@platf/bridge 0.0.13 → 0.0.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -26,15 +26,21 @@ export function createDiscoveryRouter(auth, logger) {
|
|
|
26
26
|
* The `resource` field MUST match the URL the client is accessing (RFC 9728 §2).
|
|
27
27
|
* For path-suffixed requests like /.well-known/oauth-protected-resource/mcp,
|
|
28
28
|
* the resource is the path after the well-known prefix.
|
|
29
|
+
*
|
|
30
|
+
* IMPORTANT: We advertise the BRIDGE as the authorization_server (not the upstream issuer).
|
|
31
|
+
* This ensures clients use our proxied AS metadata (which patches registration_endpoint),
|
|
32
|
+
* rather than going directly to the upstream auth server's DCR endpoint.
|
|
29
33
|
*/
|
|
30
34
|
router.get('/.well-known/oauth-protected-resource', (req, res) => {
|
|
31
35
|
// Exact match — client is looking for the root resource
|
|
32
36
|
// Return /mcp as that's our protected endpoint
|
|
33
37
|
const scheme = req.protocol;
|
|
34
38
|
const host = req.get('host');
|
|
39
|
+
const bridgeOrigin = `${scheme}://${host}`;
|
|
35
40
|
const resourceMetadata = {
|
|
36
|
-
resource: `${
|
|
37
|
-
|
|
41
|
+
resource: `${bridgeOrigin}/mcp`,
|
|
42
|
+
// Point to OURSELVES so clients use our proxied AS metadata
|
|
43
|
+
authorization_servers: [bridgeOrigin],
|
|
38
44
|
scopes_supported: ['openid', 'profile', 'email'],
|
|
39
45
|
bearer_methods_supported: ['header'],
|
|
40
46
|
};
|
|
@@ -44,10 +50,12 @@ export function createDiscoveryRouter(auth, logger) {
|
|
|
44
50
|
// Path-suffixed request — the suffix IS the protected resource path
|
|
45
51
|
const scheme = req.protocol;
|
|
46
52
|
const host = req.get('host');
|
|
53
|
+
const bridgeOrigin = `${scheme}://${host}`;
|
|
47
54
|
const resourcePath = '/' + req.params[0];
|
|
48
55
|
const resourceMetadata = {
|
|
49
|
-
resource: `${
|
|
50
|
-
|
|
56
|
+
resource: `${bridgeOrigin}${resourcePath}`,
|
|
57
|
+
// Point to OURSELVES so clients use our proxied AS metadata
|
|
58
|
+
authorization_servers: [bridgeOrigin],
|
|
51
59
|
scopes_supported: ['openid', 'profile', 'email'],
|
|
52
60
|
bearer_methods_supported: ['header'],
|
|
53
61
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"discoveryRoutes.js","sourceRoot":"","sources":["../../src/lib/discoveryRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAA;AAG7D,MAAM,UAAU,qBAAqB,CAAC,IAAgB,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB
|
|
1
|
+
{"version":3,"file":"discoveryRoutes.js","sourceRoot":"","sources":["../../src/lib/discoveryRoutes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAA;AAG7D,MAAM,UAAU,qBAAqB,CAAC,IAAgB,EAAE,MAAc;IACpE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAA;IAEvB;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,CAAC,GAAG,CAAC,uCAAuC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAClF,wDAAwD;QACxD,+CAA+C;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;QAC1C,MAAM,gBAAgB,GAAG;YACvB,QAAQ,EAAE,GAAG,YAAY,MAAM;YAC/B,4DAA4D;YAC5D,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QACpF,oEAAoE;QACpE,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,MAAM,YAAY,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAA;QAC1C,MAAM,YAAY,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,gBAAgB,GAAG;YACvB,QAAQ,EAAE,GAAG,YAAY,GAAG,YAAY,EAAE;YAC1C,4DAA4D;YAC5D,qBAAqB,EAAE,CAAC,YAAY,CAAC;YACrC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YAChD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;SACrC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,GAAG,CAAC,0CAA0C,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC3F,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,yCAAyC,CAAA;YAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;YAEzC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,KAAK,CAAC,4CAA4C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC3E,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;YAEnE,yDAAyD;YACzD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAA;YAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC5B,QAAQ,CAAC,qBAAqB,GAAG,GAAG,MAAM,MAAM,IAAI,iBAAiB,CAAA;YAErE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACpB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,yCAAyC,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,CAAA;YAC3E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,GAAY,EAAE,GAAa,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAA;QAC3B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,WAAW,EAAE,cAAc;YAC3B,8CAA8C;YAC9C,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;SAC3E,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}
|
package/package.json
CHANGED
|
@@ -30,15 +30,21 @@ export function createDiscoveryRouter(auth: AuthConfig, logger: Logger): Router
|
|
|
30
30
|
* The `resource` field MUST match the URL the client is accessing (RFC 9728 §2).
|
|
31
31
|
* For path-suffixed requests like /.well-known/oauth-protected-resource/mcp,
|
|
32
32
|
* the resource is the path after the well-known prefix.
|
|
33
|
+
*
|
|
34
|
+
* IMPORTANT: We advertise the BRIDGE as the authorization_server (not the upstream issuer).
|
|
35
|
+
* This ensures clients use our proxied AS metadata (which patches registration_endpoint),
|
|
36
|
+
* rather than going directly to the upstream auth server's DCR endpoint.
|
|
33
37
|
*/
|
|
34
38
|
router.get('/.well-known/oauth-protected-resource', (req: Request, res: Response) => {
|
|
35
39
|
// Exact match — client is looking for the root resource
|
|
36
40
|
// Return /mcp as that's our protected endpoint
|
|
37
41
|
const scheme = req.protocol
|
|
38
42
|
const host = req.get('host')
|
|
43
|
+
const bridgeOrigin = `${scheme}://${host}`
|
|
39
44
|
const resourceMetadata = {
|
|
40
|
-
resource: `${
|
|
41
|
-
|
|
45
|
+
resource: `${bridgeOrigin}/mcp`,
|
|
46
|
+
// Point to OURSELVES so clients use our proxied AS metadata
|
|
47
|
+
authorization_servers: [bridgeOrigin],
|
|
42
48
|
scopes_supported: ['openid', 'profile', 'email'],
|
|
43
49
|
bearer_methods_supported: ['header'],
|
|
44
50
|
}
|
|
@@ -49,10 +55,12 @@ export function createDiscoveryRouter(auth: AuthConfig, logger: Logger): Router
|
|
|
49
55
|
// Path-suffixed request — the suffix IS the protected resource path
|
|
50
56
|
const scheme = req.protocol
|
|
51
57
|
const host = req.get('host')
|
|
58
|
+
const bridgeOrigin = `${scheme}://${host}`
|
|
52
59
|
const resourcePath = '/' + req.params[0]
|
|
53
60
|
const resourceMetadata = {
|
|
54
|
-
resource: `${
|
|
55
|
-
|
|
61
|
+
resource: `${bridgeOrigin}${resourcePath}`,
|
|
62
|
+
// Point to OURSELVES so clients use our proxied AS metadata
|
|
63
|
+
authorization_servers: [bridgeOrigin],
|
|
56
64
|
scopes_supported: ['openid', 'profile', 'email'],
|
|
57
65
|
bearer_methods_supported: ['header'],
|
|
58
66
|
}
|