Fix API URL, auth loop, credential sanitization, and expand MCP toolset

[SecOps-7]

Summary

This PR brings bug fixes, security improvements, and feature additions developed while deploying the server in an Azure Web App environment against an
SDPOnDemand instance without a custom domain.

---

Bug Fixes

API URL Construction — Critical

The original code constructed the API base URL as {SDP_BASE_URL}/app/{instanceName}/api/v3. For SDPOnDemand instances without a custom domain, the
/app/{name} path segment is absent. The correct URL is {SDP_BASE_URL}/api/v3. Both sdp-api-client-v2.cjs and sdp-api-metadata.cjs updated.

Infinite 401 Retry Loop — Critical

The axios response interceptor retried requests by calling this.client(originalRequest), re-entering the same interceptor. When a 401 was caused by a
wrong URL (not an expired token), this created an infinite refresh→retry→401 loop until Zoho rate-limited the token endpoint. Fixed by adding a _retry
flag so each request is retried at most once.

testConnection() Calling Invalid Endpoint

The startup connection test called GET /priorities which does not exist on all SDP instances and returns a Tomcat HTML 401 page, triggering the retry
loop on every startup. Now verifies connectivity by successfully obtaining an OAuth access token instead.

Resolution Failing on Closed Tickets (403)

Setting resolution via PUT /requests/{id} fails with 403 on closed tickets. Separated into a dedicated closure_resolution tool requiring an open
ticket, and changed close_request to use POST /requests/{id}/close.

closure_comments 400 Error

SDP enforces a 250-character limit on closure_comments. Added automatic truncation with … suffix.

Environment Variable Loading

Added require('dotenv').config() to working-sse-server.cjs so local .env files load before module initialization.

---

Security

Hardcoded Credentials Removed

All real client IDs, secrets, and tokens previously committed have been replaced with YOUR_CLIENT_ID / YOUR_CLIENT_SECRET / YOUR_REFRESH_TOKEN
placeholders across all config files, docs, and scripts.

.sdp-tokens.json Untracked

Removed from git tracking (git rm --cached) so token cache files are never committed.

.env.example Variable Names Corrected

Renamed SDP_OAUTH_CLIENT_ID → SDP_CLIENT_ID, SDP_OAUTH_CLIENT_SECRET → SDP_CLIENT_SECRET, SDP_OAUTH_REFRESH_TOKEN → SDP_REFRESH_TOKEN to match
what the server actually reads.

---

New MCP Tools

Tool	Description
closure_resolution	Set resolution text on an open request
update_status	Change request status independently
advanced_search_requests	Search with multiple criteria, date ranges, sort
reply_to_requester	Send email reply to requester via note
add_private_note	Add technician-only note
send_first_response	Send first response notification
get_request_conversation	Retrieve full note/conversation history

---

Startup Diagnostics

Added env var log at startup showing all critical config values (secrets masked) and the constructed API base URL, making misconfiguration immediately
visible:

SDP env check:
SDP_BASE_URL = https://sdpondemand.manageengine.com
SDP_CLIENT_ID = (set)
SDP_REFRESH_TOKEN= (set)
SDP API baseURL: https://sdpondemand.manageengine.com/api/v3
✅ SDP API connection successful — OAuth token obtained

---

Schema Expansions

create_request and update_request schemas expanded with: urgency, impact, impact_details, group, technician, support_level, due_by_time,
item, assets, tags, template.

---

Other

• Added CHANGELOG.md
• start_index pagination corrected to 0 (0-based per API docs)
• SDP_INSTANCE_NAME removed from .env.example (consolidated into SDP_PORTAL_NAME)