snow-flow 2.9.4 → 2.9.5

package/dist/mcp/servicenow-deployment-mcp.js

@@ -15,6 +15,7 @@ const scope_manager_js_1 = require("../managers/scope-manager.js");
 const global_scope_strategy_js_1 = require("../strategies/global-scope-strategy.js");
 const artifact_tracker_js_1 = require("../utils/artifact-tracker.js");
 const servicenow_id_generator_js_1 = require("../utils/servicenow-id-generator.js");
+const deployment_auth_fix_js_1 = require("../utils/deployment-auth-fix.js");
 const fs_1 = require("fs");
 const path_1 = require("path");
 class ServiceNowDeploymentMCP {
@@ -30,6 +31,7 @@ class ServiceNowDeploymentMCP {
         this.client = new servicenow_client_js_1.ServiceNowClient();
         this.oauth = new snow_oauth_js_1.ServiceNowOAuth();
         this.logger = new logger_js_1.Logger('ServiceNowDeploymentMCP');
+        this.deploymentAuthManager = new deployment_auth_fix_js_1.DeploymentAuthManager();
         // Initialize global scope management
         this.scopeManager = new scope_manager_js_1.ScopeManager({
             defaultScope: global_scope_strategy_js_1.ScopeType.GLOBAL,
@@ -472,6 +474,45 @@ class ServiceNowDeploymentMCP {
             updateSetName: updateSetName
         };
     }
+    /**
+     * Create a record with automatic 403 error recovery
+     * Will attempt to refresh token and retry once if 403 error occurs
+     */
+    async createRecordWithRetry(table, data) {
+        try {
+            // First attempt
+            return await this.client.createRecord(table, data);
+        }
+        catch (error) {
+            // Check if it's a 403 error
+            if (error.response?.status === 403 || error.message?.includes('403')) {
+                this.logger.warn('Got 403 error, attempting token refresh and retry...');
+                // Refresh token
+                const refreshResult = await this.deploymentAuthManager.forceTokenRefresh();
+                if (refreshResult.success && refreshResult.accessToken) {
+                    // Client will use the new token automatically from unified auth store
+                    // No need to call authenticate - the client reads from auth store
+                    // Retry the operation
+                    try {
+                        this.logger.info('Retrying operation with refreshed token...');
+                        return await this.client.createRecord(table, data);
+                    }
+                    catch (retryError) {
+                        this.logger.error('Retry failed after token refresh:', retryError);
+                        throw retryError;
+                    }
+                }
+                else {
+                    this.logger.error('Failed to refresh token for retry');
+                    throw error;
+                }
+            }
+            else {
+                // Not a 403 error, just re-throw
+                throw error;
+            }
+        }
+    }
     /**
      * Ensure artifact is tracked in current Update Set
      */
@@ -537,17 +578,26 @@ class ServiceNowDeploymentMCP {
     }
     async deployWidget(args) {
         try {
-            // Check authentication first
-            const isAuth = await this.oauth.isAuthenticated();
-            if (!isAuth) {
-                return {
-                    content: [
-                        {
-                            type: 'text',
-                            text: '❌ Not authenticated with ServiceNow.\n\nPlease run: snow-flow auth login\n\nOr configure your .env file with ServiceNow OAuth credentials.',
-                        },
-                    ],
-                };
+            // Enhanced authentication check with token refresh for deployment
+            const authResult = await this.deploymentAuthManager.ensureDeploymentAuth();
+            if (!authResult.isValid) {
+                this.logger.error('Deployment authentication failed:', authResult.error);
+                // If auth failed, try to refresh token
+                const refreshResult = await this.deploymentAuthManager.forceTokenRefresh();
+                if (!refreshResult.success) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `❌ Deployment authentication failed.\n\nError: ${authResult.error || 'Unable to authenticate'}\n\nRecommendations:\n${(authResult.recommendations || ['Run: snow-flow auth login']).map(r => `• ${r}`).join('\n')}\n\nNote: Deployment requires valid OAuth tokens with write permissions.`,
+                            },
+                        ],
+                    };
+                }
+            }
+            // Warn if token may lack write permissions
+            if (!authResult.hasWriteScope) {
+                this.logger.warn('⚠️ Token may lack write permissions, deployment might fail with 403');
             }
             this.logger.info('Deploying widget to ServiceNow', { name: args.name });
             // ENHANCED: Mandatory Update Set management with auto-activation
@@ -695,7 +745,7 @@ class ServiceNowDeploymentMCP {
                 // Strategy 2: Direct table record creation (fallback)
                 try {
                     this.logger.info('🔄 Attempting fallback: Direct table record creation');
-                    result = await this.client.createRecord('sp_widget', {
+                    result = await this.createRecordWithRetry('sp_widget', {
                         name: args.name,
                         id: args.name,
                         title: args.title,
@@ -1069,17 +1119,26 @@ Use \`snow_deployment_debug\` for more information about this session.`,
      */
     async deployPortalPage(args) {
         try {
-            // Check authentication first
-            const isAuth = await this.oauth.isAuthenticated();
-            if (!isAuth) {
-                return {
-                    content: [
-                        {
-                            type: 'text',
-                            text: '❌ Not authenticated with ServiceNow.\n\nPlease run: snow-flow auth login\n\nOr configure your .env file with ServiceNow OAuth credentials.',
-                        },
-                    ],
-                };
+            // Enhanced authentication check with token refresh for deployment
+            const authResult = await this.deploymentAuthManager.ensureDeploymentAuth();
+            if (!authResult.isValid) {
+                this.logger.error('Deployment authentication failed:', authResult.error);
+                // If auth failed, try to refresh token
+                const refreshResult = await this.deploymentAuthManager.forceTokenRefresh();
+                if (!refreshResult.success) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `❌ Deployment authentication failed.\n\nError: ${authResult.error || 'Unable to authenticate'}\n\nRecommendations:\n${(authResult.recommendations || ['Run: snow-flow auth login']).map(r => `• ${r}`).join('\n')}\n\nNote: Deployment requires valid OAuth tokens with write permissions.`,
+                            },
+                        ],
+                    };
+                }
+            }
+            // Warn if token may lack write permissions
+            if (!authResult.hasWriteScope) {
+                this.logger.warn('⚠️ Token may lack write permissions, deployment might fail with 403');
             }
             this.logger.info('Deploying portal page to ServiceNow', { name: args.page_id });
             // Ensure Update Set is active
@@ -1124,7 +1183,7 @@ Use \`snow_deployment_debug\` for more information about this session.`,
             let pageResult;
             try {
                 // Create the page record
-                pageResult = await this.client.createRecord('sp_page', {
+                pageResult = await this.createRecordWithRetry('sp_page', {
                     id: args.page_id,
                     title: args.title,
                     short_description: args.description || `Portal page created by Snow-Flow`,
@@ -1512,17 +1571,26 @@ ${args.widgets && args.widgets.length > 0 ? args.widgets.map((w, i) => `
     }
     async deployFlow(args) {
         try {
-            // Check authentication first
-            const isAuth = await this.oauth.isAuthenticated();
-            if (!isAuth) {
-                return {
-                    content: [
-                        {
-                            type: 'text',
-                            text: '❌ Not authenticated with ServiceNow.\n\nPlease run: snow-flow auth login\n\nOr configure your .env file with ServiceNow OAuth credentials.',
-                        },
-                    ],
-                };
+            // Enhanced authentication check with token refresh for deployment
+            const authResult = await this.deploymentAuthManager.ensureDeploymentAuth();
+            if (!authResult.isValid) {
+                this.logger.error('Deployment authentication failed:', authResult.error);
+                // If auth failed, try to refresh token
+                const refreshResult = await this.deploymentAuthManager.forceTokenRefresh();
+                if (!refreshResult.success) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `❌ Deployment authentication failed.\n\nError: ${authResult.error || 'Unable to authenticate'}\n\nRecommendations:\n${(authResult.recommendations || ['Run: snow-flow auth login']).map(r => `• ${r}`).join('\n')}\n\nNote: Deployment requires valid OAuth tokens with write permissions.`,
+                            },
+                        ],
+                    };
+                }
+            }
+            // Warn if token may lack write permissions
+            if (!authResult.hasWriteScope) {
+                this.logger.warn('⚠️ Token may lack write permissions, deployment might fail with 403');
             }
             // Ensure we have a flow definition
             if (!args.flow_definition) {
@@ -1964,17 +2032,26 @@ ${isComposedFlow ? `
     }
     async deployApplication(args) {
         try {
-            // Check authentication first
-            const isAuth = await this.oauth.isAuthenticated();
-            if (!isAuth) {
-                return {
-                    content: [
-                        {
-                            type: 'text',
-                            text: '❌ Not authenticated with ServiceNow.\n\nPlease run: snow-flow auth login\n\nOr configure your .env file with ServiceNow OAuth credentials.',
-                        },
-                    ],
-                };
+            // Enhanced authentication check with token refresh for deployment
+            const authResult = await this.deploymentAuthManager.ensureDeploymentAuth();
+            if (!authResult.isValid) {
+                this.logger.error('Deployment authentication failed:', authResult.error);
+                // If auth failed, try to refresh token
+                const refreshResult = await this.deploymentAuthManager.forceTokenRefresh();
+                if (!refreshResult.success) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: `❌ Deployment authentication failed.\n\nError: ${authResult.error || 'Unable to authenticate'}\n\nRecommendations:\n${(authResult.recommendations || ['Run: snow-flow auth login']).map(r => `• ${r}`).join('\n')}\n\nNote: Deployment requires valid OAuth tokens with write permissions.`,
+                            },
+                        ],
+                    };
+                }
+            }
+            // Warn if token may lack write permissions
+            if (!authResult.hasWriteScope) {
+                this.logger.warn('⚠️ Token may lack write permissions, deployment might fail with 403');
             }
             this.logger.info('Deploying application with intelligent scope management', { name: args.name });
             // Ensure Update Set is active
@@ -3480,13 +3557,13 @@ Run snow_deployment_debug for basic session info or check the logs for more deta
     async previewWidget(args) {
         try {
             // Check authentication first
-            const isAuth = await this.oauth.isAuthenticated();
-            if (!isAuth) {
+            const authResult = await this.deploymentAuthManager.ensureDeploymentAuth();
+            if (!authResult.isValid) {
                 return {
                     content: [
                         {
                             type: 'text',
-                            text: '❌ Not authenticated with ServiceNow.\n\nPlease run: snow-flow auth login\n\nOr configure your .env file with ServiceNow OAuth credentials.',
+                            text: `❌ Deployment authentication failed.\n\nError: ${authResult.error || 'Unable to authenticate'}\n\nRecommendations:\n${(authResult.recommendations || ['Run: snow-flow auth login']).map(r => `• ${r}`).join('\n')}\n\nNote: Deployment requires valid OAuth tokens with write permissions.`,
                         },
                     ],
                 };
@@ -3653,13 +3730,13 @@ Use \`snow_widget_test\` to run automated tests with different scenarios.`,
     async testWidget(args) {
         try {
             // Check authentication first
-            const isAuth = await this.oauth.isAuthenticated();
-            if (!isAuth) {
+            const authResult = await this.deploymentAuthManager.ensureDeploymentAuth();
+            if (!authResult.isValid) {
                 return {
                     content: [
                         {
                             type: 'text',
-                            text: '❌ Not authenticated with ServiceNow.\n\nPlease run: snow-flow auth login\n\nOr configure your .env file with ServiceNow OAuth credentials.',
+                            text: `❌ Deployment authentication failed.\n\nError: ${authResult.error || 'Unable to authenticate'}\n\nRecommendations:\n${(authResult.recommendations || ['Run: snow-flow auth login']).map(r => `• ${r}`).join('\n')}\n\nNote: Deployment requires valid OAuth tokens with write permissions.`,
                         },
                     ],
                 };
@@ -4689,21 +4766,21 @@ Use \`snow_preview_widget\` to see a detailed preview of the widget rendering.`,
                     };
                 case 'script':
                 case 'script_include':
-                    const scriptResult = await this.client.createRecord('sys_script_include', config);
+                    const scriptResult = await this.createRecordWithRetry('sys_script_include', config);
                     return {
                         success: scriptResult.success,
                         sys_id: scriptResult.data?.sys_id,
                         message: scriptResult.success ? 'Script deployed' : scriptResult.error
                     };
                 case 'business_rule':
-                    const ruleResult = await this.client.createRecord('sys_script', config);
+                    const ruleResult = await this.createRecordWithRetry('sys_script', config);
                     return {
                         success: ruleResult.success,
                         sys_id: ruleResult.data?.sys_id,
                         message: ruleResult.success ? 'Business rule deployed' : ruleResult.error
                     };
                 case 'table':
-                    const tableResult = await this.client.createRecord('sys_db_object', config);
+                    const tableResult = await this.createRecordWithRetry('sys_db_object', config);
                     return {
                         success: tableResult.success,
                         sys_id: tableResult.data?.sys_id,

package/dist/utils/deployment-auth-fix.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Deployment Authentication Fix
+ * Ensures OAuth tokens are properly refreshed and validated before deployment operations
+ */
+export interface AuthValidationResult {
+    isValid: boolean;
+    hasWriteScope: boolean;
+    tokenAge?: number;
+    expiresIn?: number;
+    error?: string;
+    recommendations?: string[];
+}
+export declare class DeploymentAuthManager {
+    private oauth;
+    private lastTokenRefresh;
+    constructor();
+    /**
+     * Ensure we have valid tokens for deployment operations
+     * This is MORE strict than regular authentication
+     */
+    ensureDeploymentAuth(): Promise<AuthValidationResult>;
+    /**
+     * Validate token by making a simple API call
+     */
+    private validateTokenWithAPI;
+    /**
+     * Check if token has write permissions by attempting to read widget table
+     */
+    private checkWritePermissions;
+    /**
+     * Force a fresh token for deployment operations
+     */
+    forceTokenRefresh(): Promise<{
+        success: boolean;
+        accessToken?: string;
+        error?: string;
+    }>;
+    /**
+     * Get fresh access token for deployment
+     */
+    getDeploymentToken(): Promise<string | null>;
+}
+//# sourceMappingURL=deployment-auth-fix.d.ts.map

package/dist/utils/deployment-auth-fix.js

@@ -0,0 +1,272 @@
+"use strict";
+/**
+ * Deployment Authentication Fix
+ * Ensures OAuth tokens are properly refreshed and validated before deployment operations
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeploymentAuthManager = void 0;
+const snow_oauth_js_1 = require("./snow-oauth.js");
+const unified_auth_store_js_1 = require("./unified-auth-store.js");
+const logger_js_1 = require("./logger.js");
+const logger = new logger_js_1.Logger('DeploymentAuthFix');
+class DeploymentAuthManager {
+    constructor() {
+        this.lastTokenRefresh = 0;
+        this.oauth = new snow_oauth_js_1.ServiceNowOAuth();
+    }
+    /**
+     * Ensure we have valid tokens for deployment operations
+     * This is MORE strict than regular authentication
+     */
+    async ensureDeploymentAuth() {
+        try {
+            logger.info('🔐 Validating deployment authentication...');
+            // Step 1: Check if we have any auth at all
+            const isAuth = await this.oauth.isAuthenticated();
+            if (!isAuth) {
+                return {
+                    isValid: false,
+                    hasWriteScope: false,
+                    error: 'Not authenticated',
+                    recommendations: [
+                        'Run: snow-flow auth login',
+                        'Ensure OAuth app has write/admin scopes'
+                    ]
+                };
+            }
+            // Step 2: Get current tokens
+            let tokens = await this.oauth.loadTokens();
+            if (!tokens || !tokens.accessToken) {
+                // Try unified auth store as fallback
+                tokens = await unified_auth_store_js_1.unifiedAuthStore.getTokens();
+                if (!tokens || !tokens.accessToken) {
+                    return {
+                        isValid: false,
+                        hasWriteScope: false,
+                        error: 'No access token found',
+                        recommendations: [
+                            'Run: snow-flow auth login',
+                            'Check .env configuration'
+                        ]
+                    };
+                }
+            }
+            // Step 3: Check token age and expiry
+            const now = Date.now();
+            const tokenAge = tokens.issuedAt ? now - tokens.issuedAt : null;
+            const expiresIn = tokens.expiresAt ? tokens.expiresAt - now : null;
+            // If token expires in less than 5 minutes, refresh it
+            if (expiresIn && expiresIn < 300000) { // 5 minutes
+                logger.info('⚠️ Token expires soon, refreshing...');
+                try {
+                    const refreshResult = await this.oauth.refreshAccessToken();
+                    if (refreshResult.success && refreshResult.accessToken) {
+                        logger.info('✅ Token refreshed successfully');
+                        tokens = {
+                            ...tokens,
+                            accessToken: refreshResult.accessToken,
+                            expiresAt: refreshResult.expiresIn ? now + refreshResult.expiresIn * 1000 : undefined,
+                            issuedAt: now
+                        };
+                        // Update unified auth store
+                        await unified_auth_store_js_1.unifiedAuthStore.saveTokens(tokens);
+                    }
+                    else {
+                        logger.warn('Failed to refresh token:', refreshResult.error);
+                    }
+                }
+                catch (error) {
+                    logger.error('Token refresh error:', error);
+                }
+            }
+            // Step 4: Validate token by making a test API call
+            try {
+                const testResponse = await this.validateTokenWithAPI(tokens.accessToken);
+                if (!testResponse.success) {
+                    // Token is invalid, try to refresh
+                    logger.warn('Token validation failed, attempting refresh...');
+                    const refreshResult = await this.oauth.refreshAccessToken();
+                    if (refreshResult.success && refreshResult.accessToken) {
+                        tokens.accessToken = refreshResult.accessToken;
+                        await unified_auth_store_js_1.unifiedAuthStore.saveTokens(tokens);
+                        // Validate again
+                        const retryResponse = await this.validateTokenWithAPI(tokens.accessToken);
+                        if (!retryResponse.success) {
+                            return {
+                                isValid: false,
+                                hasWriteScope: false,
+                                error: 'Token validation failed after refresh',
+                                recommendations: [
+                                    'Run: snow-flow auth login',
+                                    'Check ServiceNow OAuth app configuration',
+                                    'Verify API access is enabled for your user'
+                                ]
+                            };
+                        }
+                    }
+                    else {
+                        return {
+                            isValid: false,
+                            hasWriteScope: false,
+                            error: 'Failed to refresh invalid token',
+                            recommendations: [
+                                'Run: snow-flow auth login',
+                                'Your session may have expired'
+                            ]
+                        };
+                    }
+                }
+            }
+            catch (error) {
+                logger.error('Token validation error:', error);
+                return {
+                    isValid: false,
+                    hasWriteScope: false,
+                    error: `Token validation failed: ${error.message}`,
+                    recommendations: [
+                        'Check network connectivity',
+                        'Verify ServiceNow instance is accessible',
+                        'Run: snow-flow auth login'
+                    ]
+                };
+            }
+            // Step 5: Check for write permissions
+            const hasWriteScope = await this.checkWritePermissions(tokens.accessToken);
+            return {
+                isValid: true,
+                hasWriteScope,
+                tokenAge: tokenAge ? Math.round(tokenAge / 1000) : undefined,
+                expiresIn: expiresIn ? Math.round(expiresIn / 1000) : undefined,
+                recommendations: hasWriteScope ? [] : [
+                    'OAuth token is valid but may lack write permissions',
+                    'Check OAuth app scopes in ServiceNow',
+                    'Ensure user has sp_admin or admin role'
+                ]
+            };
+        }
+        catch (error) {
+            logger.error('Deployment auth validation error:', error);
+            return {
+                isValid: false,
+                hasWriteScope: false,
+                error: error.message,
+                recommendations: [
+                    'Unexpected error during authentication',
+                    'Run: snow-flow auth login',
+                    'Check error logs for details'
+                ]
+            };
+        }
+    }
+    /**
+     * Validate token by making a simple API call
+     */
+    async validateTokenWithAPI(accessToken) {
+        try {
+            const axios = require('axios');
+            const credentials = await this.oauth.loadCredentials();
+            if (!credentials?.instance) {
+                return { success: false, error: 'No instance configured' };
+            }
+            const response = await axios.get(`https://${credentials.instance}/api/now/table/sys_user?sysparm_limit=1`, {
+                headers: {
+                    'Authorization': `Bearer ${accessToken}`,
+                    'Accept': 'application/json'
+                },
+                timeout: 10000
+            });
+            return { success: response.status === 200 };
+        }
+        catch (error) {
+            if (error.response?.status === 401) {
+                return { success: false, error: 'Token is invalid or expired' };
+            }
+            return { success: false, error: error.message };
+        }
+    }
+    /**
+     * Check if token has write permissions by attempting to read widget table
+     */
+    async checkWritePermissions(accessToken) {
+        try {
+            const axios = require('axios');
+            const credentials = await this.oauth.loadCredentials();
+            if (!credentials?.instance) {
+                return false;
+            }
+            // Try to read from sp_widget table (requires portal access)
+            const response = await axios.get(`https://${credentials.instance}/api/now/table/sp_widget?sysparm_limit=1`, {
+                headers: {
+                    'Authorization': `Bearer ${accessToken}`,
+                    'Accept': 'application/json'
+                },
+                timeout: 10000
+            });
+            // If we can read widgets, we likely have portal access
+            return response.status === 200;
+        }
+        catch (error) {
+            // 403 means we don't have permission
+            if (error.response?.status === 403) {
+                logger.warn('No write permissions for Service Portal');
+                return false;
+            }
+            // Other errors we'll assume no permission
+            return false;
+        }
+    }
+    /**
+     * Force a fresh token for deployment operations
+     */
+    async forceTokenRefresh() {
+        try {
+            logger.info('🔄 Forcing token refresh for deployment...');
+            const refreshResult = await this.oauth.refreshAccessToken();
+            if (refreshResult.success && refreshResult.accessToken) {
+                // Store in unified auth store
+                const tokens = await this.oauth.loadTokens();
+                if (tokens) {
+                    tokens.accessToken = refreshResult.accessToken;
+                    tokens.expiresAt = refreshResult.expiresIn ? Date.now() + refreshResult.expiresIn * 1000 : undefined;
+                    tokens.issuedAt = Date.now();
+                    await unified_auth_store_js_1.unifiedAuthStore.saveTokens(tokens);
+                }
+                logger.info('✅ Token refreshed successfully');
+                return {
+                    success: true,
+                    accessToken: refreshResult.accessToken
+                };
+            }
+            return {
+                success: false,
+                error: refreshResult.error || 'Failed to refresh token'
+            };
+        }
+        catch (error) {
+            logger.error('Force refresh error:', error);
+            return {
+                success: false,
+                error: error.message
+            };
+        }
+    }
+    /**
+     * Get fresh access token for deployment
+     */
+    async getDeploymentToken() {
+        // First ensure we have valid auth
+        const authResult = await this.ensureDeploymentAuth();
+        if (!authResult.isValid) {
+            logger.error('Invalid authentication for deployment:', authResult.error);
+            throw new Error(authResult.error || 'Authentication failed');
+        }
+        if (!authResult.hasWriteScope) {
+            logger.warn('⚠️ Token may lack write permissions, deployment might fail');
+        }
+        // Get the token
+        const tokens = await this.oauth.loadTokens();
+        return tokens?.accessToken || null;
+    }
+}
+exports.DeploymentAuthManager = DeploymentAuthManager;
+//# sourceMappingURL=deployment-auth-fix.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snow-flow",
-  "version": "2.9.4",
+  "version": "2.9.5",
   "description": "Snow-Flow: ServiceNow Advanced Intelligence Platform - 100+ real MCP tools with AI-powered swarm orchestration and neural networks. Dynamic task categorization using AI. Machine learning for incident classification, change risk prediction, and anomaly detection. Zero Mock Data, 100% Real API Integration.",
   "main": "dist/index.js",
   "type": "commonjs",