mcp-sharepoint-us 2.0.12__py3-none-any.whl → 2.0.14__py3-none-any.whl

mcp_sharepoint/__init__.py

@@ -14,11 +14,6 @@ from mcp.types import Resource, Tool, TextContent, ImageContent, EmbeddedResourc
 from pydantic import AnyUrl
 import mcp.server.stdio
 
-from office365.sharepoint.files.file import File
-from office365.sharepoint.folders.folder import Folder
-from office365.sharepoint.client_context import ClientContext
-
-from .auth import create_sharepoint_context
 from .graph_api import GraphAPIClient
 
 # Setup logging
@@ -28,78 +23,65 @@ logger = logging.getLogger(__name__)
 # Initialize MCP server
 app = Server("mcp-sharepoint")
 
-# Global SharePoint context, Graph API client, and authenticator
-ctx: Optional[ClientContext] = None
+# Global Graph API client and authenticator
 graph_client: Optional[GraphAPIClient] = None
 authenticator = None
 
 
 def ensure_context(func):
-    """Decorator to ensure SharePoint context and Graph API client are available"""
+    """Decorator to ensure Graph API client is available"""
     @wraps(func)
     async def wrapper(*args, **kwargs):
-        global ctx, graph_client, authenticator
-        if ctx is None:
+        global graph_client, authenticator
+        if graph_client is None:
             try:
-                ctx = create_sharepoint_context()
-                logger.info("SharePoint context initialized successfully")
+                logger.info("Initializing Graph API client...")
+                from .auth import SharePointAuthenticator
 
-                # Get site URL for Graph client
+                # Get credentials
                 site_url = os.getenv("SHP_SITE_URL")
+                client_id = os.getenv("SHP_ID_APP")
+                client_secret = os.getenv("SHP_ID_APP_SECRET")
+                tenant_id = os.getenv("SHP_TENANT_ID")
+                cloud = "government" if ".sharepoint.us" in site_url else "commercial"
+
+                logger.info(f"Site URL: {site_url}")
+                logger.info(f"Tenant ID: {tenant_id}")
+                logger.info(f"Client ID: {client_id}")
+                logger.info(f"Cloud: {cloud}")
+
+                # Create shared authenticator
+                authenticator = SharePointAuthenticator(
+                    site_url=site_url,
+                    client_id=client_id,
+                    client_secret=client_secret,
+                    tenant_id=tenant_id,
+                    cloud=cloud
+                )
+                logger.info("Authenticator created successfully")
 
-                # Create Graph API client
-                # The token callback will use the same MSAL authenticator internally
-                def token_callback():
-                    """Simple token callback that gets a fresh token using MSAL"""
-                    from .auth import SharePointAuthenticator
-                    from urllib.parse import urlparse
-
-                    site_url = os.getenv("SHP_SITE_URL")
-                    client_id = os.getenv("SHP_ID_APP")
-                    client_secret = os.getenv("SHP_ID_APP_SECRET")
-                    tenant_id = os.getenv("SHP_TENANT_ID")
-                    cloud = "government" if ".sharepoint.us" in site_url else "commercial"
-
-                    import msal
-                    from office365.runtime.auth.token_response import TokenResponse
-
-                    # Build authority URL
-                    if cloud in ("government", "us"):
-                        authority_url = f"https://login.microsoftonline.us/{tenant_id}"
-                    else:
-                        authority_url = f"https://login.microsoftonline.com/{tenant_id}"
-
-                    # Create MSAL app
-                    msal_app = msal.ConfidentialClientApplication(
-                        authority=authority_url,
-                        client_id=client_id,
-                        client_credential=client_secret,
-                        validate_authority=False if cloud in ("government", "us") else True
-                    )
-
-                    # Get scope
-                    parsed = urlparse(site_url)
-                    sharepoint_root = f"{parsed.scheme}://{parsed.netloc}"
-                    scopes = [f"{sharepoint_root}/.default"]
-
-                    # Acquire token
-                    result = msal_app.acquire_token_for_client(scopes=scopes)
-                    return TokenResponse.from_json(result)
+                # Create Graph API client with direct token access
+                def get_token():
+                    """Get access token for Graph API"""
+                    logger.debug("Token callback invoked")
+                    token = authenticator.get_access_token()
+                    logger.debug(f"Token acquired (length: {len(token)})")
+                    return token
 
                 graph_client = GraphAPIClient(
                     site_url=site_url,
-                    token_callback=token_callback
+                    token_callback=get_token
                 )
                 logger.info("Graph API client initialized successfully")
 
             except Exception as e:
-                logger.error(f"Failed to initialize SharePoint context: {e}")
+                logger.error(f"Failed to initialize Graph API client: {e}", exc_info=True)
                 raise RuntimeError(
-                    f"SharePoint authentication failed: {e}. "
+                    f"Graph API authentication failed: {e}. "
                     "Please check your environment variables and ensure:\n"
                     "1. SHP_TENANT_ID is set correctly\n"
-                    "2. Your Azure AD app has the correct API permissions\n"
-                    "3. If using a new tenant, make sure you're using modern auth (MSAL)"
+                    "2. Your Azure AD app has Microsoft Graph API permissions\n"
+                    "3. The app registration has 'Sites.Read.All' and 'Files.ReadWrite.All' permissions"
                 )
         return await func(*args, **kwargs)
     return wrapper
@@ -349,127 +331,88 @@ async def call_tool(name: str, arguments: dict) -> list[TextContent]:
 
 
 async def test_connection() -> list[TextContent]:
-    """Test SharePoint connection"""
+    """Test SharePoint connection using Microsoft Graph API"""
     try:
-        web = ctx.web.get().execute_query()
-        auth_method = os.getenv("SHP_AUTH_METHOD", "msal")
-        
+        logger.info("Testing Graph API connection...")
+
+        # Try to get site ID and drive ID
+        site_id = await asyncio.to_thread(graph_client._get_site_id)
+        drive_id = await asyncio.to_thread(graph_client._get_drive_id)
+
+        auth_method = "msal (Microsoft Graph API)"
+
+        logger.info(f"✓ Connection test successful - Site ID: {site_id}, Drive ID: {drive_id}")
+
         return [TextContent(
             type="text",
-            text=f"✓ Successfully connected to SharePoint!\n\n"
-                 f"Site Title: {web.title}\n"
-                 f"Site URL: {web.url}\n"
-                 f"Authentication Method: {auth_method.upper()}\n"
+            text=f"✓ Successfully connected to SharePoint via Microsoft Graph API!\n\n"
+                 f"Site URL: {graph_client.site_url}\n"
+                 f"Graph Endpoint: {graph_client.graph_endpoint}\n"
+                 f"Site ID: {site_id}\n"
+                 f"Drive ID: {drive_id}\n"
+                 f"Authentication Method: {auth_method}\n"
                  f"Tenant ID: {os.getenv('SHP_TENANT_ID')}\n\n"
-                 f"Connection is working correctly with modern Azure AD authentication."
+                 f"Connection is working correctly with Microsoft Graph API."
         )]
     except Exception as e:
+        logger.error(f"✗ Connection test failed: {str(e)}", exc_info=True)
         return [TextContent(
             type="text",
             text=f"✗ Connection failed: {str(e)}\n\n"
                  f"This usually means:\n"
                  f"1. Your credentials are incorrect\n"
-                 f"2. Your app doesn't have proper SharePoint permissions\n"
-                 f"3. You're using legacy auth on a new tenant (set SHP_AUTH_METHOD=msal)"
+                 f"2. Your app doesn't have proper Microsoft Graph permissions\n"
+                 f"3. Network connectivity issues\n"
+                 f"4. Azure AD app registration is missing required permissions:\n"
+                 f"   - Sites.Read.All\n"
+                 f"   - Files.ReadWrite.All\n\n"
+                 f"Check the logs for more details."
         )]
 
 
 async def list_folders(folder_path: str = "") -> list[TextContent]:
-    """List folders in specified path"""
+    """List folders in specified path using Microsoft Graph API"""
     doc_lib = get_document_library_path()
     full_path = f"{doc_lib}/{folder_path}" if folder_path else doc_lib
 
     try:
-        # Try SharePoint REST API first
-        folder = ctx.web.get_folder_by_server_relative_path(full_path)
-        folders = folder.folders.get().execute_query()
-
-        folder_list = []
-        for f in folders:
-            folder_list.append(f"📁 {f.name}")
+        # Use Graph API directly
+        folders = await asyncio.to_thread(graph_client.list_folders, folder_path)
+        folder_list = [f"📁 {f['name']}" for f in folders]
 
         result = f"Folders in '{full_path}':\n\n" + "\n".join(folder_list) if folder_list else f"No folders found in '{full_path}'"
         return [TextContent(type="text", text=result)]
 
     except Exception as e:
-        error_msg = str(e).lower()
-
-        # Check if it's an app-only token error
-        if "unsupported app only token" in error_msg or "401" in error_msg:
-            logger.warning(f"SharePoint REST API failed with app-only token error, falling back to Graph API")
-
-            try:
-                # Fallback to Graph API
-                folders = await asyncio.to_thread(graph_client.list_folders, folder_path)
-
-                folder_list = [f"📁 {f['name']}" for f in folders]
-
-                result = f"Folders in '{full_path}' (via Graph API):\n\n" + "\n".join(folder_list) if folder_list else f"No folders found in '{full_path}'"
-                return [TextContent(type="text", text=result)]
-
-            except Exception as graph_error:
-                return [TextContent(type="text", text=f"Error with both APIs - REST: {e}, Graph: {graph_error}")]
-
-        # Other errors
         return [TextContent(type="text", text=f"Error listing folders: {str(e)}")]
 
 
 async def list_documents(folder_path: str = "") -> list[TextContent]:
-    """List documents in specified folder"""
+    """List documents in specified folder using Microsoft Graph API"""
     doc_lib = get_document_library_path()
     full_path = f"{doc_lib}/{folder_path}" if folder_path else doc_lib
 
     try:
-        # Try SharePoint REST API first
-        folder = ctx.web.get_folder_by_server_relative_path(full_path)
-        files = folder.files.get().execute_query()
+        # Use Graph API directly
+        files = await asyncio.to_thread(graph_client.list_documents, folder_path)
 
         file_list = []
         for f in files:
-            size_kb = f.length / 1024
-            file_list.append(f"📄 {f.name} ({size_kb:.2f} KB)")
+            size_kb = f['size'] / 1024
+            file_list.append(f"📄 {f['name']} ({size_kb:.2f} KB)")
 
         result = f"Documents in '{full_path}':\n\n" + "\n".join(file_list) if file_list else f"No documents found in '{full_path}'"
         return [TextContent(type="text", text=result)]
 
     except Exception as e:
-        error_msg = str(e).lower()
-
-        # Check if it's an app-only token error
-        if "unsupported app only token" in error_msg or "401" in error_msg:
-            logger.warning(f"SharePoint REST API failed with app-only token error, falling back to Graph API")
-
-            try:
-                # Fallback to Graph API
-                files = await asyncio.to_thread(graph_client.list_documents, folder_path)
-
-                file_list = []
-                for f in files:
-                    size_kb = f['size'] / 1024
-                    file_list.append(f"📄 {f['name']} ({size_kb:.2f} KB)")
-
-                result = f"Documents in '{full_path}' (via Graph API):\n\n" + "\n".join(file_list) if file_list else f"No documents found in '{full_path}'"
-                return [TextContent(type="text", text=result)]
-
-            except Exception as graph_error:
-                return [TextContent(type="text", text=f"Error with both APIs - REST: {e}, Graph: {graph_error}")]
-
-        # Other errors
         return [TextContent(type="text", text=f"Error listing documents: {str(e)}")]
 
 
 async def get_document_content(file_path: str) -> list[TextContent]:
-    """Get document content"""
+    """Get document content using Microsoft Graph API"""
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{file_path}"
-
-        def _read_bytes():
-            sp_file = ctx.web.get_file_by_server_relative_path(full_path)
-            # IMPORTANT: execute the request
-            return sp_file.read().execute_query()
-
-        content = await asyncio.to_thread(_read_bytes)
+        # Use Graph API to get file content
+        content = await asyncio.to_thread(graph_client.get_file_content, file_path)
 
         ext = os.path.splitext(file_path)[1].lower()
         text_extensions = {'.txt', '.md', '.json', '.xml', '.html', '.csv', '.log'}
@@ -494,141 +437,127 @@ async def get_document_content(file_path: str) -> list[TextContent]:
 
 
 async def upload_document(folder_path: str, file_name: str, content: str, is_binary: bool = False) -> list[TextContent]:
-    """Upload a document"""
+    """Upload a document using Microsoft Graph API"""
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{folder_path}" if folder_path else doc_lib
-        
-        folder = ctx.web.get_folder_by_server_relative_path(full_path)
-        
         if is_binary:
             file_content = base64.b64decode(content)
         else:
             file_content = content.encode('utf-8')
-        
-        uploaded_file = folder.upload_file(file_name, file_content).execute_query()
-        
+
+        # Use Graph API to upload file
+        result = await asyncio.to_thread(
+            graph_client.upload_file,
+            folder_path,
+            file_name,
+            file_content
+        )
+
         return [TextContent(
             type="text",
-            text=f"✓ Successfully uploaded '{file_name}' to '{full_path}'"
+            text=f"✓ Successfully uploaded '{file_name}' to '{folder_path or 'root'}'"
         )]
-        
+
     except Exception as e:
         return [TextContent(type="text", text=f"Error uploading document: {str(e)}")]
 
 
 async def update_document(file_path: str, content: str, is_binary: bool = False) -> list[TextContent]:
-    """Update a document"""
+    """Update a document using Microsoft Graph API"""
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{file_path}"
-        
         if is_binary:
             file_content = base64.b64decode(content)
         else:
             file_content = content.encode('utf-8')
-        
-        file = ctx.web.get_file_by_server_relative_path(full_path)
-        file.write(file_content).execute_query()
-        
+
+        # Split file_path into folder and filename
+        folder_path = os.path.dirname(file_path)
+        file_name = os.path.basename(file_path)
+
+        # Use Graph API to upload/update file (PUT overwrites)
+        await asyncio.to_thread(
+            graph_client.upload_file,
+            folder_path,
+            file_name,
+            file_content
+        )
+
         return [TextContent(
             type="text",
             text=f"✓ Successfully updated '{file_path}'"
         )]
-        
+
     except Exception as e:
         return [TextContent(type="text", text=f"Error updating document: {str(e)}")]
 
 
 async def delete_document(file_path: str) -> list[TextContent]:
-    """Delete a document"""
+    """Delete a document using Microsoft Graph API"""
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{file_path}"
-        
-        file = ctx.web.get_file_by_server_relative_path(full_path)
-        file.delete_object().execute_query()
-        
+        # Use Graph API to delete file
+        await asyncio.to_thread(graph_client.delete_file, file_path)
+
         return [TextContent(
             type="text",
             text=f"✓ Successfully deleted '{file_path}'"
         )]
-        
+
     except Exception as e:
         return [TextContent(type="text", text=f"Error deleting document: {str(e)}")]
 
 
 async def create_folder(folder_path: str, folder_name: str) -> list[TextContent]:
-    """Create a folder"""
+    """Create a folder using Microsoft Graph API"""
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{folder_path}" if folder_path else doc_lib
-        
-        parent_folder = ctx.web.get_folder_by_server_relative_path(full_path)
-        new_folder = parent_folder.folders.add(folder_name).execute_query()
-        
+        # Use Graph API to create folder
+        await asyncio.to_thread(
+            graph_client.create_folder,
+            folder_path,
+            folder_name
+        )
+
         return [TextContent(
             type="text",
-            text=f"✓ Successfully created folder '{folder_name}' in '{full_path}'"
+            text=f"✓ Successfully created folder '{folder_name}' in '{folder_path or 'root'}'"
         )]
-        
+
     except Exception as e:
         return [TextContent(type="text", text=f"Error creating folder: {str(e)}")]
 
 
 async def delete_folder(folder_path: str) -> list[TextContent]:
-    """Delete a folder"""
+    """Delete a folder using Microsoft Graph API"""
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{folder_path}"
-        
-        folder = ctx.web.get_folder_by_server_relative_path(full_path)
-        folder.delete_object().execute_query()
-        
+        # Use Graph API to delete folder
+        await asyncio.to_thread(graph_client.delete_folder, folder_path)
+
         return [TextContent(
             type="text",
             text=f"✓ Successfully deleted folder '{folder_path}'"
         )]
-        
+
     except Exception as e:
         return [TextContent(type="text", text=f"Error deleting folder: {str(e)}")]
 
 
 async def get_tree(folder_path: str = "", max_depth: int = 5, current_depth: int = 0) -> list[TextContent]:
-    """Get folder tree structure"""
+    """Get folder tree structure using Microsoft Graph API"""
     if current_depth >= max_depth:
         return [TextContent(type="text", text="Max depth reached")]
 
     try:
-        doc_lib = get_document_library_path()
-        full_path = f"{doc_lib}/{folder_path}" if folder_path else doc_lib
-
-        folder = ctx.web.get_folder_by_server_relative_path(full_path)
-        folders = folder.folders.get().execute_query()
+        # Use Graph API to list folders
+        folders = await asyncio.to_thread(graph_client.list_folders, folder_path)
 
         indent = "  " * current_depth
         tree_lines = [f"{indent}📁 {folder_path or 'Root'}"]
 
         for f in folders:
-            sub_path = f"{folder_path}/{f.name}" if folder_path else f.name
+            sub_path = f"{folder_path}/{f['name']}" if folder_path else f['name']
             sub_tree = await get_tree(sub_path, max_depth, current_depth + 1)
             tree_lines.append(sub_tree[0].text)
 
         return [TextContent(type="text", text="\n".join(tree_lines))]
 
-    except TypeError as e:
-        if "can't compare offset-naive and offset-aware datetimes" in str(e):
-            logger.error(
-                f"DateTime comparison error occurred despite patch. "
-                f"This may indicate a new code path in the library. Error: {e}"
-            )
-            return [TextContent(
-                type="text",
-                text=f"Encountered a datetime comparison issue. "
-                     f"A workaround patch is applied, but this specific code path may need attention.\n"
-                     f"Alternative: Use List_SharePoint_Folders for folder navigation."
-            )]
-        raise
     except Exception as e:
         return [TextContent(type="text", text=f"Error getting tree: {str(e)}")]
 

mcp_sharepoint/auth.py

@@ -7,7 +7,6 @@ import logging
 import time
 import random
 from typing import Optional
-from urllib.parse import urlparse
 from datetime import datetime, timezone
 from office365.sharepoint.client_context import ClientContext
 from office365.runtime.auth.client_credential import ClientCredential
@@ -85,7 +84,17 @@ class SharePointAuthenticator:
         self.cert_path = cert_path
         self.cert_thumbprint = cert_thumbprint
         self.cloud = cloud.lower()
-        
+
+        # Initialize token cache
+        self._access_token = None
+        self._access_token_exp = 0
+
+        # Set Graph API scope based on cloud environment
+        if self.cloud in ("government", "us"):
+            self._scopes = ["https://graph.microsoft.us/.default"]
+        else:
+            self._scopes = ["https://graph.microsoft.com/.default"]
+
     def get_context_with_msal(self) -> ClientContext:
         """
         Get ClientContext using MSAL for modern Azure AD authentication.
@@ -123,19 +132,7 @@ class SharePointAuthenticator:
             self._msal_app = msal.ConfidentialClientApplication(**msal_params)
             self._authority_url = authority_url
 
-        # Small in-memory access-token cache (avoid repeated acquire calls)
-        # MSAL caches too, but keeping the raw token avoids extra work in Office365 callbacks.
-        if not hasattr(self, "_access_token"):
-            self._access_token = None
-            self._access_token_exp = 0
-
-        # Extract root SharePoint URL for scope
-        # For https://tenant.sharepoint.us/sites/SiteName -> https://tenant.sharepoint.us
-        parsed = urlparse(self.site_url)
-        sharepoint_root = f"{parsed.scheme}://{parsed.netloc}"
-        scopes = [f"{sharepoint_root}/.default"]
-
-        logger.info(f"Using SharePoint root scope: {sharepoint_root}/.default")
+        logger.info(f"Using Graph API scope: {self._scopes[0]}")
 
         def acquire_token():
             """
@@ -153,7 +150,7 @@ class SharePointAuthenticator:
             last_err = None
             for attempt in range(1, 6):  # 5 attempts
                 try:
-                    result = self._msal_app.acquire_token_for_client(scopes=scopes)
+                    result = self._msal_app.acquire_token_for_client(scopes=self._scopes)
 
                     if "access_token" not in result:
                         error_desc = result.get("error_description", "Unknown error")
@@ -161,7 +158,7 @@ class SharePointAuthenticator:
                         raise ValueError(
                             f"Failed to acquire token: {error} - {error_desc}\n"
                             f"Authority: {self._authority_url}\n"
-                            f"Scopes: {scopes}"
+                            f"Scopes: {self._scopes}"
                         )
 
                     token = result["access_token"]
@@ -191,7 +188,91 @@ class SharePointAuthenticator:
         logger.info("Successfully authenticated using MSAL (Modern Azure AD)")
         return ctx
 
-    
+    def get_access_token(self) -> str:
+        """
+        Get access token directly for use with Microsoft Graph API.
+        Uses the same retry logic as get_context_with_msal() but returns just the token string.
+
+        Returns:
+            Access token as string
+
+        Raises:
+            RuntimeError: If token acquisition fails after retries
+        """
+        # Initialize MSAL app if not already done
+        if not hasattr(self, "_msal_app"):
+            if self.cloud in ("government", "us"):
+                authority_url = f"https://login.microsoftonline.us/{self.tenant_id}"
+                logger.info("Using Azure US Government Cloud endpoints")
+            else:
+                authority_url = f"https://login.microsoftonline.com/{self.tenant_id}"
+                logger.info("Using Azure Commercial Cloud endpoints")
+
+            self._token_cache = msal.SerializableTokenCache()
+
+            msal_params = {
+                "authority": authority_url,
+                "client_id": self.client_id,
+                "client_credential": self.client_secret,
+                "token_cache": self._token_cache,
+            }
+
+            if self.cloud in ("government", "us"):
+                msal_params["validate_authority"] = False
+                logger.info("Disabled authority validation for government cloud")
+
+            self._msal_app = msal.ConfidentialClientApplication(**msal_params)
+            self._authority_url = authority_url
+
+        now = int(time.time())
+        if self._access_token and now < (self._access_token_exp - 60):
+            logger.debug("Using cached access token")
+            return self._access_token
+
+        logger.info(f"Acquiring new access token from {self._authority_url}")
+        logger.debug(f"Scopes: {self._scopes}")
+
+        last_err = None
+        for attempt in range(1, 6):  # 5 attempts
+            try:
+                logger.debug(f"Token acquisition attempt {attempt}/5")
+                result = self._msal_app.acquire_token_for_client(scopes=self._scopes)
+
+                if "access_token" not in result:
+                    error_desc = result.get("error_description", "Unknown error")
+                    error = result.get("error", "Unknown")
+                    logger.error(f"Token acquisition failed: {error} - {error_desc}")
+                    raise ValueError(
+                        f"Failed to acquire token: {error} - {error_desc}\n"
+                        f"Authority: {self._authority_url}\n"
+                        f"Scopes: {self._scopes}"
+                    )
+
+                token = result["access_token"]
+
+                # MSAL returns expires_in (seconds) for client credential tokens
+                expires_in = int(result.get("expires_in", 3600))
+                self._access_token = token
+                self._access_token_exp = int(time.time()) + expires_in
+
+                logger.info(f"Successfully acquired Graph API token (expires in {expires_in}s)")
+                logger.debug(f"Token length: {len(token)}, starts with: {token[:20]}...")
+                return token
+
+            except Exception as e:
+                last_err = e
+                logger.error(f"Token acquisition attempt {attempt}/5 failed: {type(e).__name__}: {e}")
+                # Exponential backoff with jitter
+                sleep_s = min(8.0, (2 ** (attempt - 1)) * 0.5) + random.random() * 0.25
+                logger.warning(
+                    f"Token acquisition attempt {attempt}/5 failed: {e}. Retrying in {sleep_s:.2f}s"
+                )
+                time.sleep(sleep_s)
+
+        # If we get here, all retries failed
+        raise RuntimeError(f"Token acquisition failed after retries: {last_err}")
+
+
     def get_context_with_certificate(self) -> ClientContext:
         """
         Get ClientContext using certificate-based authentication.

mcp_sharepoint/graph_api.py

@@ -1,6 +1,6 @@
 """
-Microsoft Graph API implementation for SharePoint operations
-Used as a fallback when SharePoint REST API doesn't support app-only tokens
+Microsoft Graph API implementation for SharePoint operations.
+Primary API for all SharePoint operations in Azure Government Cloud.
 """
 import os
 import logging
@@ -15,7 +15,8 @@ logger = logging.getLogger(__name__)
 class GraphAPIClient:
     """
     Microsoft Graph API client for SharePoint operations.
-    Fallback for when SharePoint REST API doesn't support app-only authentication.
+    Primary client for all SharePoint operations, especially in Azure Government Cloud
+    where SharePoint REST API may not support app-only authentication.
     """
 
     def __init__(self, site_url: str, token_callback):
@@ -29,6 +30,7 @@ class GraphAPIClient:
         self.site_url = site_url.rstrip("/")
         self.token_callback = token_callback
         self._site_id = None
+        self._drive_id = None  # Cache drive ID to avoid repeated API calls
 
         # Determine Graph API endpoint based on cloud
         if ".sharepoint.us" in site_url:
@@ -40,6 +42,7 @@ class GraphAPIClient:
 
     def _get_headers(self) -> Dict[str, str]:
         """Get authorization headers with access token."""
+        logger.debug("Getting authorization headers...")
         token_obj = self.token_callback()
         # Handle both TokenResponse objects and plain strings
         if hasattr(token_obj, 'accessToken'):
@@ -47,17 +50,51 @@ class GraphAPIClient:
         else:
             token = str(token_obj)
 
+        logger.debug(f"Token acquired for headers (length: {len(token)}, starts with: {token[:20]}...)")
+
         return {
             "Authorization": f"Bearer {token}",
             "Accept": "application/json",
         }
 
+    def _handle_response(self, response: requests.Response) -> None:
+        """
+        Handle Graph API response and raise detailed errors if needed.
+
+        Graph API returns errors in format:
+        {
+          "error": {
+            "code": "itemNotFound",
+            "message": "The resource could not be found."
+          }
+        }
+        """
+        if response.ok:
+            return
+
+        try:
+            error_data = response.json()
+            if "error" in error_data:
+                error = error_data["error"]
+                code = error.get("code", "Unknown")
+                message = error.get("message", "Unknown error")
+                raise requests.HTTPError(
+                    f"Graph API error [{code}]: {message}",
+                    response=response
+                )
+        except (ValueError, KeyError):
+            # If we can't parse the error, fall back to standard handling
+            pass
+
+        self._handle_response(response)
+
     def _get_site_id(self) -> str:
         """
         Get the site ID from the site URL.
         Caches the result for reuse.
         """
         if self._site_id:
+            logger.debug(f"Using cached site ID: {self._site_id}")
             return self._site_id
 
         parsed = urlparse(self.site_url)
@@ -71,24 +108,43 @@ class GraphAPIClient:
         else:
             url = f"{self.graph_endpoint}/sites/{hostname}:/{path}"
 
-        response = requests.get(url, headers=self._get_headers())
-        response.raise_for_status()
+        logger.info(f"Fetching site ID from: {url}")
+        try:
+            response = requests.get(url, headers=self._get_headers(), timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        self._site_id = response.json()["id"]
-        logger.info(f"Retrieved site ID: {self._site_id}")
-        return self._site_id
+            self._site_id = response.json()["id"]
+            logger.info(f"Retrieved site ID: {self._site_id}")
+            return self._site_id
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error getting site ID: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def _get_drive_id(self) -> str:
-        """Get the default document library drive ID."""
+        """
+        Get the default document library drive ID.
+        Caches the result for reuse.
+        """
+        if self._drive_id:
+            logger.debug(f"Using cached drive ID: {self._drive_id}")
+            return self._drive_id
+
         site_id = self._get_site_id()
         url = f"{self.graph_endpoint}/sites/{site_id}/drive"
 
-        response = requests.get(url, headers=self._get_headers())
-        response.raise_for_status()
+        logger.info(f"Fetching drive ID from: {url}")
+        try:
+            response = requests.get(url, headers=self._get_headers(), timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        drive_id = response.json()["id"]
-        logger.info(f"Retrieved drive ID: {drive_id}")
-        return drive_id
+            self._drive_id = response.json()["id"]
+            logger.info(f"Retrieved drive ID: {self._drive_id}")
+            return self._drive_id
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error getting drive ID: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def list_folders(self, folder_path: str = "") -> List[Dict[str, Any]]:
         """
@@ -100,6 +156,7 @@ class GraphAPIClient:
         Returns:
             List of folder objects with name, id, webUrl
         """
+        logger.info(f"Listing folders in '{folder_path}'")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
@@ -110,23 +167,29 @@ class GraphAPIClient:
         else:
             url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root/children"
 
-        response = requests.get(url, headers=self._get_headers())
-        response.raise_for_status()
-
-        items = response.json().get("value", [])
-        # Filter to only folders
-        folders = [
-            {
-                "name": item["name"],
-                "id": item["id"],
-                "webUrl": item.get("webUrl", ""),
-            }
-            for item in items
-            if "folder" in item
-        ]
-
-        logger.info(f"Found {len(folders)} folders in '{folder_path}'")
-        return folders
+        logger.info(f"Fetching folders from: {url}")
+        try:
+            response = requests.get(url, headers=self._get_headers(), timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
+
+            items = response.json().get("value", [])
+            # Filter to only folders
+            folders = [
+                {
+                    "name": item["name"],
+                    "id": item["id"],
+                    "webUrl": item.get("webUrl", ""),
+                }
+                for item in items
+                if "folder" in item
+            ]
+
+            logger.info(f"Found {len(folders)} folders in '{folder_path}'")
+            return folders
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error listing folders: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def list_documents(self, folder_path: str = "") -> List[Dict[str, Any]]:
         """
@@ -138,6 +201,7 @@ class GraphAPIClient:
         Returns:
             List of file objects with name, id, size, webUrl
         """
+        logger.info(f"Listing documents in '{folder_path}'")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
@@ -147,24 +211,30 @@ class GraphAPIClient:
         else:
             url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root/children"
 
-        response = requests.get(url, headers=self._get_headers())
-        response.raise_for_status()
-
-        items = response.json().get("value", [])
-        # Filter to only files
-        files = [
-            {
-                "name": item["name"],
-                "id": item["id"],
-                "size": item.get("size", 0),
-                "webUrl": item.get("webUrl", ""),
-            }
-            for item in items
-            if "file" in item
-        ]
-
-        logger.info(f"Found {len(files)} files in '{folder_path}'")
-        return files
+        logger.info(f"Fetching documents from: {url}")
+        try:
+            response = requests.get(url, headers=self._get_headers(), timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
+
+            items = response.json().get("value", [])
+            # Filter to only files
+            files = [
+                {
+                    "name": item["name"],
+                    "id": item["id"],
+                    "size": item.get("size", 0),
+                    "webUrl": item.get("webUrl", ""),
+                }
+                for item in items
+                if "file" in item
+            ]
+
+            logger.info(f"Found {len(files)} files in '{folder_path}'")
+            return files
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error listing documents: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def get_file_content(self, file_path: str) -> bytes:
         """
@@ -176,17 +246,24 @@ class GraphAPIClient:
         Returns:
             File content as bytes
         """
+        logger.info(f"Getting content for file '{file_path}'")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
         encoded_path = quote(file_path)
         url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root:/{encoded_path}:/content"
 
-        response = requests.get(url, headers=self._get_headers())
-        response.raise_for_status()
+        logger.info(f"Fetching file content from: {url}")
+        try:
+            response = requests.get(url, headers=self._get_headers(), timeout=60)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        logger.info(f"Retrieved content for '{file_path}' ({len(response.content)} bytes)")
-        return response.content
+            logger.info(f"Retrieved content for '{file_path}' ({len(response.content)} bytes)")
+            return response.content
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error getting file content: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def upload_file(self, folder_path: str, file_name: str, content: bytes) -> Dict[str, Any]:
         """
@@ -200,6 +277,7 @@ class GraphAPIClient:
         Returns:
             File metadata
         """
+        logger.info(f"Uploading file '{file_name}' to '{folder_path}' ({len(content)} bytes)")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
@@ -211,14 +289,20 @@ class GraphAPIClient:
         encoded_path = quote(full_path)
         url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root:/{encoded_path}:/content"
 
+        logger.info(f"Uploading to: {url}")
         headers = self._get_headers()
         headers["Content-Type"] = "application/octet-stream"
 
-        response = requests.put(url, headers=headers, data=content)
-        response.raise_for_status()
+        try:
+            response = requests.put(url, headers=headers, data=content, timeout=120)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        logger.info(f"Uploaded '{file_name}' to '{folder_path}'")
-        return response.json()
+            logger.info(f"Successfully uploaded '{file_name}' to '{folder_path}'")
+            return response.json()
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error uploading file: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def delete_file(self, file_path: str) -> None:
         """
@@ -227,16 +311,23 @@ class GraphAPIClient:
         Args:
             file_path: Relative path to the file
         """
+        logger.info(f"Deleting file '{file_path}'")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
         encoded_path = quote(file_path)
         url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root:/{encoded_path}"
 
-        response = requests.delete(url, headers=self._get_headers())
-        response.raise_for_status()
+        logger.info(f"Deleting from: {url}")
+        try:
+            response = requests.delete(url, headers=self._get_headers(), timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        logger.info(f"Deleted '{file_path}'")
+            logger.info(f"Successfully deleted '{file_path}'")
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error deleting file: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def create_folder(self, parent_path: str, folder_name: str) -> Dict[str, Any]:
         """
@@ -249,6 +340,7 @@ class GraphAPIClient:
         Returns:
             Folder metadata
         """
+        logger.info(f"Creating folder '{folder_name}' in '{parent_path}'")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
@@ -258,17 +350,23 @@ class GraphAPIClient:
         else:
             url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root/children"
 
+        logger.info(f"Creating folder at: {url}")
         payload = {
             "name": folder_name,
             "folder": {},
             "@microsoft.graph.conflictBehavior": "fail"
         }
 
-        response = requests.post(url, headers=self._get_headers(), json=payload)
-        response.raise_for_status()
+        try:
+            response = requests.post(url, headers=self._get_headers(), json=payload, timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        logger.info(f"Created folder '{folder_name}' in '{parent_path}'")
-        return response.json()
+            logger.info(f"Successfully created folder '{folder_name}' in '{parent_path}'")
+            return response.json()
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error creating folder: {type(e).__name__}: {e}", exc_info=True)
+            raise
 
     def delete_folder(self, folder_path: str) -> None:
         """
@@ -277,13 +375,20 @@ class GraphAPIClient:
         Args:
             folder_path: Relative path to the folder
         """
+        logger.info(f"Deleting folder '{folder_path}'")
         site_id = self._get_site_id()
         drive_id = self._get_drive_id()
 
         encoded_path = quote(folder_path)
         url = f"{self.graph_endpoint}/sites/{site_id}/drives/{drive_id}/root:/{encoded_path}"
 
-        response = requests.delete(url, headers=self._get_headers())
-        response.raise_for_status()
+        logger.info(f"Deleting folder from: {url}")
+        try:
+            response = requests.delete(url, headers=self._get_headers(), timeout=30)
+            logger.debug(f"Response status: {response.status_code}")
+            self._handle_response(response)
 
-        logger.info(f"Deleted folder '{folder_path}'")
+            logger.info(f"Successfully deleted folder '{folder_path}'")
+        except requests.exceptions.RequestException as e:
+            logger.error(f"Network error deleting folder: {type(e).__name__}: {e}", exc_info=True)
+            raise

{mcp_sharepoint_us-2.0.12.dist-info → mcp_sharepoint_us-2.0.14.dist-info}/METADATA

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: mcp-sharepoint-us
-Version: 2.0.12
-Summary: SharePoint MCP Server with Modern Azure AD Authentication
+Version: 2.0.14
+Summary: SharePoint MCP Server with Microsoft Graph API
 License: MIT
 Project-URL: Homepage, https://github.com/mdev26/mcp-sharepoint-us
 Project-URL: Repository, https://github.com/mdev26/mcp-sharepoint-us

mcp_sharepoint_us-2.0.14.dist-info/RECORD

@@ -0,0 +1,10 @@
+mcp_sharepoint/__init__.py,sha256=sSJtlX91mBQ4fM12R8XK7Vrkkr3YPJqriE8LZP157vM,20969
+mcp_sharepoint/__main__.py,sha256=4iVDdDZx4rQ4Zo-x0RaCrT-NKeGObIz_ks3YF8di2nA,132
+mcp_sharepoint/auth.py,sha256=fwOCsg1pv0cN26hNlsHhJhGckeDkJCiXZrMmiBn9jf4,18156
+mcp_sharepoint/graph_api.py,sha256=GNZXKTyTKqSL9t4AAyUSszmhulyJ5cX4e5tlxpYUuYM,14510
+mcp_sharepoint_us-2.0.14.dist-info/licenses/LICENSE,sha256=SRM8juGH4GjIqnl5rrp-P-S5mW5h2mINOPx5-wOZG6s,1112
+mcp_sharepoint_us-2.0.14.dist-info/METADATA,sha256=reWorSnGr5fY68_KV1OK4kTj2Me8aYBRzM-lgt6Jykw,11402
+mcp_sharepoint_us-2.0.14.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+mcp_sharepoint_us-2.0.14.dist-info/entry_points.txt,sha256=UZOa_7OLI41rmsErbvnSz9RahPMGQVcqZUFMphOcjbY,57
+mcp_sharepoint_us-2.0.14.dist-info/top_level.txt,sha256=R6mRoWe61lz4kUSKGV6S2XVbE7825xfC_J-ouZIYpuo,15
+mcp_sharepoint_us-2.0.14.dist-info/RECORD,,

mcp_sharepoint_us-2.0.12.dist-info/RECORD

@@ -1,10 +0,0 @@
-mcp_sharepoint/__init__.py,sha256=bPS8QLq2U83JjAIr76_cEwQfZkv92K8MMWR7hbuo-9s,24298
-mcp_sharepoint/__main__.py,sha256=4iVDdDZx4rQ4Zo-x0RaCrT-NKeGObIz_ks3YF8di2nA,132
-mcp_sharepoint/auth.py,sha256=Tve5y-m1WwL6eTVpofeDv3zFSIDhwo1s26gJSy3F_1s,14729
-mcp_sharepoint/graph_api.py,sha256=63ZCx4G5BqimkYcYbibJtRYiU2UhsjN8nXp-qzPGBfA,9273
-mcp_sharepoint_us-2.0.12.dist-info/licenses/LICENSE,sha256=SRM8juGH4GjIqnl5rrp-P-S5mW5h2mINOPx5-wOZG6s,1112
-mcp_sharepoint_us-2.0.12.dist-info/METADATA,sha256=UP72g9PzIBBNJFY_Se2ECqiuocwUhj8aiwEu7ur1yY0,11413
-mcp_sharepoint_us-2.0.12.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
-mcp_sharepoint_us-2.0.12.dist-info/entry_points.txt,sha256=UZOa_7OLI41rmsErbvnSz9RahPMGQVcqZUFMphOcjbY,57
-mcp_sharepoint_us-2.0.12.dist-info/top_level.txt,sha256=R6mRoWe61lz4kUSKGV6S2XVbE7825xfC_J-ouZIYpuo,15
-mcp_sharepoint_us-2.0.12.dist-info/RECORD,,