Update dependencies, enhance authentication, and improve server tools#1
Merged
Conversation
…ependencies - Added new dependencies and devDependencies for packages/mcp-server - Updated versions and specifications of core dependencies including express, cors, and zod - Added resolutions and integrity checks for multiple new packages such as @hono/node-server, @modelcontextprotocol/sdk, and express-rate-limit - Included additional @types packages for TypeScript support in express, cors, node, and related modules - Added multiple updated and new package entries with engine constraints and peerDependencies - Improved dependency management by specifying optional and peer dependencies with metadata - Updated content-disposition, cookie, finalhandler, and other middleware package versions - Added several utilities and helper packages with corresponding version resolutions and integrity hashes - Included engines requirements for node versions across multiple packages to ensure compatibility
…nput schemas - Replace server.tool calls with server.registerTool for better clarity and consistency - Add inputSchema and description fields to all tool registration calls for improved validation and documentation - Update tool argument structures to use typed input objects for stronger type safety - Enhance config validation by adding validateHttpConfig function with OAuth checks - Extend package.json scripts with watch mode, dev mode with node watch, and additional start commands - Maintain existing functionality while improving code maintainability and developer experience
- Changed MCP server config to use AFRIEX_API_KEY as the client credential in api-key mode - Removed AFRIEX_MCP_API_KEY configuration and related validation - Updated README and usage docs to reflect single API key usage - Modified auth middleware to use afriexApiKey instead of separate apiKey field - Added CARD as a new checkout channel type in checkout package types
- Add better-sqlite3 v12.11.1 as a runtime dependency - Add @types/better-sqlite3 v7.6.13 as a dev dependency - Update pnpm-lock.yaml accordingly with new package resolutions - Ensure compatibility with Node.js versions 20.x and above - Slightly bump related dependencies in lockfile for consistency
…h modes - Clarify AFRIEX_API_KEY requirement varies by mode: required in stdio, optional in HTTP - Add detailed explanation for API Key auth mode with shared server key and client keys - Remove AFRIEX_MCP_ALLOW_CLIENT_CREDENTIALS flag references and update multi-tenant behavior - Document how x-afriex-api-key and x-api-key headers are used in different scenarios - Improve OAuth user flow description for better clarity - Update example client config to prefer x-afriex-api-key header - Refactor config validation to reflect optional AFRIEX_API_KEY in HTTP mode - Simplify credential resolution to always check x-afriex-api-key header if present - Revise API key middleware to allow x-afriex-api-key header and use x-api-key only as fallback - Enhance CLI help and README to align with updated authentication and multi-tenant usage
- Unify resolution of API key and environment with clear priority order - Allow partial override of environment or API key independently - Remove redundant default SDK caching logic from getSdk function - Rename server instance name from "afriex-mcp" to "afriex" for consistency - Improve error handling by removing unused defaultSdk fallback - Streamline retrieval of headers and OAuth extras in one flow
- Update AFRIEX_ENVIRONMENT default value from production to staging in config files - Modify README to reflect staging as the default environment - Correct environment selection logic to default to staging if unspecified - Adjust UI dropdown order to list staging before production - Update comments and documentation for clarity on default environment setting
- Add .dockerignore to exclude unnecessary files from Docker context - Provide .env.example for configuration of authentication and OAuth settings - Create docker-compose.yml for easy local deployment of mcp-server service - Implement Dockerfile to build and run the mcp-server with workspace pruning - Use multi-stage build to optimize dependency installation and final image size - Set environment variables and healthcheck for container runtime operation
- Remove Dockerfile from packages/mcp-server directory - Add new Dockerfile at repository root to encompass entire monorepo context - Update docker-compose.yml to use new Dockerfile location - Use turbo prune to trim dependencies for @afriex/mcp-server package - Maintain NODE_ENV and OAuth environment variables for runtime - Implement healthcheck command and volume setup for persistent OAuth storage - Enable flexible auth mode configuration via environment variable at deploy time
- Replace remote JWKS fetch with local signing key loading for custom provider - Avoid self-HTTP requests that fail due to container hairpin routing limits - Use createLocalJWKSet with loaded or newly created signing key instead of remote JWKS - Simplify JWKS resolving logic to separate remote and local key retrieval - Remove unused userinfo token validation fallback method - Update validateJwtWithJwks to accept local or remote JWKS getter promise
- Add a WeakMap cache to deduplicate concurrent calls per database instance - Split key loading and creation into cached and uncached functions - Use atomic INSERT with WHERE NOT EXISTS to avoid duplicate active keys in DB - Re-select active key after insert to handle cross-process race conditions - Throw error if no active key can be loaded or created after attempts
…mple - Added placeholder value "< generate >" for OAUTH_ENCRYPTION_KEY - Provided instruction comment for generating a key using Node.js crypto - Ensured example environment file reflects necessary OAuth configuration fields
- Allow GET to open server-initiated SSE stream as per Streamable HTTP spec - Enable DELETE method for session termination on /mcp route - Avoid fallback to Express default 404 page for unsupported methods - Refactor request handler into a shared function for POST, GET, and DELETE - Ensure auth middleware applies consistently across allowed methods
- Introduce toResourceUrl function to normalize base URLs to the canonical /mcp resource URL - Update JWT audience validation to use normalized resource URL for custom OAuth provider - Modify custom provider token issuance to set audience claim with canonical /mcp URL - Update protected resource metadata endpoint to return normalized resource URL per RFC 9728 - Add duplicate well-known OAuth protected resource endpoint at /mcp for compatibility - Refactor auth module to distinguish custom provider and handle expected audience accordingly - Disable Express "x-powered-by" header for improved security and standardization
- Add header "X-Accel-Buffering: no" to disable buffering of SSE responses - Provide compatibility with nginx-family proxies and potential CDNs - Ensure proper streaming behavior for server-sent events - Document fix as a safety net complementing proxy configuration
- Add pino, pino-http, and pino-pretty logging dependencies to server package - Implement centralized logger setup with redaction for sensitive fields - Initialize logger in server startup and log server start details - Wrap all tool registrations to log invocation start, duration, success, and errors - Add OAuth authentication logging including token validation and error cases - Replace console.error with structured logging for fatal startup errors - Provide request logger extraction for Express middleware integration
… mode - Remove shared MCP server instance in HTTP mode to avoid reuse errors - Create fresh MCP server and transport for each HTTP request - Keep single long-lived MCP server for stdio transport mode - Add cleanup handlers to close transport and server on request close - Update startHttpServer to accept config only, create server internally - Improve comments explaining stateless HTTP transport limitations and design
- Added readOnlyHint, idempotentHint, destructiveHint, and openWorldHint flags - Updated balance tool annotations for currency-related methods - Updated checkout endpoints with appropriate method hints - Added detailed annotations for customers-related RPC calls - Enhanced payment-methods tools with correct annotations per method - Applied annotations to rates and transactions tools - Added webhook RPC method annotations reflecting readOnly and idempotency - Improved clarity and correctness of RPC metadata across multiple modules
- Introduce `update` method to partially update a customer's profile fields - Add validation for update to require at least one field: fullName, email, or phone - Support document verification via `verify` method (e.g. BVN for Nigeria) - Adjust KYC update to accept flat key-value pairs as request body - Add corresponding input validation and error handling for new methods - Extend MCP server tools with update, KYC update, and verify customer handlers - Update tests to cover new functionality and edge cases - Rename `fullName` to `name` in customer model and related tests fix(balance): allow getBalance to fetch all currencies when no param given - Make currencies parameter optional in getBalance and related types - Support fetching balances for all supported currencies if omitted or empty - Remove throwing ValidationError when currencies are missing - Add tests for omitted and empty currencies param scenarios feat(core): enhance ApiError with better error detail handling - Support friendlyMessage and errorMessage extraction from error details - Adjust ApiError to parse improved error response body shape - Add RateLimitError subclass with retryAfter support - Include comprehensive unit tests for error parsing and behaviors - Update AfriexErrorCode to align with documented API error codes and messages feat(payment-methods): extend filtering and type definitions - Support array filters for channel, currencies, capabilities, and status in list calls - Normalize array query params to comma-separated string for HTTP requests - Expand PaymentChannel and CreatablePaymentChannel types with more values - Add lifecycle statuses and card brand enums for improved typings - Enhance PaymentMethod and CreatePaymentMethodRequest interfaces with new fields - Adjust institution-related types for more precise channel and country handling - Add tests verifying serialization of array filters in query params feat(mcp-server): add tools for transaction authorization and customer updates - Add afriex_authorize_transaction tool to authorize OTP-based transaction steps - Add afriex_update_customer tool for partial profile updates - Add afriex_verify_customer tool for customer document verification - Update transaction tools to support shouldPreferSourceAmount boolean flag - Extend transaction status and type filters with more values and descriptions - Add detailed error handling and response parsing in new tools
- Add missing endpoints: customers.update, customers.verify, transactions.authorize - Fix customers.updateKyc to send unwrapped KYC document map, matching real API - Replace Customer.fullName with Customer.name in API responses (request fields unchanged) - Improve ApiError to parse actual API error body and show real error messages - Update AfriexErrorCode to use real API error codes - Remove non-existent TransactionStatus.COMPLETED; add new status values including DISPUTED and SCHEDULED - Remove TransactionMeta.merchantId; update PaymentChannel with creatable channels distinction - Make balance.getBalance() optional for currencies, fetching all by default - Add fields channel, merchantReference, rate, meta.otpRequired, meta.failureReason to Transaction - Add shouldPreferSourceAmount to CreateTransactionRequest - Enhance PaymentMethod with new fields: reference, capabilities, routingNumber, status, and card/dynamic fields - Add channel, currencies, capabilities, and status filters to ListPaymentMethodsParams - Expand InstitutionCodesParams.country support beyond US for SWIFT lookups - Update webhook payload types to match real API and adjust transaction status types - Add MCP server tools for customer update, verification, and transaction authorization - Remove unsupported inputs channel and meta.merchantId from MCP create_transaction tool - Update documentation with new method usage and parameter changes across all affected API sections - Bump package versions: @afriex/core to 2.0.0, @afriex/balance to 1.4.0, @afriex/customers to 2.0.0, @afriex/payment-methods to 3.0.0, @afriex/mcp-server to 1.1.0, @afriex/checkout to 2.0.1 - Update dependencies and improve error handling and API consistency throughout the SDK
- Changed default `OAUTH_DB_PATH` = `./a.db` - Updated relevant documentation to reflect new default path - Clarified storage usage for registered clients, auth codes, and tokens
…DK v3 - Introduce structuredContent and outputSchema to all tools for typed JSON responses - Reconstruct output schemas in src/schemas/output.ts matching Afriex SDK v3 types - Add new tool afriex_resolve_institution_code to resolve bank codes to names - Extend afriex_create_payment_method with VIRTUAL_BANK_ACCOUNT and ACH_BANK_ACCOUNT channels - Expand afriex_get_institutions channels to include SWIFT, UPI, INTERAC, WE_CHAT - Enhance afriex_list_payment_methods with filters: channel, currencies, capabilities, status - Add optional customerId to afriex_get_pool_account and optional reference to virtual account tools - Make currencies optional in afriex_get_balance to fetch all supported currencies when omitted - Allow CARD channel in afriex_create_checkout_session tool - Update all tool implementations to return structuredContent alongside text content - Update documentation, changelog, and package version to 1.2.0 reflecting these changes
…erTestWebhook - Change `triggerTestWebhook` to require `entityId` as the primary identifier - Keep `resourceId` as a deprecated fallback mapped to `entityId` with a console warning - Update SDK, MCP server, and webhooks package to support `entityId` field - Modify API call to send `entityId` instead of `resourceId` to pass backend validation - Update documentation and examples to reflect the change to `entityId` - Add tests to verify behavior when using `entityId`, deprecated `resourceId`, and both - Remove direct usage of `resourceId` except as deprecated alias with warning - Provide deprecation warning when `resourceId` is used without `entityId`
- Upgrade @changesets/cli to 2.31.0 and related Changesets packages - Update @types/node to 22.20.1 across multiple packages - Bump turbo to version 2.10.4 and associated binaries - Upgrade vitest to 4.1.10 for testing improvements - Update fumadocs packages and related @types/react, @types/mdx dependencies - Upgrade React and React-DOM to 19.2.7 versions - Update next.js and associated packages to 16.2.10 - Bump Express to version 5.2.1 and other backend dependencies like pino to v10 - Upgrade rimraf and TypeScript to versions 6.1.3 and 5.9.3 respectively - Update @vercel/analytics to 2.0.1 with expanded peer dependencies - Update various optional and peer dependencies including tailwindcss to 4.3.2 - Refresh @tybys/wasm-util to 0.10.3 and other utility packages
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.