@better-auth/mcp 1.7.0-rc.1 → 1.7.0-rc.2

package/dist/client/adapters.d.mts

@@ -1,5 +1,4 @@
 import { McpResourceClient, McpResourceClientOptions, McpSession } from "./index.mjs";
-
 //#region src/client/adapters.d.ts
 interface HonoContext {
   req: {

package/dist/client/adapters.mjs

@@ -5,7 +5,8 @@ const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource"
 function getProtectedResourceMetadataPath(resource) {
 	const resourceUrl = new URL(resource);
 	if (resourceUrl.origin === "null") return PROTECTED_RESOURCE_METADATA_PATH;
-	return `${PROTECTED_RESOURCE_METADATA_PATH}${resourceUrl.pathname === "/" ? "" : resourceUrl.pathname.replace(/\/$/, "")}`;
+	const resourcePath = resourceUrl.pathname === "/" ? "" : resourceUrl.pathname.replace(/\/$/, "");
+	return `${PROTECTED_RESOURCE_METADATA_PATH}${resourcePath}`;
 }
 function getProtectedResourceMetadataURL(resource) {
 	const resourceUrl = new URL(resource);
@@ -36,14 +37,17 @@ function mcpAuthHono(options) {
 			if (isDpopBindingError(error)) return unauthorized(c, dpopChallenge, "Invalid or expired token");
 			throw error;
 		}
-		if (!session) return unauthorized(c, parseAccessTokenAuthorization(authHeader)?.scheme === "DPoP" || !!c.req.header("DPoP") ? dpopChallenge : `Bearer resource_metadata="${resourceMetadata}"`, authHeader ? "Invalid or expired token" : "Unauthorized: Authentication required");
+		if (!session) {
+			const challenge = parseAccessTokenAuthorization(authHeader)?.scheme === "DPoP" || !!c.req.header("DPoP") ? dpopChallenge : `Bearer resource_metadata="${resourceMetadata}"`;
+			return unauthorized(c, challenge, authHeader ? "Invalid or expired token" : "Unauthorized: Authentication required");
+		}
 		c.set("mcpSession", session);
 		await next();
 	};
 	const discoveryRoutes = (app, serverURL) => {
 		const discoveryFn = client.discoveryHandler();
 		const protectedResourceFn = client.protectedResourceHandler(serverURL);
-		const protectedResourcePaths = new Set([PROTECTED_RESOURCE_METADATA_PATH, getProtectedResourceMetadataPath(options.resource ?? client.authURL)]);
+		const protectedResourcePaths = /* @__PURE__ */ new Set([PROTECTED_RESOURCE_METADATA_PATH, getProtectedResourceMetadataPath(options.resource ?? client.authURL)]);
 		app.get("/.well-known/oauth-authorization-server", async (c) => {
 			const response = await discoveryFn(c.req.raw);
 			const data = await response.json().catch(() => ({ error: "Invalid response from auth server" }));

package/dist/client/index.d.mts

@@ -1,6 +1,5 @@
 import { VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { JWTPayload } from "jose";
-
 //#region src/client/index.d.ts
 interface McpResourceClientOptions {
   authURL: string;
@@ -30,7 +29,9 @@ interface NodeLikeRequest {
 }
 interface NodeLikeResponse {
   set?: (name: string, value: string) => void;
+  get?: (name: string) => string | undefined;
   setHeader?: (name: string, value: string) => void;
+  getHeader?: (name: string) => string | number | string[] | undefined;
   status?: (code: number) => {
     json: (body: unknown) => void;
   };

package/dist/client/index.mjs

@@ -30,7 +30,19 @@ function makeWWWAuthenticate(authURL, resource) {
 function makeDpopWWWAuthenticate(algorithms) {
 	return `DPoP algs="${algorithms.map((alg) => alg.replace(/[\r\n"\\]/g, "")).join(" ")}"`;
 }
-function make401Response(wwwAuth) {
+function addExposeHeader(headers, headerName) {
+	const exposedHeaders = headers["Access-Control-Expose-Headers"];
+	if (!exposedHeaders) return {
+		...headers,
+		"Access-Control-Expose-Headers": headerName
+	};
+	const alreadyExposed = exposedHeaders.split(",").some((header) => header.trim().toLowerCase() === headerName.toLowerCase());
+	return {
+		...headers,
+		"Access-Control-Expose-Headers": alreadyExposed ? exposedHeaders : `${exposedHeaders}, ${headerName}`
+	};
+}
+function make401Response(wwwAuth, corsHeaders) {
 	return Response.json({
 		jsonrpc: "2.0",
 		error: {
@@ -41,10 +53,13 @@ function make401Response(wwwAuth) {
 		id: null
 	}, {
 		status: 401,
-		headers: { "WWW-Authenticate": wwwAuth }
+		headers: {
+			...addExposeHeader(corsHeaders, "WWW-Authenticate"),
+			"WWW-Authenticate": wwwAuth
+		}
 	});
 }
-function send401Node(res, wwwAuth, message) {
+function send401Node(res, wwwAuth, message, corsHeaders) {
 	const body = JSON.stringify({
 		jsonrpc: "2.0",
 		error: {
@@ -53,13 +68,21 @@ function send401Node(res, wwwAuth, message) {
 		},
 		id: null
 	});
+	const existingExposedHeaders = res.get?.("Access-Control-Expose-Headers") ?? res.getHeader?.("Access-Control-Expose-Headers") ?? res.getHeader?.("access-control-expose-headers");
+	const headers = {
+		...addExposeHeader({
+			...corsHeaders,
+			...existingExposedHeaders ? { "Access-Control-Expose-Headers": Array.isArray(existingExposedHeaders) ? existingExposedHeaders.join(", ") : String(existingExposedHeaders) } : {}
+		}, "WWW-Authenticate"),
+		"WWW-Authenticate": wwwAuth
+	};
 	if (typeof res.set === "function") {
-		res.set("WWW-Authenticate", wwwAuth);
+		for (const [name, value] of Object.entries(headers)) res.set(name, value);
 		res.status?.(401).json(JSON.parse(body));
 	} else if (typeof res.writeHead === "function") {
 		res.writeHead(401, {
 			"Content-Type": "application/json",
-			"WWW-Authenticate": wwwAuth
+			...headers
 		});
 		res.end?.(body);
 	}
@@ -159,10 +182,10 @@ function createMcpResourceClient(options) {
 			try {
 				session = await verifyRequest(req);
 			} catch (error) {
-				if (isDpopBindingError(error)) return make401Response(makeDpopWWWAuthenticate(dpopSigningAlgorithms));
+				if (isDpopBindingError(error)) return make401Response(makeDpopWWWAuthenticate(dpopSigningAlgorithms), corsHeaders);
 				throw error;
 			}
-			if (!session) return make401Response(selectChallenge(req.headers.get("Authorization"), req.headers.has("DPoP")));
+			if (!session) return make401Response(selectChallenge(req.headers.get("Authorization"), req.headers.has("DPoP")), corsHeaders);
 			return fn(req, session);
 		};
 	};
@@ -217,13 +240,13 @@ function createMcpResourceClient(options) {
 				session = await verifyRequest(request);
 			} catch (error) {
 				if (isDpopBindingError(error)) {
-					send401Node(res, makeDpopWWWAuthenticate(dpopSigningAlgorithms), "Invalid or expired token");
+					send401Node(res, makeDpopWWWAuthenticate(dpopSigningAlgorithms), "Invalid or expired token", corsHeaders);
 					return;
 				}
 				throw error;
 			}
 			if (!session) {
-				send401Node(res, selectChallenge(authHeader, !!getHeader(req, "dpop")), authHeader ? "Invalid or expired token" : "Unauthorized: Authentication required");
+				send401Node(res, selectChallenge(authHeader, !!getHeader(req, "dpop")), authHeader ? "Invalid or expired token" : "Unauthorized: Authentication required", corsHeaders);
 				return;
 			}
 			req.mcpSession = session;

package/dist/index.d.mts

@@ -3,7 +3,6 @@ import { DpopReplayReservations, DpopReplayStore, verifyAccessTokenRequest } fro
 import { JWTPayload } from "jose";
 import { Awaitable } from "@better-auth/core";
 import { BetterAuthOptions } from "better-auth/types";
-
 //#region src/handler.d.ts
 /**
  * A request middleware handler that verifies an MCP access token and responds
@@ -11,10 +10,11 @@ import { BetterAuthOptions } from "better-auth/types";
  *
  * @external
  */
-declare const mcpHandler: (/** Verifier options. `audience` must match the protected resource identifier. */
-
+declare const mcpHandler: (
+/** Verifier options. `audience` must match the protected resource identifier. */
 verifyOptions: Parameters<typeof verifyAccessTokenRequest>[1], handler: (req: Request, jwt: JWTPayload) => Awaitable<Response>, opts?: {
-  /** Maps non-url (ie urn, client) resources to resource_metadata */resourceMetadataMappings: Record<string, string>;
+  /** Maps non-url (ie urn, client) resources to resource_metadata */
+  resourceMetadataMappings: Record<string, string>;
 }) => (req: Request) => Promise<Response>;
 //#endregion
 //#region src/plugin.d.ts

package/dist/index.mjs

@@ -43,7 +43,7 @@ const mcpHandler = (verifyOptions, handler, opts) => {
 //#endregion
 //#region src/plugin.ts
 const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
-const AUTHORIZATION_SERVER_ONLY_SCOPES = new Set([
+const AUTHORIZATION_SERVER_ONLY_SCOPES = /* @__PURE__ */ new Set([
 	"openid",
 	"profile",
 	"email",
@@ -133,7 +133,7 @@ const mcp = (options) => {
 			} catch {
 				resourcePath = "";
 			}
-			if (!new Set([PROTECTED_RESOURCE_METADATA_PATH, `${PROTECTED_RESOURCE_METADATA_PATH}${resourcePath}`]).has(requestPath)) return;
+			if (!(/* @__PURE__ */ new Set([PROTECTED_RESOURCE_METADATA_PATH, `${PROTECTED_RESOURCE_METADATA_PATH}${resourcePath}`])).has(requestPath)) return;
 			if (request.method !== "GET" && request.method !== "HEAD") return { response: new Response(null, {
 				status: 405,
 				headers: { Allow: "GET, HEAD" }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/mcp",
-  "version": "1.7.0-rc.1",
+  "version": "1.7.0-rc.2",
   "description": "Model Context Protocol (MCP) plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -63,22 +63,22 @@
   },
   "dependencies": {
     "jose": "^6.1.3",
-    "@better-auth/oauth-provider": "^1.7.0-rc.1"
+    "@better-auth/oauth-provider": "^1.7.0-rc.2"
   },
   "devDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.1",
     "better-call": "1.3.7",
     "listhen": "1.9.0",
-    "tsdown": "0.21.1",
-    "@better-auth/core": "1.7.0-rc.1",
-    "better-auth": "1.7.0-rc.1"
+    "tsdown": "0.22.7",
+    "better-auth": "1.7.0-rc.2",
+    "@better-auth/core": "1.7.0-rc.2"
   },
   "peerDependencies": {
     "@better-auth/utils": "0.4.2",
     "@better-fetch/fetch": "1.3.1",
     "better-call": "1.3.7",
-    "@better-auth/core": "^1.7.0-rc.1",
-    "better-auth": "^1.7.0-rc.1"
+    "better-auth": "^1.7.0-rc.2",
+    "@better-auth/core": "^1.7.0-rc.2"
   },
   "scripts": {
     "build": "tsdown",