rhombus-node-mcp 0.1.35 → 0.1.43

package/dist/api/get-accessible-apps.js

@@ -2,15 +2,18 @@ import { logger } from "../logger.js";
 import { postApi } from "../network/network.js";
 /**
  * Fetches `user.accessibleRhombusApps` from getCurrentUser for the given session.
- * Result is cached in-memory for the lifetime of the session. Returns null on
- * error or missing session; callers should fall back to a permissive default.
+ * Successful results are cached in-memory for the lifetime of the session;
+ * failures are NOT cached so transient errors don't poison the session.
+ * Returns null on error or missing session; callers should fall back to a
+ * permissive default.
  */
 const cache = new Map();
 export async function resolveAccessibleApps(sessionId) {
     if (!sessionId)
         return null;
-    if (cache.has(sessionId))
-        return cache.get(sessionId) ?? null;
+    const cached = cache.get(sessionId);
+    if (cached !== undefined)
+        return cached;
     try {
         const res = await postApi({
             route: "/customer/getCurrentUser",
@@ -19,7 +22,6 @@ export async function resolveAccessibleApps(sessionId) {
         });
         if (res.error) {
             logger.warn(`resolveAccessibleApps: getCurrentUser failed for session ${sessionId}`);
-            cache.set(sessionId, null);
             return null;
         }
         const apps = (res.user?.accessibleRhombusApps ?? []).filter((a) => a !== null && a !== undefined);
@@ -29,7 +31,6 @@ export async function resolveAccessibleApps(sessionId) {
     }
     catch (e) {
         logger.warn(`resolveAccessibleApps: error for session ${sessionId}: ${String(e)}`);
-        cache.set(sessionId, null);
         return null;
     }
 }

package/dist/auth-context.js

@@ -0,0 +1,2 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+export const requestAuthContext = new AsyncLocalStorage();

package/dist/filtering-utils.js

@@ -295,9 +295,35 @@ export function createFilteringProxy(server, blacklist = new Set()) {
                 if (blacklist.has(name)) {
                     return target.registerTool(name, config, handler);
                 }
+                let descriptionSuffix = FILTERING_DESCRIPTION_SUFFIX;
+                if (config.outputSchema) {
+                    try {
+                        let schema;
+                        if (config.outputSchema instanceof z.ZodType) {
+                            schema = config.outputSchema;
+                        }
+                        else if (typeof config.outputSchema === "object") {
+                            schema = z.object(config.outputSchema);
+                        }
+                        else {
+                            schema = config.outputSchema;
+                        }
+                        const paths = zodToDotNotationPaths(schema);
+                        if (paths.length > 0) {
+                            const filteredPaths = [...new Set(paths.filter((p) => p !== "requestType" && p !== "error" && p.trim() !== ""))].sort();
+                            if (filteredPaths.length > 0) {
+                                descriptionSuffix += `\n\n**Available output field paths for this tool's \`includeFields\` / \`filterBy\`:**\n` +
+                                    filteredPaths.map((p) => `- \`"${p}"\``).join("\n");
+                            }
+                        }
+                    }
+                    catch (error) {
+                        // Fall back to the default description suffix on parsing failure
+                    }
+                }
                 const augmentedConfig = {
                     ...config,
-                    description: (config.description ?? "") + FILTERING_DESCRIPTION_SUFFIX,
+                    description: (config.description ?? "") + descriptionSuffix,
                     inputSchema: {
                         ...config.inputSchema,
                         includeFields: INCLUDE_FIELDS_ARG,

package/dist/network/network.js

@@ -1,5 +1,5 @@
 import { logger } from "../logger.js";
-import { authStore } from "../transports/streamable-http.js";
+import { requestAuthContext } from "../auth-context.js";
 export const RHOMBUS_API_KEY = process.env.RHOMBUS_API_KEY;
 export const serverUrl = process.env.RHOMBUS_API_SERVER || "api2.rhombussystems.com";
 export const BASE_URL = `https://${serverUrl}/api`;
@@ -26,50 +26,48 @@ export const appendQueryParams = (url, params) => {
     const queryString = existingSearchParams.toString();
     return queryString ? `${baseUrl}?${queryString}` : baseUrl;
 };
-export function constructRequestHeaders(url, modifiers, sessionId) {
-    // construct auth headers
+export function constructRequestHeaders(url, modifiers, sessionId // kept for API compatibility; ignored — always uses AsyncLocalStorage
+) {
+    // construct auth headers from async context (stateless: set per-request by the transport handler)
     let authHeaders = {};
-    if (!sessionId) {
-        // if no sessionId, we fall back to the api key in our environment variables
-        authHeaders = AUTH_HEADERS;
-    }
-    else {
-        // use sessionId to get auth
-        const auth = authStore.get(sessionId);
-        if (!auth) {
-            logger.error(`No auth found for sessionId: ${sessionId}`);
-            throw new Error(`No auth found for sessionId: ${sessionId}`);
-        }
-        if ("oauthToken" in auth) {
+    const contextAuth = requestAuthContext.getStore();
+    if (contextAuth) {
+        if ("oauthBearer" in contextAuth) {
+            // The Bearer is an opaque Rhombus access token issued by the Rhombus
+            // OAuth 2.1 authorization server. api2 validates it directly.
             authHeaders = {
-                Authorization: `Bearer ${auth.oauthToken}`,
+                "x-auth-access-token": contextAuth.oauthBearer,
                 "x-auth-scheme": "api-oauth-token",
             };
         }
-        else if ("apiKey" in auth) {
+        else if ("apiKey" in contextAuth) {
             authHeaders = {
-                "x-auth-apikey": auth.apiKey,
+                "x-auth-apikey": contextAuth.apiKey,
                 "x-auth-scheme": "api-token",
             };
         }
-        else if ("sessionId" in auth) {
+        else if ("sessionId" in contextAuth) {
             authHeaders = {
-                "x-auth-session": auth.sessionId,
-                "x-auth-chat": auth.latestRecordUuid,
+                "x-auth-session": contextAuth.sessionId,
+                "x-auth-chat": contextAuth.latestRecordUuid,
                 "x-auth-scheme": "chatbot",
             };
-            url = appendQueryParams(url, { _rs: auth.sessionId });
+            url = appendQueryParams(url, { _rs: contextAuth.sessionId });
         }
-        else if ("cookie" in auth) {
+        else if ("cookie" in contextAuth) {
             authHeaders = {
                 "x-auth-scheme": "web2",
-                cookie: auth.cookie,
+                cookie: contextAuth.cookie,
             };
-            if ("sessionAlias" in auth) {
-                url = appendQueryParams(url, { _rs: auth.sessionAlias });
+            if (contextAuth.sessionAlias) {
+                url = appendQueryParams(url, { _rs: contextAuth.sessionAlias });
             }
         }
     }
+    else {
+        // no async context — fall back to env API key (local dev / stdio)
+        authHeaders = AUTH_HEADERS;
+    }
     // merge headers
     const requestHeaders = {
         ...STATIC_HEADERS,

package/dist/transports/streamable-http.js

@@ -1,211 +1,188 @@
-import crypto from "node:crypto";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
 import cors from "cors";
 import express from "express";
-import { clearAccessibleAppsCache } from "../api/get-accessible-apps.js";
+import { requestAuthContext } from "../auth-context.js";
 import createServer from "../createServer.js";
 import { logger } from "../logger.js";
+// ---------------------------------------------------------------------------
+// x-auth-* header extraction (internal chatbot / API key clients) — UNCHANGED
+// ---------------------------------------------------------------------------
 var AuthScheme;
 (function (AuthScheme) {
-    AuthScheme["OAUTH"] = "oauth";
     AuthScheme["API_TOKEN"] = "api-token";
     AuthScheme["CHATBOT"] = "chatbot";
     AuthScheme["WEB2"] = "web2";
 })(AuthScheme || (AuthScheme = {}));
-export const authStore = new Map();
-const transports = new Map();
-/**
- * Populate authStore for the given sessionId based on the request headers.
- * Done up-front (before createServer) so resolveAccessibleApps can read auth
- * during tool registration. Returns true on success.
- */
-function populateAuthStore(req, sessionId) {
-    const oauthToken = req.headers["x-auth-access-token"];
-    const authScheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN;
-    if (oauthToken && typeof oauthToken === "string") {
-        authStore.set(sessionId, { oauthToken, createdMs: Date.now() });
-        logger.info(`🔒 MCP request authenticated with oauth token (session ${sessionId})`);
-        return true;
+function extractAuth(req) {
+    const scheme = req.headers["x-auth-scheme"] ?? AuthScheme.API_TOKEN;
+    if (scheme === AuthScheme.API_TOKEN) {
+        const apiKey = req.headers["x-auth-apikey"] ?? process.env.RHOMBUS_API_KEY;
+        if (!apiKey)
+            return null;
+        return { apiKey };
     }
-    if (authScheme === AuthScheme.API_TOKEN) {
-        const apiKey = "x-auth-apikey" in req.headers
-            ? req.headers["x-auth-apikey"]
-            : process.env.RHOMBUS_API_KEY;
-        if (!apiKey) {
-            logger.warn("populateAuthStore: API_TOKEN scheme but no api key found");
-            return false;
-        }
-        logger.info(`🔒 MCP request authenticated with api key (session ${sessionId})`);
-        authStore.set(sessionId, { apiKey, createdMs: Date.now() });
-        return true;
+    if (scheme === AuthScheme.CHATBOT) {
+        const sessionId = req.headers["x-auth-session"];
+        const latestRecordUuid = req.headers["x-auth-chat"];
+        if (!sessionId || !latestRecordUuid)
+            return null;
+        return { sessionId, latestRecordUuid };
     }
-    if (authScheme === AuthScheme.CHATBOT &&
-        "x-auth-session" in req.headers &&
-        "x-auth-chat" in req.headers) {
-        logger.info(`🔒 MCP request authenticated with x-auth-session: ${req.headers["x-auth-session"]} and x-auth-chat: ${req.headers["x-auth-chat"]}`);
-        authStore.set(sessionId, {
-            sessionId: req.headers["x-auth-session"],
-            latestRecordUuid: req.headers["x-auth-chat"],
-            createdMs: Date.now(),
-        });
-        return true;
+    if (scheme === AuthScheme.WEB2) {
+        const cookie = req.headers["x-auth-cookie"];
+        if (!cookie)
+            return null;
+        return { cookie, sessionAlias: req.headers["x-auth-session-alias"] };
     }
-    if (authScheme === AuthScheme.WEB2 && "x-auth-cookie" in req.headers) {
-        logger.info(`🔒 MCP request authenticated with x-auth-cookie (session ${sessionId})`);
-        authStore.set(sessionId, {
-            cookie: req.headers["x-auth-cookie"],
-            sessionAlias: req.headers["x-auth-session-alias"],
-            createdMs: Date.now(),
-        });
-        return true;
-    }
-    logger.warn(`populateAuthStore: invalid auth scheme. x-auth-scheme: ${req.headers["x-auth-scheme"]}, x-auth-session: ${req.headers["x-auth-session"]}, x-auth-chat: ${req.headers["x-auth-chat"]}`);
-    return false;
+    return null;
 }
+// ---------------------------------------------------------------------------
+// Transport
+//
+// Pure RFC 9728 OAuth 2.1 Resource Server. The Rhombus authorization server
+// (RFC 8414 issuer) is configured via OAUTH_AS_ISSUER_URL — e.g. set it to
+// the Rhombus auth host whose /.well-known/oauth-authorization-server
+// document advertises /authorize, /token, /register, /revoke per
+// RFC 6749 + 7636 + 7591 + 7009.
+//
+// The AS issues opaque Rhombus access tokens, so the MCP server does no
+// local validation — it just forwards the Bearer to api2 as
+// x-auth-access-token, which api2 already knows how to validate.
+//
+// The legacy x-auth-* dispatch for internal callers (chatbot, API-key, web2)
+// is unchanged.
+// ---------------------------------------------------------------------------
 export default function streamableHttpTransport() {
     const app = express();
     app.use(express.json());
+    const oauthAsIssuerUrl = process.env.OAUTH_AS_ISSUER_URL;
+    const mcpServerUrl = process.env.MCP_SERVER_URL;
+    const allowedHost = process.env.ALLOWED_HOST;
+    const allowedHosts = allowedHost
+        ? allowedHost
+            .split(",")
+            .map(h => h.trim())
+            .filter(Boolean)
+        : [];
     app.use(cors({
-        // TODO: domain
         origin: ["*"],
         exposedHeaders: ["mcp-session-id"],
-        allowedHeaders: ["Content-Type", "mcp-session-id"],
+        allowedHeaders: [
+            "Content-Type",
+            "Authorization",
+            "mcp-session-id",
+            "x-auth-scheme",
+            "x-auth-apikey",
+            "x-auth-session",
+            "x-auth-chat",
+            "x-auth-cookie",
+            "x-auth-session-alias",
+        ],
     }));
-    /**
-     * STATEFUL ENDPOINT
-     */
-    const authRequired = ["tools/call"];
-    app.post("/mcp", async (req, res) => {
-        logger.info(`Received MCP request`, JSON.stringify(req.body, null, 2));
-        // Check for existing session ID
-        const sessionId = req.headers["mcp-session-id"];
-        let transport;
-        if (sessionId && transports.has(sessionId)) {
-            // Reuse existing transport
-            const _transport = transports.get(sessionId);
-            if (!_transport) {
-                throw new Error(`Transport not found for sessionId: ${sessionId}`);
-            }
-            transport = _transport;
+    app.get("/health", (_, res) => {
+        res.status(200).json({ status: "ok" });
+    });
+    if (oauthAsIssuerUrl) {
+        logger.info(`OAuth Resource Server — AS at ${oauthAsIssuerUrl}`);
+    }
+    else {
+        logger.info("OAUTH_AS_ISSUER_URL not set — Bearer tokens will be rejected. Set this to the Rhombus authorization server issuer URL (e.g. https://auth-web.<env>.rhombussystems.com/).");
+    }
+    // RFC 9728 — Protected Resource Metadata. Points clients at the Rhombus AS.
+    // Preserves the issuer URL verbatim so the value matches the `issuer` field
+    // strict OAuth clients (Claude Desktop, etc.) read from the AS metadata.
+    app.get("/.well-known/oauth-protected-resource", (req, res) => {
+        if (!oauthAsIssuerUrl) {
+            res.status(404).json({ error: "oauth_not_configured" });
+            return;
         }
-        else if (!sessionId && isInitializeRequest(req.body)) {
-            // New initialization request — mint our sessionId up front so we can
-            // populate authStore and gate tool registration BEFORE the SDK calls
-            // onsessioninitialized.
-            const newSessionId = crypto.randomUUID();
-            const authOk = populateAuthStore(req, newSessionId);
-            if (!authOk && authRequired.includes(req.body.method)) {
-                logger.error(`Auth required for ${req.body.method} but auth could not be populated`);
-                res
-                    .status(401)
-                    .setHeader("WWW-Authenticate", `Bearer realm="${process.env.REALM}", error="invalid_token", error_description="The access token is missing or invalid"`)
-                    .send("Unauthorized");
-                return;
+        res.json({
+            resource: mcpServerUrl ?? `${getSelfOrigin(req, mcpServerUrl)}/mcp`,
+            authorization_servers: [oauthAsIssuerUrl],
+            scopes_supported: ["rhombus:access"],
+            bearer_methods_supported: ["header"],
+        });
+    });
+    const handleMcpRequest = async (req, res) => {
+        logger.info("Received MCP request");
+        let auth = null;
+        const authHeader = req.headers.authorization;
+        if (authHeader?.startsWith("Bearer ")) {
+            if (!oauthAsIssuerUrl) {
+                return reject401(req, res, mcpServerUrl, "OAuth not configured: set OAUTH_AS_ISSUER_URL");
             }
-            transport = new StreamableHTTPServerTransport({
-                sessionIdGenerator: () => newSessionId,
-                onsessioninitialized: sessionId => {
-                    transports.set(sessionId, transport);
-                    logger.info(`🔒 MCP request initialized with sessionId: ${sessionId}`);
-                },
-                // DNS rebinding protection is disabled by default for backwards compatibility. If you are running this server
-                // locally, make sure to set:
-                // enableDnsRebindingProtection: true,
-                // allowedHosts: ['127.0.0.1'],
-            });
-            // Clean up transport when closed
-            transport.onclose = () => {
-                if (transport.sessionId) {
-                    transports.delete(transport.sessionId);
-                    authStore.delete(transport.sessionId);
-                    clearAccessibleAppsCache(transport.sessionId);
-                }
-            };
-            // newSessionId is already in authStore; createServer can resolve
-            // accessibleRhombusApps and pick the right tool set.
-            const server = await createServer({ sessionId: newSessionId });
-            // Connect to the MCP server
-            await server.connect(transport);
-            logger.info(`🔗 Transport connected with sessionId: ${newSessionId}`);
+            const token = authHeader.slice(7).trim();
+            if (!token) {
+                return reject401(req, res, mcpServerUrl, "empty Bearer token");
+            }
+            auth = { oauthBearer: token };
+            logger.info("MCP request authenticated via Bearer (opaque, forwarded to api2)");
         }
         else {
-            // Invalid request
-            res.status(400).json({
-                jsonrpc: "2.0",
-                error: {
-                    code: -32000,
-                    message: "Bad Request: No valid session ID provided",
-                },
-                id: null,
-            });
-            return;
+            auth = extractAuth(req);
+            if (!auth) {
+                return reject401(req, res, mcpServerUrl, "no credentials presented");
+            }
+            logger.info("MCP request authenticated via x-auth-* headers");
         }
-        await transport.handleRequest(req, res, req.body);
-    });
-    app.get("/mcp", async (_, res) => {
-        logger.warn("Received Not Allowed GET MCP request");
-        res.writeHead(405).end(JSON.stringify({
-            jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
-            id: null,
-        }));
-    });
-    app.delete("/mcp", async (req, res) => {
-        logger.warn("Received Not Allowed DELETE MCP request");
-        res.writeHead(405).end(JSON.stringify({
-            jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
-            id: null,
-        }));
-    });
-    /**
-     * STATELESS ENDPOINT
-     */
-    app.post("/mcp-stateless", async (req, res) => {
-        logger.info(`Received stateless MCP request`, req.body);
-        let transport;
-        transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
+        await requestAuthContext.run(auth, async () => {
+            const transport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+                ...(allowedHosts.length > 0 ? { enableDnsRebindingProtection: true, allowedHosts } : {}),
+            });
+            const server = await createServer();
+            await server.connect(transport);
+            logger.info("🔗 Stateless MCP Transport connected");
+            await transport.handleRequest(req, res, req.body);
         });
-        const server = await createServer();
-        // Connect to the MCP server
-        await server.connect(transport);
-        logger.info(`🔗 Stateless Transport connected`);
-        // Handle the request
-        await transport.handleRequest(req, res, req.body);
-    });
-    app.get("/mcp-stateless", async (req, res) => {
-        logger.warn("Received Not Allowed GET MCP request");
+    };
+    app.post("/mcp", handleMcpRequest);
+    app.get("/mcp", (_, res) => {
         res.writeHead(405).end(JSON.stringify({
             jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
+            error: { code: -32000, message: "Method not allowed." },
             id: null,
         }));
     });
-    app.delete("/mcp-stateless", async (req, res) => {
-        logger.warn("Received Not Allowed DELETE MCP request");
+    app.delete("/mcp", (_, res) => {
         res.writeHead(405).end(JSON.stringify({
             jsonrpc: "2.0",
-            error: {
-                code: -32000,
-                message: "Method not allowed.",
-            },
+            error: { code: -32000, message: "Method not allowed." },
             id: null,
         }));
     });
-    // Start the server
-    const PORT = process.env.PORT || 3000;
+    const PORT = process.env.PORT ?? 3000;
     app.listen(PORT, () => {
         logger.info(`rhombus-node-mcp listening on port ${PORT}`);
     });
 }
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function reject401(req, res, mcpServerUrl, msg) {
+    const resourceMetadataUrl = `${getSelfOrigin(req, mcpServerUrl)}/.well-known/oauth-protected-resource`;
+    res
+        .status(401)
+        .set("WWW-Authenticate", `Bearer error="invalid_token", error_description="${escapeWwwAuth(msg)}", resource_metadata="${resourceMetadataUrl}"`)
+        .json({
+        jsonrpc: "2.0",
+        error: { code: -32000, message: `Unauthorized: ${msg}` },
+        id: null,
+    });
+}
+function getSelfOrigin(req, mcpServerUrl) {
+    if (mcpServerUrl) {
+        try {
+            return new URL(mcpServerUrl).origin;
+        }
+        catch {
+            // fall through
+        }
+    }
+    const proto = req.headers["x-forwarded-proto"] ?? req.protocol;
+    const host = req.headers.host ?? "localhost";
+    return `${proto}://${host}`;
+}
+function escapeWwwAuth(s) {
+    return s.replace(/["\r\n]/g, "");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rhombus-node-mcp",
-  "version": "0.1.35",
+  "version": "0.1.43",
   "description": "MCP server for Rhombus API",
   "keywords": [
     "ai",
@@ -56,9 +56,7 @@
     "cors": "^2.8.5",
     "dotenv": "^16.5.0",
     "express": "^5.1.0",
-    "express-jwt": "^8.5.1",
     "faiss-node": "^0.5.1",
-    "jsonwebtoken": "^9.0.2",
     "langchain": "^0.3.30",
     "log4js": "^6.9.1",
     "luxon": "^3.6.1",
@@ -69,7 +67,6 @@
   "devDependencies": {
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
-    "@types/jwt-express": "^1.1.6",
     "@types/luxon": "^3.6.2",
     "@types/node": "^22.14.0",
     "openapi-typescript-codegen": "^0.29.0",