ms365-mcp-server 1.1.1 → 1.1.2

package/dist/index.js

@@ -55,7 +55,7 @@ function parseArgs() {
 }
 const server = new Server({
     name: "ms365-mcp-server",
-    version: "1.1.1"
+    version: "1.1.2"
 }, {
     capabilities: {
         resources: {

package/dist/utils/ms365-auth-enhanced.js

@@ -24,6 +24,7 @@ const DEFAULT_TENANT_ID = "common";
 const CONFIG_DIR = path.join(os.homedir(), '.ms365-mcp');
 const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json');
 const DEVICE_CODE_FILE = path.join(CONFIG_DIR, 'device-code.json');
+const TOKEN_CACHE_FILE = path.join(CONFIG_DIR, 'msal-cache.json');
 /**
  * Enhanced Microsoft 365 authentication manager with device code flow support
  */
@@ -97,13 +98,42 @@ export class EnhancedMS365Auth {
         }
     }
     /**
-     * Initialize MSAL client based on auth type
+     * Initialize MSAL client based on auth type with persistent token cache
      */
     initializeMsalClient() {
         if (!this.credentials) {
             throw new Error('Credentials not loaded');
         }
+        // Return existing client if already initialized with same credentials
+        if (this.msalClient) {
+            return this.msalClient;
+        }
         const isConfidential = this.credentials.clientSecret && this.credentials.authType === 'redirect';
+        // Create persistent token cache
+        const cachePlugin = {
+            beforeCacheAccess: async (cacheContext) => {
+                try {
+                    if (fs.existsSync(TOKEN_CACHE_FILE)) {
+                        const cacheData = fs.readFileSync(TOKEN_CACHE_FILE, 'utf8');
+                        cacheContext.tokenCache.deserialize(cacheData);
+                    }
+                }
+                catch (error) {
+                    logger.error('Error loading MSAL token cache:', error);
+                }
+            },
+            afterCacheAccess: async (cacheContext) => {
+                try {
+                    if (cacheContext.cacheHasChanged) {
+                        const cacheData = cacheContext.tokenCache.serialize();
+                        fs.writeFileSync(TOKEN_CACHE_FILE, cacheData);
+                    }
+                }
+                catch (error) {
+                    logger.error('Error saving MSAL token cache:', error);
+                }
+            }
+        };
         if (isConfidential) {
             // Confidential client for redirect-based auth
             const config = {
@@ -112,6 +142,9 @@ export class EnhancedMS365Auth {
                     clientSecret: this.credentials.clientSecret,
                     authority: `https://login.microsoftonline.com/${this.credentials.tenantId}`
                 },
+                cache: {
+                    cachePlugin
+                },
                 system: {
                     loggerOptions: {
                         loggerCallback: (level, message, containsPii) => {
@@ -133,6 +166,9 @@ export class EnhancedMS365Auth {
                     clientId: this.credentials.clientId,
                     authority: `https://login.microsoftonline.com/${this.credentials.tenantId}`
                 },
+                cache: {
+                    cachePlugin
+                },
                 system: {
                     loggerOptions: {
                         loggerCallback: (level, message, containsPii) => {
@@ -147,6 +183,7 @@ export class EnhancedMS365Auth {
             };
             this.msalClient = new PublicClientApplication(config);
         }
+        logger.log('Initialized MSAL client with persistent token cache');
         return this.msalClient;
     }
     /**
@@ -266,14 +303,14 @@ export class EnhancedMS365Auth {
         try {
             const tokenData = {
                 accessToken: token.accessToken,
-                refreshToken: '',
+                refreshToken: '', // MSAL manages refresh tokens internally
                 expiresOn: token.expiresOn?.getTime() || 0,
                 account: token.account,
                 authType: authType
             };
             // Always use a single account key for simplicity
             await credentialStore.setCredentials('ms365-user', tokenData);
-            logger.log('Saved MS365 access token securely');
+            logger.log(`Saved MS365 access token securely (expires: ${new Date(tokenData.expiresOn).toLocaleString()})`);
         }
         catch (error) {
             logger.error('Error saving token:', error);
@@ -331,13 +368,19 @@ export class EnhancedMS365Auth {
      * Get authenticated Microsoft Graph client
      */
     async getGraphClient() {
-        const storedToken = await this.loadStoredToken();
+        let storedToken = await this.loadStoredToken();
         if (!storedToken) {
             throw new Error('No stored token found. Please authenticate first.');
         }
         // Check if token is expired
         if (storedToken.expiresOn < Date.now()) {
+            logger.log('Access token expired, refreshing...');
             await this.refreshToken();
+            // Reload the token after refresh
+            storedToken = await this.loadStoredToken();
+            if (!storedToken) {
+                throw new Error('Failed to refresh token. Please re-authenticate.');
+            }
         }
         const client = Client.init({
             authProvider: (done) => {
@@ -399,9 +442,23 @@ export class EnhancedMS365Auth {
         }
         const msalClient = this.initializeMsalClient();
         try {
+            // Try to get all accounts from MSAL cache first (only available on PublicClientApplication)
+            let accountToUse = storedToken.account;
+            if (msalClient instanceof PublicClientApplication) {
+                const accounts = await msalClient.getAllAccounts();
+                // If we have accounts in MSAL cache, use the first one that matches
+                if (accounts.length > 0) {
+                    const matchingAccount = accounts.find((acc) => acc.username === storedToken.account?.username ||
+                        acc.homeAccountId === storedToken.account?.homeAccountId);
+                    if (matchingAccount) {
+                        accountToUse = matchingAccount;
+                        logger.log('Using account from MSAL cache for token refresh');
+                    }
+                }
+            }
             const tokenResponse = await msalClient.acquireTokenSilent({
                 scopes: SCOPES,
-                account: storedToken.account
+                account: accountToUse
             });
             if (!tokenResponse) {
                 throw new Error('Failed to refresh token - please re-authenticate using: authenticate_with_device_code');
@@ -417,6 +474,9 @@ export class EnhancedMS365Auth {
             else if (error.errorCode === 'consent_required') {
                 throw new Error('Additional consent required. Please re-authenticate using the "authenticate_with_device_code" tool.');
             }
+            else if (error.errorCode === 'no_account_in_silent_request') {
+                throw new Error('No account found in token cache. Please re-authenticate using the "authenticate_with_device_code" tool.');
+            }
             else {
                 logger.error('Token refresh failed:', error);
                 throw new Error(`Token refresh failed: ${error.message}. Please re-authenticate using the "authenticate_with_device_code" tool.`);
@@ -457,6 +517,13 @@ export class EnhancedMS365Auth {
         try {
             await credentialStore.deleteCredentials('ms365-user');
             await this.clearDeviceCodeState();
+            // Clear MSAL token cache
+            if (fs.existsSync(TOKEN_CACHE_FILE)) {
+                fs.unlinkSync(TOKEN_CACHE_FILE);
+                logger.log('Cleared MSAL token cache');
+            }
+            // Reset MSAL client instance to force re-initialization
+            this.msalClient = null;
             logger.log('Cleared stored authentication tokens');
         }
         catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ms365-mcp-server",
-  "version": "1.1.1",
+  "version": "1.1.2",
   "description": "Microsoft 365 MCP Server for managing Microsoft 365 email through natural language interactions with full OAuth2 authentication support",
   "main": "dist/index.js",
   "type": "module",