@better-auth/mcp 1.8.0-beta.7 → 1.8.0-beta.9

package/dist/index.d.mts

@@ -1,9 +1,8 @@
 import { OAuthOptions, Scope, oauthProvider } from "@better-auth/oauth-provider";
-import { DpopReplayReservations, DpopReplayStore } from "better-auth/oauth2";
+import { DpopReplayReservations, DpopReplayStore, VerifyAccessTokenRequestOptions } from "better-auth/oauth2";
 import { Awaitable } from "@better-auth/core";
 import { JWTPayload, JWTVerifyOptions } from "jose";
 import { BetterAuthOptions } from "better-auth/types";
-//#region src/handler.d.ts
 interface McpProtectedRequestHandlerOptions {
   /** Expected authorization-server issuer for the access token. */
   issuer: string;
@@ -38,6 +37,15 @@ interface McpProtectedRequestHandlerOptions {
     proofMaxAgeSeconds?: number;
     signingAlgorithms?: readonly string[];
     replayStore?: DpopReplayStore;
+    /**
+     * Require server-provided nonces in DPoP proofs (RFC 9449 §9). A proof
+     * without a current nonce gets a `401` `use_dpop_nonce` challenge with a
+     * fresh `DPoP-Nonce`, and successful DPoP responses carry the next one.
+     * Responses that carry a nonce are marked `Cache-Control: no-store`. Use
+     * the authorization server's secret to accept the nonces it issues, such
+     * as when the MCP server shares its origin.
+     */
+    nonce?: NonNullable<VerifyAccessTokenRequestOptions["dpop"]>["nonce"];
   };
 }
 /**
@@ -49,8 +57,6 @@ interface McpProtectedRequestHandlerOptions {
  * @external
  */
 export declare const createMcpProtectedRequestHandler: (options: McpProtectedRequestHandlerOptions, handler: (request: Request, accessTokenClaims: JWTPayload) => Awaitable<Response>) => (request: Request) => Promise<Response>;
-//#endregion
-//#region src/plugin.d.ts
 /**
  * Options for the {@link mcp} plugin: the full OAuth provider configuration plus
  * the MCP resource identifier.
@@ -125,8 +131,6 @@ interface McpOptions extends OAuthOptions<Scope[]> {
  * ```
  */
 export declare const mcp: (options: McpOptions) => ReturnType<typeof oauthProvider>;
-//#endregion
-//#region src/require-mcp-auth.d.ts
 interface RequireMcpAuthOptions {
   /**
    * The protected resource identifier the access token must be bound to.
@@ -167,6 +171,26 @@ interface RequireMcpAuthOptions {
     proofMaxAgeSeconds?: number;
     signingAlgorithms?: readonly string[];
     replayStore?: DpopReplayStore;
+    /**
+     * Require server-provided nonces in DPoP proofs (RFC 9449 §9). A proof
+     * without a current nonce gets a `401` `use_dpop_nonce` challenge with a
+     * fresh `DPoP-Nonce`, and successful DPoP responses carry the next one.
+     *
+     * Nonces are derived from the auth instance's secret, the same way the
+     * OAuth provider's `dpop.nonce` derives them, so the MCP server accepts
+     * the nonces the provider issues. Pass `secret` only to keep the MCP
+     * server's nonces separate, such as for an MCP server on its own origin.
+     */
+    nonce?: {
+      required: boolean;
+      /**
+       * Seconds a nonce is accepted after it is issued. Defaults to the OAuth
+       * provider's `dpop.nonce.expiresIn`, then to `300`.
+       */
+      expiresIn?: number;
+      /** Defaults to the auth instance's secret. */
+      secret?: string;
+    };
   };
 }
 /**
@@ -192,7 +216,7 @@ export declare const requireMcpAuth: <Auth extends {
   $context: Promise<{
     baseURL: string;
     internalAdapter: DpopReplayReservations;
+    secret?: string;
   }>;
 }>(auth: Auth, handler: (request: Request, accessTokenClaims: JWTPayload) => Awaitable<Response>, opts?: RequireMcpAuthOptions) => (req: Request) => Promise<Response>;
-//#endregion
 export type { McpOptions, McpProtectedRequestHandlerOptions, RequireMcpAuthOptions };

package/dist/index.mjs

@@ -1,7 +1,8 @@
 import { isLoopbackHost } from "@better-auth/core/utils/host";
 import { createResourceServerChallenge, getIssuer, metadataResponse, oauthProvider } from "@better-auth/oauth-provider";
-import { DPOP_SIGNING_ALGORITHMS, createDpopReplayStore, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest } from "better-auth/oauth2";
-//#region src/handler.ts
+import { withExposedHeaders } from "@better-auth/oauth-provider/internal";
+import { DPOP_NONCE_HEADER, DPOP_SIGNING_ALGORITHMS, createDpopNonce, createDpopReplayStore, getDpopJktFromPayload, isInsufficientScopeError, requestToResourceInput, verifyAccessTokenRequest } from "better-auth/oauth2";
+// src/handler.ts
 /**
 * Validates the canonical protected-resource identifier accepted by MCP.
 *
@@ -21,6 +22,23 @@ function validateMcpResource(resource) {
 	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) throw new TypeError("MCP resource URL must use HTTPS, except for localhost or loopback IP development URLs");
 	return resource;
 }
+/**
+* Returns `response` with the next DPoP nonce (RFC 9449 §8.2). The response
+* gets `Cache-Control: no-store`, overriding the handler's policy, because a
+* cached copy would hand clients the nonce after it expires. The headers are copied
+* because a handler's `Response` may have immutable headers.
+*/
+async function withNextDpopNonce(response, secret) {
+	const headers = new Headers(response.headers);
+	headers.set("Cache-Control", "no-store");
+	headers.set(DPOP_NONCE_HEADER, await createDpopNonce({ secret }));
+	headers.set("Access-Control-Expose-Headers", withExposedHeaders(headers.get("access-control-expose-headers"), DPOP_NONCE_HEADER));
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
 function toChallengeResponse(error, resource, opts) {
 	const challenge = createResourceServerChallenge(error, resource, opts);
 	if (!challenge) throw error;
@@ -69,18 +87,23 @@ const createMcpProtectedRequestHandler = (options, handler) => {
 		try {
 			accessTokenClaims = await verifyAccessTokenRequest(requestToResourceInput(request), accessTokenVerificationOptions);
 		} catch (error) {
-			return toChallengeResponse(error, resource, resolvedChallengeOptions);
+			return toChallengeResponse(error, resource, {
+				...resolvedChallengeOptions,
+				request
+			});
 		}
+		let response;
 		try {
-			return await handler(request, accessTokenClaims);
+			response = await handler(request, accessTokenClaims);
 		} catch (error) {
 			if (isInsufficientScopeError(error)) return toChallengeResponse(error, resource, resolvedChallengeOptions);
 			throw error;
 		}
+		const nonce = options.dpop?.nonce;
+		return nonce?.required && getDpopJktFromPayload(accessTokenClaims) ? withNextDpopNonce(response, nonce.secret) : response;
 	};
 };
-//#endregion
-//#region src/plugin.ts
+// src/plugin.ts
 const PROTECTED_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource";
 const AUTHORIZATION_SERVER_ONLY_SCOPES = /* @__PURE__ */ new Set([
 	"openid",
@@ -199,8 +222,11 @@ const mcp = (options) => {
 		}
 	};
 };
-//#endregion
-//#region src/require-mcp-auth.ts
+// src/require-mcp-auth.ts
+/** The OAuth provider's `dpop.nonce.expiresIn`, which `mcp()` passes through. */
+function getProviderNonceExpiresIn(options) {
+	return (options.plugins?.find((plugin) => plugin.id === "oauth-provider"))?.options?.dpop?.nonce?.expiresIn;
+}
 /**
 * Protects an MCP server route handler. Verifies the bearer access token
 * against the authorization server's JWKS (checking signature, issuer,
@@ -222,8 +248,11 @@ const mcp = (options) => {
 const requireMcpAuth = (auth, handler, opts) => {
 	if (opts?.resource !== void 0) validateMcpResource(opts.resource);
 	return async (req) => {
-		const { baseURL, internalAdapter } = await auth.$context;
+		const { baseURL, internalAdapter, secret } = await auth.$context;
 		if (!baseURL) throw new Error("requireMcpAuth requires a resolvable base URL. For dynamic base URLs use `createMcpProtectedRequestHandler` with explicit verification options.");
+		const nonce = opts?.dpop?.nonce;
+		const nonceSecret = nonce?.secret ?? secret;
+		if (nonce?.required && !nonceSecret) throw new Error("requireMcpAuth requires dpop.nonce.secret when the auth context has no secret.");
 		const issuer = opts?.issuer ?? baseURL;
 		const resource = opts?.resource ?? baseURL;
 		const jwksUrl = opts?.jwksUrl ?? `${baseURL}/jwks`;
@@ -238,10 +267,14 @@ const requireMcpAuth = (auth, handler, opts) => {
 			dpop: {
 				proofMaxAgeSeconds: opts?.dpop?.proofMaxAgeSeconds,
 				signingAlgorithms: opts?.dpop?.signingAlgorithms,
-				replayStore: opts?.dpop?.replayStore ?? createDpopReplayStore(internalAdapter)
+				replayStore: opts?.dpop?.replayStore ?? createDpopReplayStore(internalAdapter),
+				nonce: nonce && nonceSecret ? {
+					required: nonce.required,
+					expiresIn: nonce.expiresIn ?? getProviderNonceExpiresIn(auth.options),
+					secret: nonceSecret
+				} : void 0
 			}
 		}, handler)(req);
 	};
 };
-//#endregion
 export { createMcpProtectedRequestHandler, mcp, requireMcpAuth };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/mcp",
-  "version": "1.8.0-beta.7",
+  "version": "1.8.0-beta.9",
   "description": "Model Context Protocol (MCP) plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -46,21 +46,21 @@
     }
   },
   "dependencies": {
-    "jose": "^6.1.3",
-    "@better-auth/oauth-provider": "^1.8.0-beta.7"
+    "@better-auth/oauth-provider": "^1.8.0-beta.9",
+    "jose": "^6.1.3"
   },
   "devDependencies": {
+    "@better-auth/core": "1.8.0-beta.9",
     "@modelcontextprotocol/client": "2.3.1",
     "@modelcontextprotocol/server": "2.3.1",
+    "better-auth": "1.8.0-beta.9",
     "better-call": "1.4.5",
-    "tsdown": "0.23.1",
-    "@better-auth/core": "1.8.0-beta.7",
-    "better-auth": "1.8.0-beta.7"
+    "tsdown": "0.23.1"
   },
   "peerDependencies": {
-    "better-call": "1.4.5",
-    "@better-auth/core": "^1.8.0-beta.7",
-    "better-auth": "^1.8.0-beta.7"
+    "@better-auth/core": "^1.8.0-beta.9",
+    "better-auth": "^1.8.0-beta.9",
+    "better-call": "1.4.5"
   },
   "scripts": {
     "build": "tsdown",