@cloudflare/workers-oauth-provider 0.3.2 → 0.3.3

package/dist/oauth-provider.js

@@ -1,7 +1,6 @@
 import { WorkerEntrypoint } from "cloudflare:workers";
 
 //#region src/oauth-provider.ts
-const PROTECTED_RESOURCE_WELL_KNOWN_PREFIX = "/.well-known/oauth-protected-resource";
 if (!(typeof Cloudflare !== "undefined" && Cloudflare.compatibilityFlags?.global_fetch_strictly_public === true)) console.warn("CIMD (Client ID Metadata Document) is disabled: add '\"compatibility_flags\": [\"global_fetch_strictly_public\"]' to your wrangler.jsonc to enable. See: https://developers.cloudflare.com/workers/configuration/compatibility-flags/#global-fetch-strictly-public");
 /**
 * Enum representing the type of handler (ExportedHandler or WorkerEntrypoint)
@@ -142,7 +141,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	async fetch(request, env, ctx) {
 		const url = new URL(request.url);
 		if (request.method === "OPTIONS") {
-			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || this.isProtectedResourceMetadataRequest(url) || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
+			if (this.isApiRequest(url) || url.pathname === "/.well-known/oauth-authorization-server" || url.pathname === "/.well-known/oauth-protected-resource" || this.isTokenEndpoint(url) || this.options.clientRegistrationEndpoint && this.isClientRegistrationEndpoint(url)) return this.addCorsHeaders(new Response(null, {
 				status: 204,
 				headers: { "Content-Length": "0" }
 			}), request);
@@ -151,7 +150,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 			const response = await this.handleMetadataDiscovery(url);
 			return this.addCorsHeaders(response, request);
 		}
-		if (this.isProtectedResourceMetadataRequest(url)) {
+		if (url.pathname === "/.well-known/oauth-protected-resource") {
 			const response = this.handleProtectedResourceMetadata(url);
 			return this.addCorsHeaders(response, request);
 		}
@@ -246,27 +245,6 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		return this.matchEndpoint(url, this.options.clientRegistrationEndpoint);
 	}
 	/**
-	* Checks if a URL is a request for OAuth Protected Resource Metadata (RFC 9728).
-	* Matches both the root well-known path and path-suffixed variants per RFC 9728 §3.1.
-	*/
-	isProtectedResourceMetadataRequest(url) {
-		return url.pathname === PROTECTED_RESOURCE_WELL_KNOWN_PREFIX || url.pathname.startsWith(PROTECTED_RESOURCE_WELL_KNOWN_PREFIX + "/");
-	}
-	/**
-	* Derives the resource identifier from a protected resource metadata well-known URL.
-	* Per RFC 9728 §3.1, the well-known URI is inserted after the authority and before the path,
-	* so the resource identifier is reconstructed by removing the well-known prefix.
-	*
-	* Examples:
-	*   /.well-known/oauth-protected-resource       → origin (e.g. https://example.com)
-	*   /.well-known/oauth-protected-resource/mcp   → origin + /mcp (e.g. https://example.com/mcp)
-	*/
-	deriveResourceIdentifier(requestUrl) {
-		const suffix = requestUrl.pathname.slice(37);
-		if (!suffix || suffix === "/") return requestUrl.origin;
-		return `${requestUrl.origin}${suffix}`;
-	}
-	/**
 	* Parses and validates a token endpoint request (used for both token exchange and revocation)
 	* @param request - The HTTP request to parse
 	* @returns Promise with parsed body and client info, or error response
@@ -411,7 +389,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 		const tokenEndpointUrl = this.getFullEndpointUrl(this.options.tokenEndpoint, requestUrl);
 		const authServerOrigin = new URL(tokenEndpointUrl).origin;
 		const metadata = {
-			resource: rm?.resource ?? this.deriveResourceIdentifier(requestUrl),
+			resource: rm?.resource ?? requestUrl.origin,
 			authorization_servers: rm?.authorization_servers ?? [authServerOrigin],
 			scopes_supported: rm?.scopes_supported ?? this.options.scopesSupported,
 			bearer_methods_supported: rm?.bearer_methods_supported ?? ["header"]
@@ -978,7 +956,7 @@ var OAuthProviderImpl = class OAuthProviderImpl {
 	*/
 	async handleApiRequest(request, env, ctx) {
 		const url = new URL(request.url);
-		const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource${url.pathname}`;
+		const resourceMetadataUrl = `${url.origin}/.well-known/oauth-protected-resource`;
 		const authHeader = request.headers.get("Authorization");
 		if (!authHeader || !authHeader.startsWith("Bearer ")) return this.createErrorResponse("invalid_token", "Missing or invalid access token", 401, { "WWW-Authenticate": this.buildWwwAuthenticateHeader(resourceMetadataUrl, "invalid_token", "Missing or invalid access token") });
 		const accessToken = authHeader.substring(7);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",