spencerm/Claude-SharepointLists
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Warn before the client secret expires (SP_SECRET_EXPIRES)

Browse Source 
Azure client secrets lapse silently into opaque 401s (AADSTS7000222). Add a self-reported expiry date (SP_SECRET_EXPIRES=YYYY-MM-DD) and a shared secretExpiryStatus() helper in graph.mjs; surface warnings <30 days out via the CLI (stderr on every command + test output), MCP server startup log, /health, and the sharepoint_test tool. Documented in both .env.examples, setup.md, and READMEs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
ang3l12
2026-07-08 15:13:48 -06:00
parent 6704122599
commit 7d41c1ca15
8 changed files with 89 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
mcp-server/index.mjs
View File

@@ -29,7 +29,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
// Single source of truth — the same client the skill's CLI uses.
import { SharePointListsClient, GraphError } from "../.claude/skills/sharepoint-lists/scripts/lib/graph.mjs";
import { SharePointListsClient, GraphError, secretExpiryStatus } from "../.claude/skills/sharepoint-lists/scripts/lib/graph.mjs";
const __dirname = dirname(fileURLToPath(import.meta.url));
loadDotEnv();
@@ -42,6 +42,15 @@ const client = new SharePointListsClient({
clientSecret: process.env.SP_CLIENT_SECRET,
});
// Self-reported client-secret expiry (SP_SECRET_EXPIRES=YYYY-MM-DD) — warn
// loudly before auth starts failing with an opaque 401. Computed fresh on each
// use so a long-running container keeps counting down.
const secretExpiry = () => secretExpiryStatus(process.env.SP_SECRET_EXPIRES);
{
const s = secretExpiry();
if (s?.message) console.error(`[sharepoint-lists] ⚠ ${s.message}`);
}
// ---- helpers --------------------------------------------------------------
const ok = (data) => ({
@@ -97,7 +106,10 @@ function buildServer() {
},
async ({ site }) => {
try {
return ok(await client.test(site || process.env.SP_SITE_URL));
const result = await client.test(site || process.env.SP_SITE_URL);
const s = secretExpiry();
if (s) result.secretExpiry = s;
return ok(result);
} catch (e) {
return fail(e);
}
@@ -277,8 +289,16 @@ async function runHttp() {
res.status(401).json({ error: "Unauthorized" });
};
// Liveness probe (no secrets) — intentionally unauthenticated for healthchecks.
app.get("/health", (_req, res) => res.json({ ok: true, readonly: READONLY }));
// Liveness probe (no secrets — expiry days-left only) — intentionally
// unauthenticated so healthchecks/monitors can watch it.
app.get("/health", (_req, res) => {
const s = secretExpiry();
res.json({
ok: true,
readonly: READONLY,
...(s ? { secretExpiry: { level: s.level, daysLeft: s.daysLeft, expiresAt: s.expiresAt } } : {}),
});
});
// Stateless: a fresh server + transport per request.
app.post("/mcp", requireAuth, async (req, res) => {