@dereekb/firebase-server 13.11.18 → 13.12.1

package/oidc/index.cjs.js

@@ -183,6 +183,46 @@ function _define_property$f(obj, key, value) {
      * since those are typically protected by AppCheck.
      */ _define_property$f(this, "protectedPaths", void 0);
         /**
+     * Map of recognized OAuth resource indicator URLs (RFC 8707) to their
+     * {@link OidcResourceServerInfo}. When non-empty, oidc-provider's
+     * `features.resourceIndicators.getResourceServerInfo` is wired to look up
+     * each requested `resource` parameter against this map and reject unknown
+     * resources with `invalid_target`.
+     *
+     * Required for OAuth-aware MCP clients (Claude, mcp-inspector) — they pass
+     * the MCP URL from the protected-resource discovery doc as the `resource`
+     * parameter on `/authorize` and `/token`, and oidc-provider rejects every
+     * such request with `invalid_target` unless that URL is recognized here.
+     *
+     * @example
+     * ```ts
+     * resourceServers: {
+     *   'http://localhost:9902/dereekb-components/us-central1/api/mcp': {
+     *     scope: 'openid profile email offline_access demo model.create model.read model.update model.delete model.query model.invoke',
+     *     audience: 'http://localhost:9902/dereekb-components/us-central1/api/mcp'
+     *   }
+     * }
+     * ```
+     */ _define_property$f(this, "resourceServers", void 0);
+        /**
+     * Absolute URL of the OAuth 2.0 Protected Resource Metadata document
+     * (RFC 9728) for the resources guarded by {@link protectedPaths}.
+     *
+     * When set, the OIDC bearer middleware emits
+     * `WWW-Authenticate: Bearer resource_metadata="<url>", error="invalid_token"`
+     * on 401 responses, so OAuth-aware clients (Claude, mcp-inspector) can
+     * locate the discovery doc without relying on RFC 9728's origin-rooted
+     * path-walkback rule — which only works when the resource server is
+     * actually mounted at the origin root.
+     *
+     * Typically derived from `appMcpUrl` (or the equivalent protected-resource
+     * URL) — e.g. for `appMcpUrl = https://api.example.com/mcp`, the value is
+     * `https://api.example.com/.well-known/oauth-protected-resource`.
+     *
+     * @example
+     * resourceMetadataUrl: 'http://localhost:9902/dereekb-components/us-central1/api/.well-known/oauth-protected-resource'
+     */ _define_property$f(this, "resourceMetadataUrl", void 0);
+        /**
      * Supported token endpoint authentication methods.
      *
      * Overrides the default methods (`client_secret_post`, `client_secret_basic`)
@@ -3863,6 +3903,41 @@ function _ts_generator$5(thisArg, body) {
                         },
                         registrationManagement: {
                             enabled: this.providerConfigService.oidcRegistrationRouteEnabled
+                        },
+                        resourceIndicators: {
+                            enabled: true,
+                            // useGrantedResource: return true so the token endpoint will bind tokens to a previously
+                            // granted resource without requiring the client to re-send the `resource` parameter on each
+                            // refresh — Claude and other MCP clients send `resource` on `/authorize` but not on
+                            // `/token` refresh.
+                            useGrantedResource: function useGrantedResource() {
+                                return true;
+                            },
+                            getResourceServerInfo: function getResourceServerInfo(_ctx, resourceIndicator) {
+                                return _async_to_generator$5(function() {
+                                    var _config_resourceServers, info;
+                                    return _ts_generator$5(this, function(_state) {
+                                        info = (_config_resourceServers = config.resourceServers) === null || _config_resourceServers === void 0 ? void 0 : _config_resourceServers[resourceIndicator];
+                                        if (!info) {
+                                            throw new oidcProvider.errors.InvalidTarget("Unrecognized resource indicator: ".concat(resourceIndicator));
+                                        }
+                                        return [
+                                            2,
+                                            _object_spread$2({
+                                                scope: info.scope
+                                            }, info.audience === undefined ? {} : {
+                                                audience: info.audience
+                                            }, info.accessTokenTTL === undefined ? {} : {
+                                                accessTokenTTL: info.accessTokenTTL
+                                            }, info.accessTokenFormat === undefined ? {
+                                                accessTokenFormat: 'opaque'
+                                            } : {
+                                                accessTokenFormat: info.accessTokenFormat
+                                            })
+                                        ];
+                                    });
+                                })();
+                            }
                         }
                     },
                     extraParams: [
@@ -4098,6 +4173,175 @@ exports.OidcService = __decorate([
     __param(5, common.Inject(exports.OidcEncryptionService))
 ], exports.OidcService);
 
+function _class_call_check$5(instance, Constructor) {
+    if (!(instance instanceof Constructor)) {
+        throw new TypeError("Cannot call a class as a function");
+    }
+}
+function _define_property$6(obj, key, value) {
+    if (key in obj) {
+        Object.defineProperty(obj, key, {
+            value: value,
+            enumerable: true,
+            configurable: true,
+            writable: true
+        });
+    } else {
+        obj[key] = value;
+    }
+    return obj;
+}
+// MARK: Config
+/**
+ * Configuration for `OidcAuthBearerTokenMiddleware` route protection.
+ *
+ * Works in reverse of `FirebaseAppCheckMiddlewareConfig`: instead of protecting
+ * all routes and ignoring some, this only protects explicitly specified paths.
+ * Routes under the global API prefix (protected by AppCheck) are excluded.
+ *
+ * @example
+ * Manual configuration without going through `oidcModuleMetadata`:
+ * ```ts
+ * @Module({
+ *   providers: [
+ *     {
+ *       provide: OidcAuthMiddlewareConfig,
+ *       useValue: {
+ *         protectedPaths: ['/api/model', '/mcp'],
+ *         resourceMetadataUrl: 'https://api.example.com/.well-known/oauth-protected-resource'
+ *       } satisfies OidcAuthMiddlewareConfig
+ *     }
+ *   ]
+ * })
+ * export class MyApiModule {}
+ * ```
+ */ var OidcAuthMiddlewareConfig = function OidcAuthMiddlewareConfig() {
+    _class_call_check$5(this, OidcAuthMiddlewareConfig);
+    /**
+     * Path prefixes that require OAuth bearer token verification.
+     *
+     * Only requests matching one of these prefixes will be checked.
+     * Paths under the global API route prefix should not be included
+     * since those are protected by AppCheck.
+     */ _define_property$6(this, "protectedPaths", void 0);
+    /**
+     * Absolute URL of the OAuth 2.0 Protected Resource Metadata document
+     * (RFC 9728). When set, included as the `resource_metadata` parameter
+     * of the `WWW-Authenticate: Bearer` header on 401 responses so OAuth
+     * clients can locate the discovery doc explicitly rather than relying on
+     * origin-rooted path-walkback (which fails when the function isn't
+     * mounted at `/` — e.g. behind the Firebase Functions emulator URL prefix).
+     */ _define_property$6(this, "resourceMetadataUrl", void 0);
+};
+// MARK: WWW-Authenticate
+/**
+ * Builds the `WWW-Authenticate: Bearer ...` challenge string emitted on 401
+ * responses to OAuth-protected routes.
+ *
+ * Per RFC 6750 §3 / RFC 7235, auth-params are comma-separated (optionally
+ * with surrounding whitespace). When `resourceMetadataUrl` is provided, it's
+ * included as the RFC 9728 `resource_metadata` hint so clients can locate the
+ * discovery doc directly instead of relying on origin-rooted path-walkback.
+ *
+ * @param error - The RFC 6750 `error` token (e.g. `invalid_token`, `invalid_request`).
+ * @param resourceMetadataUrl - Optional protected-resource metadata URL.
+ * @returns Header value, e.g. `Bearer resource_metadata="…", error="invalid_token"`.
+ */ function buildBearerChallenge(error, resourceMetadataUrl) {
+    var params = [];
+    if (resourceMetadataUrl) {
+        params.push('resource_metadata="'.concat(resourceMetadataUrl, '"'));
+    }
+    params.push('error="'.concat(error, '"'));
+    return "Bearer ".concat(params.join(', '));
+}
+// MARK: Module
+var _logger = new common.Logger('applyOidcAuthMiddleware');
+// MARK: Express-Level Helper
+/**
+ * Applies OAuth bearer token verification as global Express middleware on
+ * the given NestJS application.
+ *
+ * Resolves `OidcService` and `OidcAuthMiddlewareConfig` from the app's DI container,
+ * then registers an Express middleware that verifies bearer tokens for the configured
+ * protected paths and attaches auth data to `req.auth`.
+ *
+ * This is an alternative to {@link ConfigureOidcAuthMiddlewareModule} for cases where
+ * NestJS module scoping makes the module approach impractical.
+ *
+ * @param nestApp - The NestJS application instance used to resolve dependencies and register the middleware.
+ *
+ * @example
+ * ```ts
+ * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
+ *   moduleClass: AppModule,
+ *   configureNestServerInstance: (nestApp) => {
+ *     applyOidcAuthMiddleware(nestApp);
+ *   }
+ * };
+ * ```
+ *
+ * Pair with `oidcModuleMetadata` (passing `resourceMetadataUrl` on `config`) so
+ * the 401 emits an RFC 9728 `WWW-Authenticate: Bearer resource_metadata="..."`
+ * header — required when the resource server isn't mounted at the origin root
+ * (e.g. behind the Firebase Functions emulator URL prefix), since RFC 9728's
+ * default path-walkback lands at a 404 in that case.
+ *
+ * @example
+ * ```ts
+ * oidcModuleMetadata({
+ *   dependencyModule: MyOidcDependencyModule,
+ *   config: {
+ *     protectedPaths: ['/api/model', '/mcp'],
+ *     resourceMetadataUrl: 'http://localhost:9902/dereekb-components/us-central1/api/.well-known/oauth-protected-resource'
+ *   }
+ * })
+ * ```
+ */ function applyOidcAuthMiddleware(nestApp) {
+    var _ref;
+    var oidcService = nestApp.get(exports.OidcService);
+    var config = nestApp.get(OidcAuthMiddlewareConfig);
+    var protectedPaths = (_ref = config === null || config === void 0 ? void 0 : config.protectedPaths) !== null && _ref !== void 0 ? _ref : [];
+    var resourceMetadataUrl = config === null || config === void 0 ? void 0 : config.resourceMetadataUrl;
+    if (protectedPaths.length === 0) {
+        return;
+    }
+    var logger = new common.Logger('OidcAuthMiddleware');
+    var respond401 = function respond401(res, error, message) {
+        res.setHeader('WWW-Authenticate', buildBearerChallenge(error, resourceMetadataUrl));
+        res.status(401).json({
+            statusCode: 401,
+            message: message
+        });
+    };
+    nestApp.use(function(req, res, next) {
+        var isProtected = protectedPaths.some(function(prefix) {
+            return req.path.startsWith(prefix);
+        });
+        if (isProtected) {
+            var authHeader = req.headers.authorization;
+            if (authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer ')) {
+                var token = authHeader.slice(7);
+                oidcService.verifyAccessToken(token).then(function(oauthAuth) {
+                    if (oauthAuth) {
+                        req.auth = oauthAuth;
+                        next();
+                    } else {
+                        respond401(res, 'invalid_token', 'Invalid or expired access token');
+                    }
+                }).catch(function(err) {
+                    logger.error('Bearer token verification failed', err);
+                    respond401(res, 'invalid_token', 'Token verification failed');
+                });
+            } else {
+                respond401(res, 'invalid_request', 'Missing or invalid Authorization header');
+            }
+        } else {
+            next();
+        }
+    });
+    _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
+}
+
 function asyncGeneratorStep$4(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -4127,7 +4371,7 @@ function _async_to_generator$4(fn) {
         });
     };
 }
-function _class_call_check$5(instance, Constructor) {
+function _class_call_check$4(instance, Constructor) {
     if (!(instance instanceof Constructor)) {
         throw new TypeError("Cannot call a class as a function");
     }
@@ -4145,7 +4389,7 @@ function _create_class$4(Constructor, protoProps, staticProps) {
     if (protoProps) _defineProperties$4(Constructor.prototype, protoProps);
     return Constructor;
 }
-function _define_property$6(obj, key, value) {
+function _define_property$5(obj, key, value) {
     if (key in obj) {
         Object.defineProperty(obj, key, {
             value: value,
@@ -4273,20 +4517,39 @@ function _ts_generator$4(thisArg, body) {
  * verifies it via the provider's AccessToken model, and attaches the
  * auth context to the request as {@link OidcAuthData}.
  *
+ * On 401, emits an RFC 9728 `WWW-Authenticate: Bearer ...` header — including
+ * the `resource_metadata` discovery URL when `OidcAuthMiddlewareConfig.resourceMetadataUrl`
+ * is configured — so OAuth-aware clients (Claude, mcp-inspector, etc.) can
+ * locate the discovery doc explicitly.
+ *
  * Applied to routes via {@link ConfigureOidcAuthMiddlewareModule}.
  *
+ * @example
+ * Wired automatically when `protectedPaths` is set on `oidcModuleMetadata`:
+ * ```ts
+ * oidcModuleMetadata({
+ *   dependencyModule: MyOidcDependencyModule,
+ *   config: {
+ *     protectedPaths: ['/api/model', '/mcp'],
+ *     resourceMetadataUrl: 'https://api.example.com/.well-known/oauth-protected-resource'
+ *   }
+ * })
+ * ```
+ *
  * @throws {UnauthorizedException} When the Authorization header is missing, malformed, or the token is invalid/expired.
  */ exports.OidcAuthBearerTokenMiddleware = /*#__PURE__*/ function() {
-    function OidcAuthBearerTokenMiddleware(oidcService) {
-        _class_call_check$5(this, OidcAuthBearerTokenMiddleware);
-        _define_property$6(this, "oidcService", void 0);
-        _define_property$6(this, "logger", new common.Logger('OidcAuthBearerTokenMiddleware'));
+    function OidcAuthBearerTokenMiddleware(oidcService, config) {
+        _class_call_check$4(this, OidcAuthBearerTokenMiddleware);
+        _define_property$5(this, "oidcService", void 0);
+        _define_property$5(this, "config", void 0);
+        _define_property$5(this, "logger", new common.Logger('OidcAuthBearerTokenMiddleware'));
         this.oidcService = oidcService;
+        this.config = config;
     }
     _create_class$4(OidcAuthBearerTokenMiddleware, [
         {
             key: "use",
-            value: function use(req, _res, next) {
+            value: function use(req, res, next) {
                 return _async_to_generator$4(function() {
                     var authHeader, token, oauthAuth, err;
                     return _ts_generator$4(this, function(_state) {
@@ -4294,6 +4557,7 @@ function _ts_generator$4(thisArg, body) {
                             case 0:
                                 authHeader = req.headers.authorization;
                                 if (!(authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer '))) {
+                                    this._setWwwAuthenticate(res, 'invalid_request');
                                     throw new common.UnauthorizedException('Missing or invalid Authorization header');
                                 }
                                 token = authHeader.slice(7);
@@ -4312,6 +4576,7 @@ function _ts_generator$4(thisArg, body) {
                             case 2:
                                 oauthAuth = _state.sent();
                                 if (!oauthAuth) {
+                                    this._setWwwAuthenticate(res, 'invalid_token');
                                     throw new common.UnauthorizedException('Invalid or expired access token');
                                 }
                                 req.auth = oauthAuth;
@@ -4326,6 +4591,7 @@ function _ts_generator$4(thisArg, body) {
                                     throw err;
                                 }
                                 this.logger.error('Bearer token verification failed', err);
+                                this._setWwwAuthenticate(res, 'invalid_token');
                                 throw new common.UnauthorizedException('Token verification failed');
                             case 4:
                                 return [
@@ -4335,122 +4601,23 @@ function _ts_generator$4(thisArg, body) {
                     });
                 }).call(this);
             }
+        },
+        {
+            key: "_setWwwAuthenticate",
+            value: function _setWwwAuthenticate(res, error) {
+                var _this_config;
+                res.setHeader('WWW-Authenticate', buildBearerChallenge(error, (_this_config = this.config) === null || _this_config === void 0 ? void 0 : _this_config.resourceMetadataUrl));
+            }
         }
     ]);
     return OidcAuthBearerTokenMiddleware;
 }();
 exports.OidcAuthBearerTokenMiddleware = __decorate([
     common.Injectable(),
-    __param(0, common.Inject(exports.OidcService))
+    __param(0, common.Inject(exports.OidcService)),
+    __param(1, common.Inject(OidcAuthMiddlewareConfig))
 ], exports.OidcAuthBearerTokenMiddleware);
 
-function _class_call_check$4(instance, Constructor) {
-    if (!(instance instanceof Constructor)) {
-        throw new TypeError("Cannot call a class as a function");
-    }
-}
-function _define_property$5(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
-// MARK: Config
-/**
- * Configuration for `OidcAuthBearerTokenMiddleware` route protection.
- *
- * Works in reverse of `FirebaseAppCheckMiddlewareConfig`: instead of protecting
- * all routes and ignoring some, this only protects explicitly specified paths.
- * Routes under the global API prefix (protected by AppCheck) are excluded.
- */ var OidcAuthMiddlewareConfig = function OidcAuthMiddlewareConfig() {
-    _class_call_check$4(this, OidcAuthMiddlewareConfig);
-    /**
-     * Path prefixes that require OAuth bearer token verification.
-     *
-     * Only requests matching one of these prefixes will be checked.
-     * Paths under the global API route prefix should not be included
-     * since those are protected by AppCheck.
-     */ _define_property$5(this, "protectedPaths", void 0);
-};
-// MARK: Module
-var _logger = new common.Logger('applyOidcAuthMiddleware');
-// MARK: Express-Level Helper
-/**
- * Applies OAuth bearer token verification as global Express middleware on
- * the given NestJS application.
- *
- * Resolves `OidcService` and `OidcAuthMiddlewareConfig` from the app's DI container,
- * then registers an Express middleware that verifies bearer tokens for the configured
- * protected paths and attaches auth data to `req.auth`.
- *
- * This is an alternative to {@link ConfigureOidcAuthMiddlewareModule} for cases where
- * NestJS module scoping makes the module approach impractical.
- *
- * @param nestApp - The NestJS application instance used to resolve dependencies and register the middleware.
- *
- * @example
- * ```ts
- * export const APP_NEST_SERVER_CONFIG: NestServerInstanceConfig<AppModule> = {
- *   moduleClass: AppModule,
- *   configureNestServerInstance: (nestApp) => {
- *     applyOidcAuthMiddleware(nestApp);
- *   }
- * };
- * ```
- */ function applyOidcAuthMiddleware(nestApp) {
-    var _ref;
-    var oidcService = nestApp.get(exports.OidcService);
-    var config = nestApp.get(OidcAuthMiddlewareConfig);
-    var protectedPaths = (_ref = config === null || config === void 0 ? void 0 : config.protectedPaths) !== null && _ref !== void 0 ? _ref : [];
-    if (protectedPaths.length === 0) {
-        return;
-    }
-    var logger = new common.Logger('OidcAuthMiddleware');
-    nestApp.use(function(req, res, next) {
-        var isProtected = protectedPaths.some(function(prefix) {
-            return req.path.startsWith(prefix);
-        });
-        if (isProtected) {
-            var authHeader = req.headers.authorization;
-            if (authHeader === null || authHeader === void 0 ? void 0 : authHeader.startsWith('Bearer ')) {
-                var token = authHeader.slice(7);
-                oidcService.verifyAccessToken(token).then(function(oauthAuth) {
-                    if (oauthAuth) {
-                        req.auth = oauthAuth;
-                        next();
-                    } else {
-                        res.status(401).json({
-                            statusCode: 401,
-                            message: 'Invalid or expired access token'
-                        });
-                    }
-                }).catch(function(err) {
-                    logger.error('Bearer token verification failed', err);
-                    res.status(401).json({
-                        statusCode: 401,
-                        message: 'Token verification failed'
-                    });
-                });
-            } else {
-                res.status(401).json({
-                    statusCode: 401,
-                    message: 'Missing or invalid Authorization header'
-                });
-            }
-        } else {
-            next();
-        }
-    });
-    _logger.debug("Applied OAuth bearer token middleware for paths: ".concat(protectedPaths.join(', ')));
-}
-
 // MARK: Express-Level Helper
 /**
  * Enables CORS on the NestJS app for OIDC cross-origin requests originating from the frontend.
@@ -6104,14 +6271,16 @@ function _ts_generator(thisArg, body) {
 }
 // MARK: Well-Known Controller
 /**
- * Controller for OAuth/OIDC discovery and metadata endpoints.
+ * Controller for OIDC discovery and JWKS endpoints under `/.well-known`.
+ *
+ * The protected-resource discovery doc (`/.well-known/oauth-protected-resource`)
+ * is owned by the protected resource itself (the MCP module's
+ * `McpWellKnownController`), not the authorization server, per RFC 9728.
  */ exports.OidcWellKnownController = /*#__PURE__*/ function() {
-    function OidcWellKnownController(config, providerConfigService, jwksService) {
+    function OidcWellKnownController(providerConfigService, jwksService) {
         _class_call_check(this, OidcWellKnownController);
-        _define_property$1(this, "config", void 0);
         _define_property$1(this, "providerConfigService", void 0);
         _define_property$1(this, "jwksService", void 0);
-        this.config = config;
         this.providerConfigService = providerConfigService;
         this.jwksService = jwksService;
     }
@@ -6164,23 +6333,6 @@ function _ts_generator(thisArg, body) {
                     });
                 }).call(this);
             }
-        },
-        {
-            /**
-     * OAuth Protected Resource discovery endpoint (RFC 8707).
-     *
-     * Returns the authorization server(s) that protect this resource,
-     * allowing clients to discover which authorization server to use.
-     *
-     * @returns The protected resource metadata with authorization server URLs.
-     */ key: "getProtectedResource",
-            value: function getProtectedResource() {
-                return {
-                    authorization_servers: [
-                        this.config.issuer
-                    ]
-                };
-            }
         }
     ]);
     return OidcWellKnownController;
@@ -6191,14 +6343,10 @@ __decorate([
 __decorate([
     common.Get('jwks.json')
 ], exports.OidcWellKnownController.prototype, "getJwks", null);
-__decorate([
-    common.Get('oauth-protected-resource')
-], exports.OidcWellKnownController.prototype, "getProtectedResource", null);
 exports.OidcWellKnownController = __decorate([
     common.Controller('.well-known'),
-    __param(0, common.Inject(OidcModuleConfig)),
-    __param(1, common.Inject(exports.OidcProviderConfigService)),
-    __param(2, common.Inject(exports.JwksService))
+    __param(0, common.Inject(exports.OidcProviderConfigService)),
+    __param(1, common.Inject(exports.JwksService))
 ], exports.OidcWellKnownController);
 
 function _array_like_to_array(arr, len) {
@@ -6395,6 +6543,7 @@ function _unsupported_iterable_to_array(o, minLen) {
         tokenLifetimes: DEFAULT_OIDC_TOKEN_LIFETIMES,
         trustProxy: envService.isProduction,
         trustProxyInNonProduction: false,
+        resourceMetadataUrl: deriveResourceMetadataUrlFromEnv(envService),
         jwksServiceConfig: {
             encryptionSecret: encryptionSecret
         },
@@ -6405,6 +6554,27 @@ function _unsupported_iterable_to_array(o, minLen) {
     OidcModuleConfig.assertValidConfig(config);
     return config;
 }
+/**
+ * Derives the RFC 9728 protected-resource metadata URL from `envService.appMcpUrl`.
+ *
+ * For `appMcpUrl = http://localhost:9902/dereekb-components/us-central1/api/mcp`, this
+ * returns `http://localhost:9902/dereekb-components/us-central1/api/.well-known/oauth-protected-resource` —
+ * i.e. the discovery doc colocated with the MCP endpoint, regardless of any URL prefix
+ * imposed by the runtime (Firebase Functions emulator, Cloud Run path, etc.).
+ *
+ * Returns `undefined` when no `appMcpUrl` is configured.
+ *
+ * @param envService - The Firebase server environment service.
+ * @returns The discovery URL, or `undefined` if `appMcpUrl` is not set.
+ */ function deriveResourceMetadataUrlFromEnv(envService) {
+    var mcpUrl = envService.appMcpUrl;
+    if (!mcpUrl) {
+        return undefined;
+    }
+    var parsed = new URL(mcpUrl);
+    var trimmedPath = parsed.pathname.replace(/\/[^/]*\/?$/, '');
+    return "".concat(parsed.origin).concat(trimmedPath, "/.well-known/oauth-protected-resource");
+}
 /**
  * Factory that creates {@link OidcServerFirestoreCollections} using the provided Firestore context
  * and JWKS encryption config from {@link OidcModuleConfig}.
@@ -6435,7 +6605,7 @@ function _unsupported_iterable_to_array(o, minLen) {
  * @param metadataConfig - The configuration for generating the OIDC module metadata.
  * @returns The NestJS module metadata for the OIDC module.
  */ function oidcModuleMetadata(metadataConfig) {
-    var dependencyModule = metadataConfig.dependencyModule, config$1 = metadataConfig.config, imports = metadataConfig.imports, exports$1 = metadataConfig.exports, providers = metadataConfig.providers;
+    var dependencyModule = metadataConfig.dependencyModule, config$1 = metadataConfig.config, configFactory = metadataConfig.configFactory, imports = metadataConfig.imports, exports$1 = metadataConfig.exports, providers = metadataConfig.providers;
     var dependencyModuleImport = [
         dependencyModule
     ];
@@ -6465,10 +6635,12 @@ function _unsupported_iterable_to_array(o, minLen) {
                 ],
                 useFactory: function useFactory(configService, envService) {
                     var moduleConfig = oidcModuleConfigFactory(configService, envService);
+                    var dynamicOverrides = configFactory ? configFactory(envService, configService) : undefined;
+                    var merged = config$1 || dynamicOverrides ? _object_spread({}, config$1, dynamicOverrides) : undefined;
                     var result = moduleConfig;
-                    if (config$1) {
-                        result = _object_spread({}, moduleConfig, config$1);
-                        if (config$1.trustProxyInNonProduction && !envService.isProduction) {
+                    if (merged) {
+                        result = _object_spread({}, moduleConfig, merged);
+                        if (merged.trustProxyInNonProduction && !envService.isProduction) {
                             result.trustProxy = true;
                         }
                     }
@@ -6480,7 +6652,8 @@ function _unsupported_iterable_to_array(o, minLen) {
                 useFactory: function useFactory(x) {
                     var _x_protectedPaths;
                     return {
-                        protectedPaths: (_x_protectedPaths = x.protectedPaths) !== null && _x_protectedPaths !== void 0 ? _x_protectedPaths : []
+                        protectedPaths: (_x_protectedPaths = x.protectedPaths) !== null && _x_protectedPaths !== void 0 ? _x_protectedPaths : [],
+                        resourceMetadataUrl: x.resourceMetadataUrl
                     };
                 },
                 inject: [
@@ -6591,10 +6764,12 @@ exports.activeJwksKeysQuery = activeJwksKeysQuery;
 exports.appOidcModelModuleMetadata = appOidcModelModuleMetadata;
 exports.applyOidcAuthMiddleware = applyOidcAuthMiddleware;
 exports.applyOidcCorsMiddleware = applyOidcCorsMiddleware;
+exports.buildBearerChallenge = buildBearerChallenge;
 exports.createAdapterFactory = createAdapterFactory;
 exports.createOidcClientFactory = createOidcClientFactory;
 exports.deleteOidcClientFactory = deleteOidcClientFactory;
 exports.deleteOidcTokenFactory = deleteOidcTokenFactory;
+exports.deriveResourceMetadataUrlFromEnv = deriveResourceMetadataUrlFromEnv;
 exports.getOidcScopesFromRequest = getOidcScopesFromRequest;
 exports.jwksKeyCollectionReference = jwksKeyCollectionReference;
 exports.jwksKeyConverter = jwksKeyConverter;