Skip to content

v2.1.0 — App-only auth fixes & Graph API correctness

Latest
Latest

Choose a tag to compare

View all tags
@chikingsley chikingsley released this 22 Feb 11:45
· 2 commits to main since this release
v2.1.0
14a6eda

What's Changed

Critical Bug Fixes

  • All me/ endpoints replaced with users/{mailbox}/ — me/ is invalid with client credentials (app-only) auth and returned cpim_sts_Unsupported_endpoint for every single API call. The server was effectively non-functional.
  • Permission checks always blocked writes — getCurrentUserEmail() called GET /me which silently failed, returning an empty string, causing every send/archive/delete/rules operation to be rejected regardless of mailbox. Removed and replaced with an explicit mailbox parameter.
  • Double URL-encoding of email IDs — encodeURIComponent(emailId) in handlers conflicted with path-segment encoding in graph-api.ts, corrupting URLs for any email ID containing special characters.
  • $search + $orderby rejected by Graph API — cannot be combined on mail endpoints; removed $orderby when $search is active.
  • $search + $filter rejected by Graph API — cannot be combined on mail endpoints; addBooleanFilters no longer called when $search is set.

New: mailbox Parameter

All tools that access Outlook data now require a mailbox parameter (e.g., chi@desertservices.net). This is required for app-only auth, where there is no "signed-in user" — the server must be told which mailbox to operate on.

Other Fixes & Improvements

  • Calendar list-events switched from me/events to calendarView endpoint — correctly expands recurring event instances within a 30-day window
  • accept-event tool handler was never wired up — now correctly registered
  • fallbackRequestHandler replaced with proper SDK setRequestHandler calls
  • isError: true added to all error return paths
  • additionalProperties: false added to all tool input schemas
  • SDK updated to @modelcontextprotocol/sdk v1.26.0

Removed

  • outlook-auth-server.ts and bun run auth-server script — delegated OAuth server, not needed with client credentials
  • One-off root-level dev scripts and shell scripts
  • package-lock.json (project uses Bun)
  • Unused zod dependency

Azure Permission Requirements

Ensure your app registration has these Application permissions (admin consent required):

Permission Purpose
Mail.Read Read emails
Mail.ReadWrite Move, archive, update emails
Mail.Send Send emails
Calendars.ReadWrite Calendar operations
MailboxSettings.ReadWrite Inbox rules (NOT covered by Mail.ReadWrite)

Tests

114 passing tests across 4 test files covering mailbox permissions, tool schemas, error paths, and mock-mode integration.

Full Changelog: v2.0.0...v2.1.0

Assets 2
Loading