@absolutejs/mcp 0.10.1 → 0.10.3

package/README.md

@@ -108,6 +108,7 @@ const server = new Elysia().use(
     // access-token checks; add your own (billing, role, MFA) on top.
     authorize: async (request) => {
       const token = await verifyBearer({
+        audience: "https://your.app/mcp",
         request,
         issuer: "https://your.app",
         requiredScope: "mcp",

package/dist/index.js

@@ -20,7 +20,7 @@ var isRecord = (value) => typeof value === "object" && value !== null && !Array.
 // src/auth.ts
 var MS_PER_SECOND = 1000;
 var verifyBearer = async (config) => {
-  const { issuer, request, verify, requiredScope } = config;
+  const { audience, issuer, request, verify, requiredScope } = config;
   const header = request.headers.get("authorization");
   if (!header?.startsWith("Bearer "))
     return { error: "Missing bearer token" };
@@ -32,6 +32,9 @@ var verifyBearer = async (config) => {
     return { error: "Not an access token" };
   if (payload.iss !== issuer)
     return { error: "Wrong issuer" };
+  const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+  if (audience !== undefined && !audiences.some((candidate) => candidate === audience))
+    return { error: "Wrong audience" };
   const expires = typeof payload.exp === "number" ? payload.exp : 0;
   if (expires * MS_PER_SECOND <= Date.now())
     return { error: "Token expired" };

package/dist/src/auth.d.ts

@@ -5,6 +5,8 @@ export type VerifiedJwt = {
 };
 export type BearerVerifier = (token: string) => Promise<VerifiedJwt | undefined> | VerifiedJwt | undefined;
 export type VerifyBearerConfig = {
+    /** Require the access token to name this protected resource in `aud`. */
+    audience?: string;
     issuer: string;
     request: Request;
     /** Verify the JWT signature and decode it (e.g. `@absolutejs/auth`'s
@@ -20,7 +22,7 @@ export type BearerResult = {
     subject: string;
 };
 /** Verify the `Authorization: Bearer` token: signature (via your `verify`),
- *  `token_use: access`, issuer, expiry, the required scope, and a subject.
+ *  `token_use: access`, issuer, optional audience, expiry, required scope, and a subject.
  *  Returns the decoded payload + parsed scopes + subject, or a reason string.
  *  The reason is safe to surface in the 401 (never why the signature failed). */
 export declare const verifyBearer: (config: VerifyBearerConfig) => Promise<BearerResult>;

package/package.json

@@ -11,7 +11,7 @@
     "elysia": ">=1.1.0"
   },
   "dependencies": {
-    "@absolutejs/agency": "^0.4.0",
+    "@absolutejs/agency": "^0.5.0",
     "@absolutejs/manifest": "^0.3.0",
     "@sinclair/typebox": "^0.34.0"
   },
@@ -58,5 +58,5 @@
     "typecheck": "tsc --noEmit --project tsconfig.json"
   },
   "types": "./dist/src/index.d.ts",
-  "version": "0.10.1"
+  "version": "0.10.3"
 }