@markmnl/fmsg-mcp 1.2.2 → 1.2.3

package/dist/http.js

@@ -4,7 +4,7 @@ import { createMcpHandler, hostHeaderValidationResponse, localhostAllowedHostnam
 import { ApiKeyCallerProvider, FMSG_SCOPE } from "./auth.js";
 import { createFmsgMcpServer } from "./server.js";
 import { OAuthCallerProvider } from "./oauth/provider.js";
-import { invalidToken, insufficientScope, missingToken, OAuthRequestError, oauthErrorResponse, oauthRequestState } from "./oauth/errors.js";
+import { invalidToken, insufficientScope, missingToken, notBearer, OAuthRequestError, oauthErrorResponse, oauthRequestState } from "./oauth/errors.js";
 import { MESSAGING_SCOPES, READ_SCOPE, WRITE_SCOPE, requestScopes } from "./oauth/scopes.js";
 import { DOWNLOAD_PATH, downloadBaseUrl, downloadHeaders, parseDownloadPath } from "./download.js";
 import { CHECKSUM_HEADER, UPLOAD_DRAIN_IDLE_MS, UPLOAD_PATH, UploadBodyError, decodedUploadBody, drainableBody, parseUploadPath, uploadEncoding } from "./upload.js";
@@ -350,7 +350,7 @@ export function createHttpServer(config, log = (l) => console.error(l)) {
                 try {
                     const bearer = /^Bearer ([A-Za-z0-9._~+\/-]+=*)$/iu.exec(authorization);
                     if (!bearer)
-                        throw authorization ? invalidToken() : missingToken();
+                        throw !authorization ? missingToken() : /^Bearer\s/iu.test(authorization) ? invalidToken() : notBearer(!!apiKeyProvider);
                     const authenticated = await oauthProvider.verifyAccessToken(bearer[1]);
                     release = () => oauthProvider.release(authenticated);
                     let parsedBody;

package/dist/oauth/errors.d.ts

@@ -14,6 +14,8 @@ export declare class OAuthRequestError extends Error {
     constructor(status: 401 | 403 | 500 | 503, code: string, message: string, scopes?: string[]);
 }
 export declare const invalidToken: () => OAuthRequestError;
+/** An Authorization header without the Bearer scheme, such as a bare API key. */
+export declare const notBearer: (apiKeys: boolean) => OAuthRequestError;
 export declare const missingToken: () => OAuthRequestError;
 export declare const insufficientScope: (scopes: string[]) => OAuthRequestError;
 export declare function oauthErrorResponse(error: OAuthRequestError, metadataUrl: string): Response;

package/dist/oauth/errors.js

@@ -27,6 +27,10 @@ export class OAuthRequestError extends Error {
     }
 }
 export const invalidToken = () => new OAuthRequestError(401, "invalid_token", "The OAuth connection must be refreshed or reconnected.");
+/** An Authorization header without the Bearer scheme, such as a bare API key. */
+export const notBearer = (apiKeys) => new OAuthRequestError(401, "invalid_token", apiKeys
+    ? "The Authorization header must be `Bearer <token>`; send an API key as `Authorization: Bearer fmsgk_...`."
+    : "The Authorization header must be `Bearer <token>`.");
 export const missingToken = () => new OAuthRequestError(401, "invalid_token", "No access token was sent; send this MCP connection's Authorization header.");
 export const insufficientScope = (scopes) => new OAuthRequestError(403, "insufficient_scope", "The OAuth connection does not authorize this operation.", scopes);
 export function oauthErrorResponse(error, metadataUrl) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@markmnl/fmsg-mcp",
   "mcpName": "io.github.markmnl/fmsg-mcp",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "MCP server for fmsg: send and receive federated messages from any AI agent via a deployed fmsg Web API",
   "type": "module",
   "license": "MIT",

package/server.json

@@ -8,13 +8,13 @@
     "url": "https://github.com/markmnl/fmsg-mcp",
     "source": "github"
   },
-  "version": "1.2.2",
+  "version": "1.2.3",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@markmnl/fmsg-mcp",
-      "version": "1.2.2",
+      "version": "1.2.3",
       "transport": {
         "type": "stdio"
       },