chore(release): v0.6.3

Author: CRACKISH

CHANGELOG.md

@@ -4,6 +4,56 @@ All notable changes to **mcp-creatio** are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/), and the project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [0.6.3]
+
+Security/perf/architecture remediation (from a full re-review) plus broker production-readiness.
+Live-regressed across all transports vs a real Creatio; 537 tests, 94.5% line coverage.
+
+### Security
+
+- **Broker access tokens are audience-bound** — `aud` (the `/mcp` resource) + `iss` (origin) are
+  set and verified on every `/mcp` call, so a token minted by one deployment is rejected by another
+  sharing `CREATIO_MCP_JWT_SECRET` (token redirection / confused-deputy). `client_id` is bound and
+  enforced on refresh.
+- **`refresh_token` grant** (rotating, single-use, client-bound, gated on the broker still holding
+  the user's Creatio tokens) — replaces a previously non-redeemable refresh token; standalone
+  clients no longer re-consent hourly.
+- **`CREATIO_MCP_JWT_SECRET` hardening** — minimum 32 chars enforced; **required in production**
+  (fail-closed); ephemeral-with-warning only outside production.
+- **SSRF guard** for the gateway `X-Creatio-Base-Url` override — `CREATIO_MCP_ALLOWED_BASE_URLS`
+  allowlist; cloud-metadata link-local addresses always blocked.
+- **OData identifier-injection guard**, **log redaction** of `code`/`state`/`token` query params,
+  and **bounded DCR client store** (TTL + cap).
+- **RFC 7009 `POST /revoke`** (logout) — revokes the Creatio token upstream
+  (`/connect/revocation`, best-effort) and purges server-side + issued-refresh tokens; always `200`.
+
+### Added
+
+- **Pluggable broker token store** — `CREATIO_MCP_TOKEN_STORE=memory` (default) | `redis`. The
+  Redis store (`CREATIO_MCP_REDIS_URL`) encrypts tokens at rest (AES-256-GCM;
+  `CREATIO_MCP_TOKEN_ENC_KEY` or derived from the JWT secret) with native TTL → stateless,
+  restart-durable, horizontally-scalable broker.
+- **`CREATIO_MCP_PUBLIC_URL`** — pins issuer/audience/redirects/discovery to the external origin
+  behind a TLS-terminating proxy.
+- **Proactive session keep-alive** (`CREATIO_MCP_KEEPALIVE_SECONDS`, default `300`s, `0` disables)
+  for `legacy`/`client_credentials`; reactive reconnect now also recovers from a login-page bounce,
+  not only `401`.
+
+### Changed
+
+- **Performance** — tuned global undici keep-alive dispatcher for outbound Creatio calls;
+  single-flight token refresh (no thundering herd); O(1) `describe-entity` via metadata indexes;
+  compact (non-pretty) tool output; capability-probe negative-cache.
+- **Architecture/DRY** — `createAuthEdge` factory (auth-strategy out of `HttpServer`);
+  `httpServer.ts` → `http-server.ts`; shared identifier/probe/expiry helpers; OData read +
+  `getCurrentUserInfo` onto the shared `request()` helper; mutation audit now records outcome.
+- **Lint** — `@typescript-eslint/member-ordering` rule codifies the class-member convention.
+
+### Tests
+
+- Coverage raised to **94.5% lines** (537 tests). Added the broker full-stack API suite
+  (supertest) and an opt-in real-Redis integration test (auto-skips without Redis).
+
 ## [0.6.2]
 
 ### Added

package.json

@@ -1,80 +1,80 @@
 {
-  "name": "mcp-creatio",
-  "version": "0.6.2",
-  "main": "dist/index.js",
-  "bin": {
-    "mcp-creatio": "dist/cli.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "scripts": {
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
-    "clean": "rimraf ./dist",
-    "prebuild": "npm run clean",
-    "build": "tsc",
-    "start": "ts-node src/index.ts",
-    "start:cli": "ts-node src/cli.ts",
-    "start:stdio": "ts-node src/cli.ts",
-    "prepack": "npm run build",
-    "lint": "eslint --ext .ts src",
-    "lint:fix": "eslint --ext .ts src --fix",
-    "format": "prettier --write \"src/**/*.{ts,js,json}\" \"test/**/*.ts\" \"*.md\"",
-    "format:check": "prettier --check \"src/**/*.{ts,js,json}\" \"test/**/*.ts\" \"*.md\""
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/CRACKISH/mcp-creatio.git"
-  },
-  "keywords": [
-    "mcp",
-    "model-context-protocol",
-    "creatio",
-    "creatio-crm",
-    "crm",
-    "odata",
-    "mcp-server",
-    "chatgpt",
-    "claude",
-    "github-copilot",
-    "typescript",
-    "ai-tools"
-  ],
-  "author": "",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/CRACKISH/mcp-creatio/issues"
-  },
-  "homepage": "https://github.com/CRACKISH/mcp-creatio#readme",
-  "description": "MCP server for Creatio CRM. Connect Claude Desktop, ChatGPT, and GitHub Copilot to Creatio via Model Context Protocol and OData v4.",
-  "devDependencies": {
-    "@types/express": "5.0.6",
-    "@types/node": "^26.0.1",
-    "@types/supertest": "^7.2.0",
-    "@typescript-eslint/eslint-plugin": "^8.62.0",
-    "@typescript-eslint/parser": "^8.62.0",
-    "@vitest/coverage-v8": "^4.1.9",
-    "eslint": "^9.39.4",
-    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-prettier": "^5.5.6",
-    "prettier": "^3.8.4",
-    "rimraf": "^6.1.3",
-    "supertest": "^7.2.2",
-    "ts-node": "^10.9.2",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.9"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "@types/jsonwebtoken": "^9.0.10",
-    "express": "^5.2.1",
-    "fast-xml-parser": "^5.9.3",
-    "jsonwebtoken": "^9.0.3",
-    "redis": "^4.7.1",
-    "undici": "^6.27.0",
-    "zod": "^4.4.3"
-  }
+	"name": "mcp-creatio",
+	"version": "0.6.3",
+	"main": "dist/index.js",
+	"bin": {
+		"mcp-creatio": "dist/cli.js"
+	},
+	"files": [
+		"dist"
+	],
+	"scripts": {
+		"test": "vitest run",
+		"test:watch": "vitest",
+		"test:coverage": "vitest run --coverage",
+		"clean": "rimraf ./dist",
+		"prebuild": "npm run clean",
+		"build": "tsc",
+		"start": "ts-node src/index.ts",
+		"start:cli": "ts-node src/cli.ts",
+		"start:stdio": "ts-node src/cli.ts",
+		"prepack": "npm run build",
+		"lint": "eslint --ext .ts src",
+		"lint:fix": "eslint --ext .ts src --fix",
+		"format": "prettier --write \"src/**/*.{ts,js,json}\" \"test/**/*.ts\" \"*.md\"",
+		"format:check": "prettier --check \"src/**/*.{ts,js,json}\" \"test/**/*.ts\" \"*.md\""
+	},
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/CRACKISH/mcp-creatio.git"
+	},
+	"keywords": [
+		"mcp",
+		"model-context-protocol",
+		"creatio",
+		"creatio-crm",
+		"crm",
+		"odata",
+		"mcp-server",
+		"chatgpt",
+		"claude",
+		"github-copilot",
+		"typescript",
+		"ai-tools"
+	],
+	"author": "",
+	"license": "MIT",
+	"bugs": {
+		"url": "https://github.com/CRACKISH/mcp-creatio/issues"
+	},
+	"homepage": "https://github.com/CRACKISH/mcp-creatio#readme",
+	"description": "MCP server for Creatio CRM. Connect Claude Desktop, ChatGPT, and GitHub Copilot to Creatio via Model Context Protocol and OData v4.",
+	"devDependencies": {
+		"@types/express": "5.0.6",
+		"@types/node": "^26.0.1",
+		"@types/supertest": "^7.2.0",
+		"@typescript-eslint/eslint-plugin": "^8.62.0",
+		"@typescript-eslint/parser": "^8.62.0",
+		"@vitest/coverage-v8": "^4.1.9",
+		"eslint": "^9.39.4",
+		"eslint-config-prettier": "^10.1.8",
+		"eslint-plugin-import": "^2.32.0",
+		"eslint-plugin-prettier": "^5.5.6",
+		"prettier": "^3.8.4",
+		"rimraf": "^6.1.3",
+		"supertest": "^7.2.2",
+		"ts-node": "^10.9.2",
+		"typescript": "^6.0.3",
+		"vitest": "^4.1.9"
+	},
+	"dependencies": {
+		"@modelcontextprotocol/sdk": "^1.29.0",
+		"@types/jsonwebtoken": "^9.0.10",
+		"express": "^5.2.1",
+		"fast-xml-parser": "^5.9.3",
+		"jsonwebtoken": "^9.0.3",
+		"redis": "^4.7.1",
+		"undici": "^6.27.0",
+		"zod": "^4.4.3"
+	}
 }