@softeria/ms-365-mcp-server 0.127.0 → 0.128.0

package/dist/lib/microsoft-auth.js

@@ -1,9 +1,17 @@
 import logger from "../logger.js";
 import { getCloudEndpoints } from "../cloud-config.js";
-function buildWwwAuthenticate(req, error, description) {
+function buildResourceMetadataUrl(req, publicUrl) {
+  if (publicUrl) {
+    const parsed = new URL(publicUrl);
+    const path = parsed.pathname.replace(/\/$/, "");
+    return `${parsed.origin}/.well-known/oauth-protected-resource${path}`;
+  }
   const protocol = req.secure ? "https" : "http";
   const origin = `${protocol}://${req.get("host")}`;
-  const resourceMetadata = `${origin}/.well-known/oauth-protected-resource`;
+  return `${origin}/.well-known/oauth-protected-resource`;
+}
+function buildWwwAuthenticate(req, error, description, publicUrl) {
+  const resourceMetadata = buildResourceMetadataUrl(req, publicUrl);
   return `Bearer resource_metadata="${resourceMetadata}", error="${error}", error_description="${description}"`;
 }
 function isJwtExpired(token) {
@@ -46,7 +54,12 @@ const microsoftBearerTokenAuthMiddleware = (opts = {}) => (req, res, next) => {
     }
     res.status(401).set(
       "WWW-Authenticate",
-      buildWwwAuthenticate(req, "invalid_token", "Missing or malformed Authorization header")
+      buildWwwAuthenticate(
+        req,
+        "invalid_token",
+        "Missing or malformed Authorization header",
+        opts.publicUrl
+      )
     ).json({
       error: "invalid_token",
       error_description: "Missing or malformed Authorization header"
@@ -57,7 +70,7 @@ const microsoftBearerTokenAuthMiddleware = (opts = {}) => (req, res, next) => {
   if (isJwtExpired(accessToken)) {
     res.status(401).set(
       "WWW-Authenticate",
-      buildWwwAuthenticate(req, "invalid_token", "The access token has expired")
+      buildWwwAuthenticate(req, "invalid_token", "The access token has expired", opts.publicUrl)
     ).json({ error: "invalid_token", error_description: "The access token has expired" });
     return;
   }

package/dist/server.js

@@ -229,7 +229,7 @@ class MicrosoftGraphServer {
         const metadata = {
           issuer: browserBase,
           authorization_endpoint: `${browserBase}/authorize`,
-          token_endpoint: `${requestOrigin}/token`,
+          token_endpoint: `${browserBase}/token`,
           response_types_supported: ["code"],
           response_modes_supported: ["query"],
           grant_types_supported: ["authorization_code", "refresh_token"],
@@ -238,23 +238,25 @@ class MicrosoftGraphServer {
           scopes_supported: scopes
         };
         if (this.options.enableDynamicRegistration) {
-          metadata.registration_endpoint = `${requestOrigin}/register`;
+          metadata.registration_endpoint = `${browserBase}/register`;
         }
         res.json(metadata);
       });
-      app.get("/.well-known/oauth-protected-resource", async (req, res) => {
+      const protectedResourcesHandler = async (req, res) => {
         const protocol = req.secure ? "https" : "http";
         const requestOrigin = `${protocol}://${req.get("host")}`;
         const browserBase = publicBase ?? requestOrigin;
         const scopes = this.options.obo ? [`${this.secrets.clientId}/access_as_user`] : resolveAuthScopes(this.options);
         res.json({
-          resource: `${requestOrigin}/mcp`,
+          resource: `${browserBase}/mcp`,
           authorization_servers: [browserBase],
           scopes_supported: scopes,
           bearer_methods_supported: ["header"],
           resource_documentation: browserBase
         });
-      });
+      };
+      app.get("/.well-known/oauth-protected-resource", protectedResourcesHandler);
+      app.get("/.well-known/oauth-protected-resource/*path", protectedResourcesHandler);
       if (this.options.enableDynamicRegistration) {
         app.post("/register", async (req, res) => {
           const body = req.body;
@@ -470,7 +472,8 @@ class MicrosoftGraphServer {
       );
       const mcpAuth = microsoftBearerTokenAuthMiddleware({
         trustProxyAuth: this.options.trustProxyAuth,
-        allowUnauthenticatedDiscovery: this.options.allowUnauthenticatedDiscovery
+        allowUnauthenticatedDiscovery: this.options.allowUnauthenticatedDiscovery,
+        publicUrl: publicBase
       });
       app.get(
         "/mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softeria/ms-365-mcp-server",
-  "version": "0.127.0",
+  "version": "0.128.0",
   "description": " A Model Context Protocol (MCP) server for interacting with Microsoft 365 and Office services through the Graph API",
   "type": "module",
   "main": "dist/index.js",