msteams-mcp 0.30.1 → 0.30.2

package/dist/auth/session-store.d.ts

@@ -63,6 +63,11 @@ export declare function writeSessionState(state: SessionState): void;
  * Deletes the session state file.
  */
 export declare function clearSessionState(): void;
+/**
+ * Deletes everything stored locally: browser profile (cookies, MSAL caches,
+ * every account ever signed in), session state and token cache.
+ */
+export declare function clearAllLocalData(): void;
 /**
  * Gets the age of the session state in hours.
  */

package/dist/auth/session-store.js

@@ -86,6 +86,13 @@ export function clearSessionState() {
         fs.unlinkSync(SESSION_STATE_PATH);
     }
 }
+/**
+ * Deletes everything stored locally: browser profile (cookies, MSAL caches,
+ * every account ever signed in), session state and token cache.
+ */
+export function clearAllLocalData() {
+    fs.rmSync(CONFIG_DIR, { recursive: true, force: true });
+}
 /**
  * Gets the age of the session state in hours.
  */

package/dist/tools/auth-tools.js

@@ -5,12 +5,12 @@ import { createRequire } from 'module';
 import { z } from 'zod';
 const require = createRequire(import.meta.url);
 const pkg = require('../../package.json');
-import { hasSessionState, isSessionLikelyExpired, clearSessionState, clearTokenCache, } from '../auth/session-store.js';
+import { hasSessionState, isSessionLikelyExpired, clearAllLocalData, } from '../auth/session-store.js';
 import { getSubstrateTokenStatus, getMessageAuthStatus, extractMessageAuth, extractCsaToken, extractSubstrateToken, extractSkypeSpacesToken, } from '../auth/token-extractor.js';
 import { refreshTokensViaHttp } from '../auth/token-refresh-http.js';
 import { createBrowserContext, closeBrowser } from '../browser/context.js';
 import * as log from '../utils/logger.js';
-import { resetAssignmentsAvailability } from '../utils/auth-guards.js';
+import { resetAssignmentsAvailability, clearRegionCache } from '../utils/auth-guards.js';
 import { ensureAuthenticated } from '../browser/auth.js';
 // ─────────────────────────────────────────────────────────────────────────────
 // Schemas
@@ -29,7 +29,7 @@ const loginToolDefinition = {
         properties: {
             forceNew: {
                 type: 'boolean',
-                description: 'Force a new login even if a session exists (default: false)',
+                description: 'Delete all previous login data (browser profile, cookies, saved session, every previously signed-in account) and sign in from scratch in a visible browser. Use to switch accounts or recover a broken session (default: false)',
             },
         },
     },
@@ -76,36 +76,32 @@ async function handleLogin(input) {
     // A fresh login may have changed what the account can access (e.g. new consent)
     resetAssignmentsAvailability();
     if (input.forceNew) {
-        clearSessionState();
-        clearTokenCache();
+        // Start from nothing: no profile, cookies, MSAL cache or session from any
+        // earlier account can survive to be mixed into the new login.
+        clearAllLocalData();
+        clearRegionCache();
+        return loginInVisibleBrowser();
     }
-    else {
-        // Fast path: if tokens are still valid, skip browser entirely
-        const tokenStatus = getSubstrateTokenStatus();
-        if (tokenStatus.hasToken && tokenStatus.minutesRemaining >= TOKEN_VALID_THRESHOLD_MINUTES) {
-            await fillCoreCredentialGaps();
-            return {
-                success: true,
-                data: {
-                    message: `Already authenticated. Token valid for ${tokenStatus.minutesRemaining} more minutes.`,
-                    tokenStatus: {
-                        expiresAt: tokenStatus.expiresAt,
-                        minutesRemaining: tokenStatus.minutesRemaining,
-                    },
+    // Fast path: if tokens are still valid, skip browser entirely
+    const tokenStatus = getSubstrateTokenStatus();
+    if (tokenStatus.hasToken && tokenStatus.minutesRemaining >= TOKEN_VALID_THRESHOLD_MINUTES) {
+        await fillCoreCredentialGaps();
+        return {
+            success: true,
+            data: {
+                message: `Already authenticated. Token valid for ${tokenStatus.minutesRemaining} more minutes.`,
+                tokenStatus: {
+                    expiresAt: tokenStatus.expiresAt,
+                    minutesRemaining: tokenStatus.minutesRemaining,
                 },
-            };
-        }
+            },
+        };
     }
     // Headless-first strategy:
     // The persistent browser profile retains Microsoft's long-lived session cookies,
-    // so headless SSO can succeed even without a session-state file. Always try
-    // headless first — even for forceNew. Most recovery scenarios complete silently.
+    // so headless SSO can succeed even without a session-state file.
     const headless = await createBrowserContext({ headless: true });
     try {
-        if (input.forceNew) {
-            // Clear persistent profile cookies to force fresh authentication
-            await headless.context.clearCookies();
-        }
         await ensureAuthenticated(headless.page, headless.context, (msg) => log.info('login:headless', msg), false, // No overlay in headless
         true // Headless mode - throw immediately if user interaction required
         );
@@ -122,7 +118,10 @@ async function handleLogin(input) {
         log.warn('login:headless', `Headless SSO failed, falling back to visible browser: ${error instanceof Error ? error.message : String(error)}`);
         await closeBrowser(headless, false).catch(() => { });
     }
-    // Open visible browser for user interaction
+    return loginInVisibleBrowser();
+}
+/** Opens a visible browser for the user to sign in, then saves the session. */
+async function loginInVisibleBrowser() {
     const visible = await createBrowserContext({ headless: false });
     try {
         await ensureAuthenticated(visible.page, visible.context, (msg) => log.info('login', msg));

package/dist/tools/auth-tools.test.js

@@ -2,8 +2,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 vi.mock('../auth/session-store.js', () => ({
     hasSessionState: vi.fn(() => true),
     isSessionLikelyExpired: vi.fn(() => false),
-    clearSessionState: vi.fn(),
-    clearTokenCache: vi.fn(),
+    clearAllLocalData: vi.fn(),
 }));
 vi.mock('../auth/token-extractor.js', () => ({
     getSubstrateTokenStatus: vi.fn(),
@@ -16,8 +15,9 @@ vi.mock('../auth/token-extractor.js', () => ({
 vi.mock('../auth/token-refresh-http.js', () => ({ refreshTokensViaHttp: vi.fn() }));
 vi.mock('../browser/context.js', () => ({ createBrowserContext: vi.fn(), closeBrowser: vi.fn() }));
 vi.mock('../browser/auth.js', () => ({ ensureAuthenticated: vi.fn() }));
-vi.mock('../utils/auth-guards.js', () => ({ resetAssignmentsAvailability: vi.fn() }));
+vi.mock('../utils/auth-guards.js', () => ({ resetAssignmentsAvailability: vi.fn(), clearRegionCache: vi.fn() }));
 import { loginTool } from './auth-tools.js';
+import { clearAllLocalData } from '../auth/session-store.js';
 import { getSubstrateTokenStatus, extractMessageAuth, extractCsaToken, extractSubstrateToken, extractSkypeSpacesToken, } from '../auth/token-extractor.js';
 import { refreshTokensViaHttp } from '../auth/token-refresh-http.js';
 import { createBrowserContext, closeBrowser } from '../browser/context.js';
@@ -49,12 +49,26 @@ describe('teams_login core credential top-up', () => {
     });
     it('tops up after a forced browser login leaves the CSA token behind', async () => {
         sessionMissingCsaToken();
-        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: { clearCookies: vi.fn() } });
+        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: {} });
         vi.mocked(closeBrowser).mockResolvedValue(undefined);
         const result = await loginTool.handler({ forceNew: true });
         expect(result.success).toBe(true);
         expect(refreshTokensViaHttp).toHaveBeenCalledOnce();
     });
+    it('forceNew wipes all previous login data and signs in from scratch in a visible browser', async () => {
+        sessionMissingCsaToken();
+        vi.mocked(extractCsaToken).mockReturnValue('csa');
+        vi.mocked(createBrowserContext).mockResolvedValue({ page: {}, context: {} });
+        vi.mocked(closeBrowser).mockResolvedValue(undefined);
+        await loginTool.handler({ forceNew: true });
+        expect(clearAllLocalData).toHaveBeenCalledOnce();
+        expect(vi.mocked(clearAllLocalData).mock.invocationCallOrder[0])
+            .toBeLessThan(vi.mocked(createBrowserContext).mock.invocationCallOrder[0]);
+        // Valid-looking tokens from the old session must not short-circuit the login,
+        // and a wiped profile has nothing for headless SSO to use.
+        expect(createBrowserContext).toHaveBeenCalledOnce();
+        expect(createBrowserContext).toHaveBeenCalledWith({ headless: false });
+    });
     it('still reports success when the top-up fails', async () => {
         sessionMissingCsaToken();
         vi.mocked(refreshTokensViaHttp).mockResolvedValue({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "msteams-mcp",
-  "version": "0.30.1",
+  "version": "0.30.2",
   "description": "MCP server for Microsoft Teams - search messages, send replies, manage favourites",
   "type": "module",
   "main": "dist/index.js",