fix: return 202 for notifications with stale sessions, warn on updateTable columns (#654)

**Issue #654 (critical):** handleRequest() returned HTTP 400 for JSON-RPC
notifications with stale/expired session IDs. Per JSON-RPC 2.0 spec,
notifications don't expect responses. Returning 400 caused Claude's proxy
to interpret the connection as broken, triggering reconnection storms
(930 errors/day, 216 users affected).

Fix: Added isJsonRpcNotification() helper that detects single and batch
notifications (messages with method but no id field). Path C in
handleRequest() now returns 202 Accepted for notifications with stale
sessions instead of 400. Also added TOCTOU null guard in Path B.

**Issue 1 (medium):** updateTable silently accepted columns parameter
via the shared MCP tool schema. Zod stripped it but gave no feedback.

Fix: handleUpdateTable now detects columns in raw args and appends a
warning to the response. Tool schema descriptions clarified that columns
are for createTable only and schema is immutable after creation.

Conceived by Romuald Członkowski - https://www.aiadvisors.pl/en

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
czlonkowski
2026-03-22 19:21:29 +01:00
parent 6f6668acc4
commit e52a04a291
7 changed files with 188 additions and 10 deletions

View File

@@ -363,6 +363,22 @@ describe('Data Table Handlers (n8n_manage_datatable)', () => {
expect(result.success).toBe(false);
expect(result.error).toBe('Update failed');
});
it('should warn when columns parameter is passed', async () => {
const updatedTable = { id: 'dt-1', name: 'Renamed' };
mockApiClient.updateDataTable.mockResolvedValue(updatedTable);
const result = await handlers.handleUpdateTable({
tableId: 'dt-1',
name: 'Renamed',
columns: [{ name: 'phone', type: 'string' }],
});
expect(result.success).toBe(true);
expect(result.message).toContain('columns parameter was ignored');
expect(result.message).toContain('immutable after creation');
expect(mockApiClient.updateDataTable).toHaveBeenCalledWith('dt-1', { name: 'Renamed' });
});
});
// ========================================================================