@cloudflare/workers-oauth-provider 0.3.1 → 0.3.2

package/dist/oauth-provider.js

@@ -1,6 +1,7 @@
 import { WorkerEntrypoint } from "cloudflare:workers";
 
 //#region src/oauth-provider.ts
+const PROTECTED_RESOURCE_WELL_KNOWN_PREFIX = "/.well-known/oauth-protected-resource";
 if (!(typeof Cloudflare !== "undefined" && Cloudflare.compatibilityFlags?.global_fetch_strictly_public === true)) console.warn("CIMD (Client ID Metadata Document) is disabled: add '\"compatibility_flags\": [\"global_fetch_strictly_public\"]' to your wrangler.jsonc to enable. See: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#global-fetch-strictly-public");
 /**
 * Enum representing the type of handler (ExportedHandler or WorkerEntrypoint)
@@ -141,7 +142,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	async fetch(request, env, ctx) {
 		const url = new URL(request.url);
 		if (request.method === "OPTIONS") {
-			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || url.pathname === "/.well-known/oauth-protected-resource" || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
+			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || this.isProtectedResourceMetadataRequest(url) || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
 				status: 204,
 				headers: { "Content-Length": "0" }
 			}), request);
@@ -150,7 +151,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			const response = await this.handleMetadataDiscovery(url);
 			return this.addCorsHeaders(response, request);
 		}
-		if (url.pathname === "/.well-known/oauth-protected-resource") {
+		if (this.isProtectedResourceMetadataRequest(url)) {
 			const response = this.handleProtectedResourceMetadata(url);
 			return this.addCorsHeaders(response, request);
 		}
@@ -245,6 +246,27 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		return this.matchEndpoint(url, this.options.clientRegistrationEndpoint);
 	}
 	/**
+	* Checks if a URL is a request for OAuth Protected Resource Metadata (RFC 9728).
+	* Matches both the root well-known path and path-suffixed variants per RFC 9728 §3.1.
+	*/
+	isProtectedResourceMetadataRequest(url) {
+		return url.pathname === PROTECTED_RESOURCE_WELL_KNOWN_PREFIX || url.pathname.startsWith(PROTECTED_RESOURCE_WELL_KNOWN_PREFIX + "/");
+	}
+	/**
+	* Derives the resource identifier from a protected resource metadata well-known URL.
+	* Per RFC 9728 §3.1, the well-known URI is inserted after the authority and before the path,
+	* so the resource identifier is reconstructed by removing the well-known prefix.
+	*
+	* Examples:
+	*   /.well-known/oauth-protected-resource       → origin (e.g. https://example.com)
+	*   /.well-known/oauth-protected-resource/mcp   → origin + /mcp (e.g. https://example.com/mcp)
+	*/
+	deriveResourceIdentifier(requestUrl) {
+		const suffix = requestUrl.pathname.slice(37);
+		if (!suffix || suffix === "/") return requestUrl.origin;
+		return `${requestUrl.origin}${suffix}`;
+	}
+	/**
 	* Parses and validates a token endpoint request (used for both token exchange and revocation)
 	* @param request - The HTTP request to parse
 	* @returns Promise with parsed body and client info, or error response
@@ -389,7 +411,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		const tokenEndpointUrl = this.getFullEndpointUrl(this.options.tokenEndpoint, requestUrl);
 		const authServerOrigin = new URL(tokenEndpointUrl).origin;
 		const metadata = {
-			resource: rm?.resource ?? requestUrl.origin,
+			resource: rm?.resource ?? this.deriveResourceIdentifier(requestUrl),
 			authorization_servers: rm?.authorization_servers ?? [authServerOrigin],
 			scopes_supported: rm?.scopes_supported ?? this.options.scopesSupported,
 			bearer_methods_supported: rm?.bearer_methods_supported ?? ["header"]
@@ -956,7 +978,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	*/
 	async handleApiRequest(request, env, ctx) {
 		const url = new URL(request.url);
-		const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
+		const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource${url.pathname}`;
 		const authHeader = request.headers.get("Authorization");
 		if (!authHeader || !authHeader.startsWith("Bearer ")) return this.createErrorResponse("invalid_token", "Missing or invalid access token", 401, { "WWW-Authenticate": this.buildWwwAuthenticateHeader(resourceMetadataUrl, "invalid_token", "Missing or invalid access token") });
 		const accessToken = authHeader.substring(7);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",