@sidecar-ai/cli 0.1.0-alpha.5 → 0.1.0-alpha.6

package/dist/index.js

@@ -3963,6 +3963,11 @@ function createSidecarHttpHandler(options) {
   const streamHub = createSseHub();
   const mcp = createSidecarMcpServer(options);
   return async (request, response) => {
+    const pathname = request.url?.split("?")[0];
+    const requestLog = createHttpRequestLog(request, pathname);
+    response.once("finish", () => {
+      logHttpRequest(requestLog, response.statusCode);
+    });
     if (isRejectedOrigin(request, options.allowedOrigins)) {
       response.writeHead(403, { "content-type": "application/json" });
       response.end(JSON.stringify({ error: "forbidden_origin" }));
@@ -3974,16 +3979,17 @@ function createSidecarHttpHandler(options) {
       response.end(proxyResult.body ?? "");
       return;
     }
-    const pathname = request.url?.split("?")[0];
     if (options.auth && request.method === "GET" && isProtectedResourceMetadataPath(pathname, endpoint)) {
       response.writeHead(200, { "content-type": "application/json" });
       response.end(JSON.stringify(options.auth.metadata()));
       return;
     }
+    if (options.auth && request.method === "GET" && pathname === "/.well-known/oauth-authorization-server") {
+      await proxyAuthorizationServerMetadata(options.auth, response);
+      return;
+    }
     if (request.method === "GET" && pathname === endpoint) {
       try {
-        validateProtocolVersion(request);
-        validateGetHeaders(request);
         const fetchRequest = toFetchRequest(request, options.publicUrl ?? options.auth?.resource);
         if (options.auth) {
           const authSession = await authorizeHttpRequest(options.auth, fetchRequest, response);
@@ -3991,6 +3997,8 @@ function createSidecarHttpHandler(options) {
             return;
           }
         }
+        validateProtocolVersion(request);
+        validateGetHeaders(request);
         streamHub.open(response);
       } catch (error) {
         const status = error instanceof JsonRpcHttpError ? error.status : 400;
@@ -4019,6 +4027,11 @@ function createSidecarHttpHandler(options) {
       return;
     }
     try {
+      const fetchRequest = toFetchRequest(request, options.publicUrl ?? options.auth?.resource);
+      const authSession = options.auth ? await authorizeHttpRequest(options.auth, fetchRequest, response) : void 0;
+      if (options.auth && authSession === AUTH_RESPONSE_SENT) {
+        return;
+      }
       validateProtocolVersion(request);
       validatePostHeaders(request);
       const body = await readJson(request, maxBodyBytes);
@@ -4031,11 +4044,6 @@ function createSidecarHttpHandler(options) {
         return;
       }
       const rpcRequest = assertJsonRpcRequest(body);
-      const fetchRequest = toFetchRequest(request, options.publicUrl ?? options.auth?.resource);
-      const authSession = options.auth ? await authorizeHttpRequest(options.auth, fetchRequest, response) : void 0;
-      if (options.auth && authSession === AUTH_RESPONSE_SENT) {
-        return;
-      }
       if (rpcRequest.id !== void 0 && hasProgressToken(rpcRequest)) {
         const stream = createSseStream(response, { supportsRequestProgress: true });
         const payload2 = await mcp.handle(rpcRequest, {
@@ -4127,6 +4135,73 @@ function escapeRegExp(value) {
 function isProtectedResourceMetadataPath(pathname, endpoint) {
   return pathname === "/.well-known/oauth-protected-resource" || pathname === `/.well-known/oauth-protected-resource${endpoint}`;
 }
+function createHttpRequestLog(request, pathname) {
+  return {
+    method: request.method,
+    path: pathname,
+    host: truncateHeader(singleHeader(request.headers.host)),
+    accept: truncateHeader(singleHeader(request.headers.accept)),
+    contentType: truncateHeader(singleHeader(request.headers["content-type"])),
+    contentLength: truncateHeader(singleHeader(request.headers["content-length"])),
+    mcpProtocolVersion: truncateHeader(singleHeader(request.headers["mcp-protocol-version"])),
+    origin: truncateHeader(singleHeader(request.headers.origin)),
+    userAgent: truncateHeader(singleHeader(request.headers["user-agent"])),
+    authorization: request.headers.authorization ? "present" : "absent",
+    cookie: request.headers.cookie ? "present" : "absent"
+  };
+}
+function logHttpRequest(metadata, status) {
+  const debug = process.env.SIDECAR_DEBUG === "1" || process.env.SIDECAR_LOG_LEVEL === "debug";
+  if (!debug && status < 400) {
+    return;
+  }
+  const message = JSON.stringify({
+    event: "sidecar.mcp.http",
+    status,
+    ...stripUndefined4(metadata)
+  });
+  if (status >= 500) {
+    console.error(message);
+  } else if (status >= 400) {
+    console.warn(message);
+  } else {
+    console.info(message);
+  }
+}
+function singleHeader(value) {
+  return Array.isArray(value) ? value.join(", ") : value;
+}
+function truncateHeader(value) {
+  if (!value) {
+    return void 0;
+  }
+  return value.length > 240 ? `${value.slice(0, 237)}...` : value;
+}
+async function proxyAuthorizationServerMetadata(auth, response) {
+  const [authorizationServer] = auth.authorizationServers;
+  if (!authorizationServer) {
+    response.writeHead(404, { "content-type": "application/json" });
+    response.end(JSON.stringify({ error: "authorization_server_not_configured" }));
+    return;
+  }
+  try {
+    const url = new URL("/.well-known/oauth-authorization-server", authorizationServer);
+    const upstream = await fetch(url, { headers: { accept: "application/json" } });
+    const body = await upstream.text();
+    response.writeHead(upstream.ok ? 200 : 502, {
+      "content-type": upstream.headers.get("content-type") ?? "application/json"
+    });
+    response.end(body);
+  } catch (error) {
+    console.warn(JSON.stringify({
+      event: "sidecar.mcp.authorization_metadata_proxy_failed",
+      authorizationServer,
+      message: error instanceof Error ? error.message : "Unknown error"
+    }));
+    response.writeHead(502, { "content-type": "application/json" });
+    response.end(JSON.stringify({ error: "authorization_metadata_unavailable" }));
+  }
+}
 var JsonRpcError = class extends Error {
   constructor(code, message, data) {
     super(message);