@cloudflare/workers-oauth-provider 0.3.0 → 0.3.2

package/dist/oauth-provider.js

@@ -1,6 +1,7 @@
 import { WorkerEntrypoint } from "cloudflare:workers";
 
 //#region src/oauth-provider.ts
+const PROTECTED_RESOURCE_WELL_KNOWN_PREFIX = "/.well-known/oauth-protected-resource";
 if (!(typeof Cloudflare !== "undefined" && Cloudflare.compatibilityFlags?.global_fetch_strictly_public === true)) console.warn("CIMD (Client ID Metadata Document) is disabled: add '\"compatibility_flags\": [\"global_fetch_strictly_public\"]' to your wrangler.jsonc to enable. See: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#global-fetch-strictly-public");
 /**
 * Enum representing the type of handler (ExportedHandler or WorkerEntrypoint)
@@ -141,7 +142,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	async fetch(request, env, ctx) {
 		const url = new URL(request.url);
 		if (request.method === "OPTIONS") {
-			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || url.pathname === "/.well-known/oauth-protected-resource" || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
+			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || this.isProtectedResourceMetadataRequest(url) || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
 				status: 204,
 				headers: { "Content-Length": "0" }
 			}), request);
@@ -150,7 +151,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			const response = await this.handleMetadataDiscovery(url);
 			return this.addCorsHeaders(response, request);
 		}
-		if (url.pathname === "/.well-known/oauth-protected-resource") {
+		if (this.isProtectedResourceMetadataRequest(url)) {
 			const response = this.handleProtectedResourceMetadata(url);
 			return this.addCorsHeaders(response, request);
 		}
@@ -245,6 +246,27 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		return this.matchEndpoint(url, this.options.clientRegistrationEndpoint);
 	}
 	/**
+	* Checks if a URL is a request for OAuth Protected Resource Metadata (RFC 9728).
+	* Matches both the root well-known path and path-suffixed variants per RFC 9728 §3.1.
+	*/
+	isProtectedResourceMetadataRequest(url) {
+		return url.pathname === PROTECTED_RESOURCE_WELL_KNOWN_PREFIX || url.pathname.startsWith(PROTECTED_RESOURCE_WELL_KNOWN_PREFIX + "/");
+	}
+	/**
+	* Derives the resource identifier from a protected resource metadata well-known URL.
+	* Per RFC 9728 §3.1, the well-known URI is inserted after the authority and before the path,
+	* so the resource identifier is reconstructed by removing the well-known prefix.
+	*
+	* Examples:
+	*   /.well-known/oauth-protected-resource       → origin (e.g. https://example.com)
+	*   /.well-known/oauth-protected-resource/mcp   → origin + /mcp (e.g. https://example.com/mcp)
+	*/
+	deriveResourceIdentifier(requestUrl) {
+		const suffix = requestUrl.pathname.slice(37);
+		if (!suffix || suffix === "/") return requestUrl.origin;
+		return `${requestUrl.origin}${suffix}`;
+	}
+	/**
 	* Parses and validates a token endpoint request (used for both token exchange and revocation)
 	* @param request - The HTTP request to parse
 	* @returns Promise with parsed body and client info, or error response
@@ -389,7 +411,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		const tokenEndpointUrl = this.getFullEndpointUrl(this.options.tokenEndpoint, requestUrl);
 		const authServerOrigin = new URL(tokenEndpointUrl).origin;
 		const metadata = {
-			resource: rm?.resource ?? requestUrl.origin,
+			resource: rm?.resource ?? this.deriveResourceIdentifier(requestUrl),
 			authorization_servers: rm?.authorization_servers ?? [authServerOrigin],
 			scopes_supported: rm?.scopes_supported ?? this.options.scopesSupported,
 			bearer_methods_supported: rm?.bearer_methods_supported ?? ["header"]
@@ -956,7 +978,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	*/
 	async handleApiRequest(request, env, ctx) {
 		const url = new URL(request.url);
-		const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+		const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource${url.pathname}`;
 		const authHeader = request.headers.get("Authorization");
 		if (!authHeader || !authHeader.startsWith("Bearer ")) return this.createErrorResponse("invalid_token", "Missing or invalid access token", 401, { "WWW-Authenticate": this.buildWwwAuthenticateHeader(resourceMetadataUrl, "invalid_token", "Missing or invalid access token") });
 		const accessToken = authHeader.substring(7);
@@ -1390,14 +1412,16 @@ function validateRedirectUriScheme(redirectUri) {
 	for (const dangerousScheme of dangerousSchemes) if (scheme === dangerousScheme) throw new Error("Invalid redirect URI");
 }
 /**
-* Checks if a URI is a loopback redirect URI (127.0.0.0/8 or ::1)
-* Per RFC 8252 Section 7.3, these get special port handling
+* Checks if a URI is a loopback redirect URI (127.0.0.0/8, ::1, or localhost).
+* Per RFC 8252 Section 7.3, loopback IPs get special port handling. This library
+* applies the same port flexibility to localhost for native apps (e.g., Claude Code).
 */
 function isLoopbackUri(uri) {
 	try {
 		const host = new URL(uri).hostname;
 		if (host.match(/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/)) return true;
 		if (host === "::1" || host === "[::1]") return true;
+		if (host.toLowerCase() === "localhost") return true;
 		return false;
 	} catch {
 		return false;
@@ -1405,7 +1429,7 @@ function isLoopbackUri(uri) {
 }
 /**
 * Validates a redirect URI against registered URIs with RFC 8252 loopback support.
-* For loopback URIs (127.x.x.x, ::1), any port is allowed as long as scheme, host, path, and query match.
+* For loopback URIs (127.x.x.x, ::1, localhost), any port is allowed as long as scheme, host, path, and query match.
 * For non-loopback URIs, exact match is required.
 */
 function isValidRedirectUri(requestUri, registeredUris) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",