mcp-data-platform-v0.35.9

What's New

Four portal UX improvements plus hardening fixes for share-by-email.

Public JSX Rendering

Shared JSX assets now render as live React components instead of raw source code. The public viewer generates a sandboxed iframe with a full client-side React runtime:

• Import maps for React 19, Recharts, and Lucide (matching the authenticated portal)
• Sucrase transpilation loaded from esm.sh for JSX-to-JS conversion
• Automatic component detection (exported default, then PascalCase declarations)
• Auto-mounting via createRoot().render() unless the source contains its own mount call
• Error display for transpilation and runtime failures
• Content-type-aware CSP: JSX content gets frame-src blob: data: while other types use the default strict policy
• CodeQL-safe injection via html/template + json.Marshal + template.JS

Session Expiration Handling

API clients now detect 401 responses globally and display a "session expired" banner:

• Both apiFetch and apiFetchRaw call expireSession() on 401
• Auth state is cleared and sessionExpired flag is set
• Login form shows an amber "Your session has expired" banner
• React Query retry function skips 401s (no retry loops)
• Flag resets on successful re-login

Share by Email

Users can share assets by email address instead of opaque user IDs:

• New shared_with_email column on portal_shares (migration 016)
• Partial index on non-null email values for query performance
• Email is validated (format check, 254-char RFC 5321 limit) and normalized to lowercase on write
• Case-insensitive matching on read via strings.EqualFold (Go) and LOWER() (SQL)
• "Shared With Me" queries match on both user ID (backward compat) and email
• Access checks (isSharedWithUser) also check both paths

Share Dialog Polish

• Active shares show "Public Link" labels (not truncated tokens)
• Time remaining until expiration displayed (days, hours, or minutes)
• Sub-hour display fixed: shows "Expires in 23m" instead of "Expires in 0h"
• "Copy Link" text button with clipboard fallback for non-HTTPS contexts
• Email input field for sharing with users

Help Section

• Help tab heading and description now use the configured portal title via useBranding() instead of hardcoded "MCP Data Platform"

Migration

This release includes migration 016 which adds a nullable shared_with_email TEXT column to portal_shares with a partial index. The migration is backward-compatible -- existing shares by user ID continue to work.

Changelog

• feat: portal UX enhancements -- JSX public links, session expiry, share-by-email (#198) @cjimti
• fix: resolve CodeQL unsafe-quoting in JSX public viewer @cjimti
• fix: harden share-by-email with validation, case normalization, and UX fixes @cjimti

Installation

Homebrew (macOS)

brew install txn2/tap/mcp-data-platform

Claude Code CLI

claude mcp add mcp-data-platform -- mcp-data-platform

Docker

docker pull ghcr.io/txn2/mcp-data-platform:v0.35.9

Verification

All release artifacts are signed with Cosign. Verify with:

cosign verify-blob --bundle mcp-data-platform_0.35.9_linux_amd64.tar.gz.sigstore.json \
  mcp-data-platform_0.35.9_linux_amd64.tar.gz