                    exit 1
-                  fi
-                  echo "tags=crackish/mcp-creatio:latest,crackish/mcp-creatio:v${VERSION}" >> $GITHUB_OUTPUT
-
-            - name: Build and push
-              uses: docker/build-push-action@v6
-              with:
-                  context: .
-                  push: true
-                  platforms: linux/amd64,linux/arm64
-                  tags: ${{ steps.vars.outputs.tags }}

package/.prettierignore

@@ -1,3 +0,0 @@
-node_modules
-dist
-coverage

package/.prettierrc

@@ -1,9 +0,0 @@
-{
-  "printWidth": 100,
-  "singleQuote": true,
-  "trailingComma": "all",
-  "semi": true,
-  "useTabs": true,
-  "tabWidth": 4,
-  "endOfLine": "crlf"
-}

package/.vscode/launch.json

@@ -1,23 +0,0 @@
-{
-  "version": "0.2.0",
-  "configurations": [
-    {
-      "name": "Debug MCP Creatio",
-      "type": "node",
-      "request": "launch",
-      "cwd": "${workspaceFolder}",
-      "runtimeExecutable": "npm",
-      "runtimeArgs": [
-        "run",
-        "start"
-      ],
-      "console": "integratedTerminal",
-      "internalConsoleOptions": "neverOpen",
-      "env": {
-        "CREATIO_BASE_URL": "https://your-creatio.com",
-        "CREATIO_LOGIN": "Supervisor",
-        "CREATIO_PASSWORD": "Supervisor"
-      }
-    }
-  ]
-}

package/.vscode/mcp.json

@@ -1,13 +0,0 @@
-{
-	"servers": {
-		"creatio_local": {
-			"url": "http://localhost:3000/mcp",
-			"type": "http"
-		},
-		"creatio_demo": {
-			"url": "http://a_vanikhin:7700/mcp",
-			"type": "http"
-		}
-	},
-	"inputs": []
-}

package/.vscode/settings.json

@@ -1,16 +0,0 @@
-{
-  "editor.formatOnSave": true,
-  "editor.insertSpaces": false,
-  "editor.tabSize": 4,
-  "files.eol": "\r\n",
-  "files.encoding": "utf8",
-  "editor.detectIndentation": false,
-  "[typescript]": {
-    "editor.defaultFormatter": "esbenp.prettier-vscode"
-  },
-  "eslint.validate": ["typescript", "typescriptreact"],
-  "editor.codeActionsOnSave": {
-    "source.fixAll": "explicit",
-    "source.fixAll.eslint": "explicit"
-  }
-}

package/Agent.md

@@ -1,187 +0,0 @@
-# Agent Guide: MCP Creatio Server
-
-This document is for AI coding agents contributing to this repository. It explains project purpose, architecture, invariants, and safe extension patterns.
-
-## 1. Purpose
-
-An implementation of a Model Context Protocol (MCP) server that exposes Creatio CRM to MCP-compatible AI clients (Claude Desktop, ChatGPT Connectors, GitHub Copilot, etc.).
-
-Primary goals:
-
-- Provide stable tool surface for CRUD, schema discovery, business process execution.
-- Enforce safe data operations (especially Activities ownership rules, date/time UTC handling).
-- Offer prompts that guide LLMs to use Creatio correctly.
-
-## 2. High-Level Architecture
-
-```
-src/
-  creatio/            ← Low-level Creatio API client & auth providers
-  server/             ← MCP server + HTTP layer (OAuth server, handlers)
-    mcp/              ← MCP tool descriptors, prompts, filters builder
-    oauth/            ← Local OAuth 2.1 authorization server for clients
-  services/           ← Session/token refresh orchestration
-  utils/              ← Reusable helpers (env, network, pkce, context)
-  types/              ← Shared TypeScript interfaces & DTO shapes
-```
-
-Key flows:
-
-1. Client authenticates (legacy credentials OR OAuth2 variants).
-2. MCP server registers tools using descriptors from `server/mcp/tools-data.ts`.
-3. Tool handlers call into `CreatioEngineManager`, which resolves a `CreatioServiceContext` (built from `src/creatio/services/*`) and delegates work to the appropriate provider (CRUD, process, sys-settings, user).
-4. Responses are normalized into MCP content blocks.
-
-### Creatio Service Stack (LLM Cheat Sheet)
-
-```
-CreatioServiceContext
-  ├─ CreatioAuthManager → selects concrete auth provider (legacy / OAuth2 / OAuth2 code)
-  ├─ CreatioHttpClient → transport + logging + retry + header helpers
-  ├─ ODataMetadataStore → caches entity schemas per environment
-  ├─ ODataCrudProvider → implements CrudProvider using http + metadata
-  ├─ ProcessServiceProvider → POSTs to ProcessEngineService
-  ├─ SysSettingsServiceProvider → DataService JSON endpoint
-  └─ UserInfoProvider → UserInfoService for current user data
-```
-
-Usage pattern:
-
-- Handlers never craft raw fetch calls. They work through provider interfaces exposed by the context (`provider.crud`, `provider.process`, etc.).
-- If you need a new Creatio capability, add a dedicated provider (or extend an existing one) and wire it up inside `CreatioServiceContext`.
-- `CreatioHttpClient` should stay transport-focused (auth headers, retries, timing). Keep endpoint-specific logic inside providers or a dedicated endpoint helper.
-
-## 3. Core Modules You Will Touch
-
-| Area                         | File(s)                          | Notes                                                                                                        |
-| ---------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------ |
-| Tool registration            | `src/server/mcp/server.ts`       | Add/remove tool handlers; keep descriptors in separate file.                                                 |
-| Tool schemas & text guidance | `src/server/mcp/tools-data.ts`   | Use `zod` schemas; detailed descriptions help AI reasoning.                                                  |
-| Filters logic                | `src/server/mcp/filters.ts`      | Converts structured JSON filters into OData `$filter` strings.                                               |
-| Prompts                      | `src/server/mcp/prompts-data.ts` | Pre-baked instructional prompts consumed by clients.                                                         |
-| Creatio API                  | `src/creatio/services/*`         | `CreatioServiceContext` composes auth + http client + providers; extend providers instead of bypassing them. |
-| OAuth for clients            | `src/server/oauth/*`             | Maintains tokens for MCP clients; ephemeral memory by default.                                               |
-
-## 4. Invariants & Rules (Do NOT Break)
-
-1. All date/time fields passed to Creatio MUST be UTC ISO8601 with `Z` suffix.
-2. Activity creation: Always set `OwnerId` and `AuthorId` to current user's ContactId obtained via `get-current-user-info` unless user explicitly specifies another owner.
-3. Avoid adding blocking network calls in tool descriptors—descriptors must be static; logic belongs in handlers.
-4. Never silently swallow errors coming from Creatio—log via `log.error` then rethrow.
-5. Keep tool names stable: lowercase kebab-case (e.g. `execute-process`).
-6. Keep authentication precedence: Authorization Code > Client Credentials > Legacy.
-7. Do not leak secrets or access tokens in tool responses.
-8. `READONLY_MODE=true` must guarantee no mutation tools (`create`, `update`, `delete`, `execute-process`) are registered.
-
-## 5. Adding a New Tool (Checklist)
-
-1. Define input shape in `tools-data.ts` using `zod`.
-2. Provide rich description (include examples, edge cases, warnings).
-3. Export descriptor & input schema.
-4. Register in `server.ts` via `_registerHandlerWithDescriptor` (respect readonly mode if mutating).
-5. Implement the handler by calling the appropriate provider on the `CreatioServiceContext` (via `CreatioEngineManager`); if functionality is missing, extend or add a provider under `src/creatio/services` rather than issuing raw fetch calls.
-6. Ensure responses are formatted as `{ content: [{ type: 'text', text: JSON.stringify(result) }] }` when not already MCP native.
-7. Add edge-case validation (empty arrays, invalid GUID, missing required filter fields).
-8. Update documentation (README if public feature; otherwise just Agent.md).
-
-## 6. Error Handling Pattern
-
-- Use `try/catch` in handlers ONLY if you need to wrap/transform the error.
-- Log with contextual tag: `log.error('mcp.tool.handler', err)`.
-- Throw the original error afterward (MCP layer will relay).
-- For validation failures rely on `withValidation(...)` wrapper.
-
-## 7. Logging Guidelines
-
-- Use `log.info('mcp.tool.register', { tool })` when registering tools.
-- Use `log.warn` for non-fatal recoverable issues (e.g., partial data fetch).
-- Use `log.error` strictly for failures that abort the operation.
-
-## 8. Performance Considerations
-
-- Prefer `select` + `expand` to limit payload size; educate users via descriptor text.
-- Batch calls carefully—avoid sequential redundant reads if data already provided.
-- Avoid adding expensive synchronous CPU logic inside handlers.
-
-## 9. Security & Safety
-
-- Never echo passwords or client secrets back to clients.
-- Strip or mask token-like values if accidentally included in objects.
-- Validate GUID format (8-4-4-4-12 hex) when exposing user input into queries.
-
-## 10. Testing (Minimal Approach)
-
-Currently no formal test suite. For quick validation:
-
-- Start server locally (`npm start`) and manually invoke tools from an MCP client.
-- Consider adding lightweight Jest tests for filter builder and client methods (future enhancement).
-
-## 11. Versioning & Release
-
-- Increment `package.json` version; code reads dynamically via `src/version.ts`.
-- Use semantic prefixes in commits: `feat:`, `fix:`, `docs:`, `chore:`.
-- Tag releases: `git tag vX.Y.Z && git push --tags` (manual unless automated later).
-
-## 12. Common Edge Cases
-
-| Case                                      | Mitigation                                                     |
-| ----------------------------------------- | -------------------------------------------------------------- |
-| Empty `select` array supplied             | Preprocess to `undefined` (already handled)                    |
-| Mixed raw `filter` + structured `filters` | Combine with `and` parenthesized in handler                    |
-| Invalid GUID quoting                      | Provide guidance text + possible pre-validation before sending |
-| Large result sets                         | Encourage `top` param (<200 recommended)                       |
-| Readonly mode attempt to mutate           | Ensure mutation tools not registered                           |
-
-## 13. Extending Authentication
-
-If adding new auth provider:
-
-1. Create provider under `src/creatio/auth/providers/` implementing shared interface.
-2. Add selection logic in `auth-manager.ts` maintaining precedence ordering.
-3. Document environment variables clearly in README + Agent.md.
-
-## 14. Prompts Extension
-
-- Add new prompt object in `prompts-data.ts` (`name`, `title`, `description`, `argsSchema`, `callback`).
-- Keep names unique and descriptive.
-- Avoid external network calls inside prompt callbacks.
-
-## 15. Code Style
-
-Baseline rules live in `docs/coding-style.md`. Highlights:
-
-- Keep TypeScript strict (avoid `any`, prefer explicit interfaces).
-- Follow the class-member ordering guide (readonly fields → fields → getters → setters → constructor → methods, each ordered `private → protected → public`).
-- Prefix private fields/methods with `_`.
-- Use existing utility wrappers (e.g., `withValidation`).
-- Keep functions small; single responsibility.
-- Reuse logging tags already established.
-
-## 16. What NOT To Do
-
-- Do not reintroduce removed tools (`search`, `fetch`) unless strong justification & design review.
-- Do not bypass `CreatioServiceContext`/providers with raw fetch calls scattered in handlers.
-- Do not embed long multi-megabyte payloads in commit history (limit sample data).
-
-## 17. Quick Start for Agent Changes
-
-1. Make code edits.
-2. Run `npm run build` to ensure TypeScript passes.
-3. Optionally lint: `npm run lint`.
-4. Commit using conventional message.
-5. Push; consider tag if version bump.
-
-## 18. Future Enhancements (Suggestions)
-
-- Add Jest test suite for filter builder + auth flows.
-- Implement persistent token storage (e.g., file/Redis) for OAuth tokens.
-- Add rate limiting to prevent excessive query load.
-- Provide structured error codes instead of raw messages.
-
-## 19. Contact Points
-
-If you need business logic clarification, check existing descriptor guidance first. Many patterns (date handling, ownership) are documented inline in `tools-data.ts`.
-
----
-
-**Summary:** Focus on safe MCP tool extension around Creatio CRM. Preserve invariants, keep descriptors rich, centralize API interactions, and avoid leaking credentials.

package/Debug.md

@@ -1,32 +0,0 @@
-# Debug Guide
-
-## PowerShell ISE Quick Start
-
-1. Open **Windows PowerShell ISE (x64)** with the working directory set to the project root.
-2. Copy the snippet below into a new script tab (for example, save it as `debug-creatio.ps1`).
-3. Update the placeholder values to match your Creatio instance.
-4. Press `F5` (or click **Run Script**) to launch the server with the desired environment.
-
-```powershell
-# debug-creatio.ps1
-# Sets temporary environment variables for the current ISE session
-# and starts the MCP Creatio server in development mode.
-
-$env:CREATIO_BASE_URL = "https://your-creatio.com"
-$env:CREATIO_LOGIN = "your_login"
-$env:CREATIO_PASSWORD = "your_password"
-
-# Optional: adjust logging verbosity or other flags here
-# $env:LOG_LEVEL = "debug"
-
-# Start the server with the configured environment
-npm start
-```
-
-### Notes
-
-- Environment variables assigned with `$env:` live only for the current ISE session; close the session to clear them.
-- If you prefer reusable configuration, convert the snippet into a standalone `.ps1` file and commit the real credentials to a secure secrets manager instead of the repository.
-- When debugging authentication, consider leveraging the existing logging utilities in `src/log.ts` to inspect token exchange flows.
-- For deeper tracing (e.g., OAuth callback handling), set breakpoints in `src/server/http/creatio-oauth-handlers.ts` and `src/server/mcp/server.ts` before running the script.
-- The `Debug MCP Creatio` configuration in `.vscode/launch.json` mirrors these environment variables; adjust the placeholder values there to attach VS Code's debugger directly to `npm start`.

package/Dockerfile

@@ -1,23 +0,0 @@
-# Minimal Dockerfile for MCP Creatio Server
-# Builds and runs with ts-node (no separate build step)
-
-FROM node:20-alpine AS base
-
-# App directory
-WORKDIR /app
-
-# Install production and dev deps (ts-node, types)
-COPY package.json package-lock.json* ./
-RUN npm ci || npm install
-
-# Copy source
-COPY . .
-
-# Environment (override at runtime)
-ENV PORT=3000
-
-# Expose MCP HTTP port
-EXPOSE 3000
-
-# Start the server (ts-node)
-CMD ["npm", "run", "start"]

package/docs/coding-style.md

@@ -1,30 +0,0 @@
-# Coding Style Guide
-
-This guide defines the class/member layout used across the project so every contributor (human or LLM) can keep the codebase consistent and easy to read.
-
-## Class Member Ordering
-
-Group class members in the following order. Within each group sort by access level: `private` → `protected` → `public`.
-
-1. **Fields (readonly)** – immutable state declared with `readonly`.
-2. **Fields** – mutable fields.
-3. **Properties (getters only)**.
-4. **Properties with setters** – getter/setter pairs.
-5. **Constructors**.
-6. **Methods** – regular functions (again `private`, `protected`, `public`).
-
-Additional rules:
-
-- Prefix all private fields and methods with `_` (e.g., `_cache`, `_buildRequest`).
-- Prefer `protected` for members intended for subclasses, otherwise keep them `private` or `public`.
-- Avoid interleaving unrelated helper functions; keep the order strict even when a method depends on another declared later.
-- Use whitespace between groups to keep sections visually distinct.
-
-## Clean Code Expectations
-
-- Keep methods small and single-purpose. Extract helpers rather than nesting complex logic.
-- Use descriptive names; avoid abbreviations unless they are domain-specific and already established.
-- Log through the shared `log` helper. Never swallow errors silently.
-- Adhere to existing TypeScript strictness (no implicit `any`).
-
-When updating or creating a class, run through this list to ensure the structure matches before submitting changes.