@ferrlabs/mcp-core 6.4.0 → 6.5.0

package/dist/transports/__tests__/http.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http.test.d.ts.map

package/dist/transports/__tests__/http.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.test.d.ts","sourceRoot":"","sources":["../../../src/transports/__tests__/http.test.ts"],"names":[],"mappings":""}

package/dist/transports/__tests__/http.test.js

@@ -0,0 +1,24 @@
+import { describe, it, expect } from 'vitest';
+import { unauthorizedChallenge } from '../http.js';
+describe('unauthorizedChallenge', () => {
+    const metadataUrl = 'https://mcp.ferrvault.com/.well-known/oauth-protected-resource';
+    it('returns an RFC 6749 §5.2 error body where `error` is a string', () => {
+        const { body } = unauthorizedChallenge(metadataUrl);
+        const parsed = JSON.parse(body);
+        expect(typeof parsed.error).toBe('string');
+        expect(parsed.error).toBe('invalid_token');
+        expect(typeof parsed.error_description).toBe('string');
+    });
+    it('does not emit a JSON-RPC envelope that strict OAuth clients reject', () => {
+        const { body } = unauthorizedChallenge(metadataUrl);
+        const parsed = JSON.parse(body);
+        expect(parsed.jsonrpc).toBeUndefined();
+        expect(typeof parsed.error).not.toBe('object');
+    });
+    it('builds a Bearer challenge carrying the error code and the resource metadata URL', () => {
+        const { wwwAuthenticate } = unauthorizedChallenge(metadataUrl);
+        expect(wwwAuthenticate.startsWith('Bearer ')).toBe(true);
+        expect(wwwAuthenticate).toContain('error="invalid_token"');
+        expect(wwwAuthenticate).toContain(`resource_metadata="${metadataUrl}"`);
+    });
+});

package/dist/transports/http.d.ts

@@ -1,4 +1,8 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function unauthorizedChallenge(metadataUrl: string): {
+    wwwAuthenticate: string;
+    body: string;
+};
 export interface HttpServerOptions {
     port: number;
     host?: string;

package/dist/transports/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAiBzE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,SAAS,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoBD,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6I5E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAoBzE,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG;IAC1D,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CACd,CAQA;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,YAAY,EAAE,MAAM,SAAS,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAoBD,wBAAsB,eAAe,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqI5E"}

package/dist/transports/http.js

@@ -14,6 +14,16 @@ function publicOrigin(req) {
     const host = req.headers['x-forwarded-host'] ?? req.headers.host ?? '';
     return `${proto}://${host}`;
 }
+const UNAUTHORIZED_DESCRIPTION = 'Missing or invalid bearer token. Fetch the OAuth protected-resource metadata and run the authorization code + PKCE flow.';
+export function unauthorizedChallenge(metadataUrl) {
+    return {
+        wwwAuthenticate: `Bearer error="invalid_token", error_description="${UNAUTHORIZED_DESCRIPTION}", resource_metadata="${metadataUrl}"`,
+        body: JSON.stringify({
+            error: 'invalid_token',
+            error_description: UNAUTHORIZED_DESCRIPTION,
+        }),
+    };
+}
 async function readJsonBody(req) {
     if (req.method !== 'POST')
         return undefined;
@@ -40,19 +50,12 @@ export async function startHttpServer(opts) {
     const transports = new Map();
     function sendUnauthorized(req, res) {
         const origin = publicOrigin(req);
-        const metadataUrl = `${origin}/.well-known/oauth-protected-resource`;
+        const { wwwAuthenticate, body } = unauthorizedChallenge(`${origin}/.well-known/oauth-protected-resource`);
         res.writeHead(401, {
             'Content-Type': 'application/json',
-            'WWW-Authenticate': `Bearer resource_metadata="${metadataUrl}"`,
+            'WWW-Authenticate': wwwAuthenticate,
         });
-        res.end(JSON.stringify({
-            jsonrpc: '2.0',
-            error: {
-                code: -32001,
-                message: 'Missing or invalid bearer token. The MCP client should fetch the OAuth protected-resource metadata and run the authorization code + PKCE flow.',
-            },
-            id: null,
-        }));
+        res.end(body);
     }
     function sendResourceMetadata(req, res) {
         const origin = publicOrigin(req);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ferrlabs/mcp-core",
-  "version": "6.4.0",
+  "version": "6.5.0",
   "description": "Shared core for FerrLabs MCP servers — auth, transports (stdio + Streamable HTTP), api-client, runner",
   "license": "MPL-2.0",
   "type": "module",