@ttoss/http-server-mcp 0.17.0 → 0.17.1

package/dist/index.cjs

@@ -126,7 +126,9 @@ var getIdentity = () => {
 * Throws if any scope is missing — the MCP SDK catches this and returns a
 * tool error to the client. Use inside tool handlers for per-tool authorization.
 *
-* Cognito tokens carry scopes as a space-separated string in `payload.scope`.
+* Accepts either `scope: string` (space-separated, standard JWT claim) or
+* `scopes: string[]` from `verifyToken`. If neither is present and `required`
+* is non-empty, throws with a descriptive message instead of a silent 403.
 *
 * @example
 * ```typescript
@@ -137,7 +139,13 @@ var getIdentity = () => {
 * ```
 */
 var checkScopes = required => {
-  const tokenScopes = (getIdentity()?.scope ?? "").split(" ");
+  const identity = getIdentity();
+  let scopeString = null;
+  if (typeof identity?.scope === "string") scopeString = identity.scope;else if (Array.isArray(identity?.scopes) && identity.scopes.every(s => {
+    return typeof s === "string";
+  })) scopeString = identity.scopes.join(" ");
+  if (scopeString === null && required.length > 0) throw new Error(`verifyToken returned no scope/scopes but requiredScopes is set (${required.join(", ")}). Return either scope: string or scopes: string[] from verifyToken.`);
+  const tokenScopes = scopeString ? scopeString.split(" ") : [];
   if (required.filter(s => {
     return !tokenScopes.includes(s);
   }).length > 0) throw new Error(`Insufficient scopes. Required: ${required.join(", ")}`);

package/dist/index.d.cts

@@ -692,7 +692,11 @@ interface McpAuthOptions {
    * JWTs, opaque tokens). Resolve with the verified payload, or throw to reject.
    */
   verifyToken?: (token: string) => Promise<unknown>;
-  /** Scopes that must all be present on the token's `scope` claim, else `403`. */
+  /**
+   * Scopes that must all be present on the token, else `403`.
+   * `verifyToken` may return either `scope: string` (space-separated) or
+   * `scopes: string[]`; both are normalised internally.
+   */
   requiredScopes?: string[];
   /**
    * JSON-RPC methods (read from `body.method`) that bypass verification.
@@ -793,7 +797,9 @@ declare const getIdentity: () => unknown;
  * Throws if any scope is missing — the MCP SDK catches this and returns a
  * tool error to the client. Use inside tool handlers for per-tool authorization.
  *
- * Cognito tokens carry scopes as a space-separated string in `payload.scope`.
+ * Accepts either `scope: string` (space-separated, standard JWT claim) or
+ * `scopes: string[]` from `verifyToken`. If neither is present and `required`
+ * is non-empty, throws with a descriptive message instead of a silent 403.
  *
  * @example
  * ```typescript

package/dist/index.d.mts

@@ -692,7 +692,11 @@ interface McpAuthOptions {
    * JWTs, opaque tokens). Resolve with the verified payload, or throw to reject.
    */
   verifyToken?: (token: string) => Promise<unknown>;
-  /** Scopes that must all be present on the token's `scope` claim, else `403`. */
+  /**
+   * Scopes that must all be present on the token, else `403`.
+   * `verifyToken` may return either `scope: string` (space-separated) or
+   * `scopes: string[]`; both are normalised internally.
+   */
   requiredScopes?: string[];
   /**
    * JSON-RPC methods (read from `body.method`) that bypass verification.
@@ -793,7 +797,9 @@ declare const getIdentity: () => unknown;
  * Throws if any scope is missing — the MCP SDK catches this and returns a
  * tool error to the client. Use inside tool handlers for per-tool authorization.
  *
- * Cognito tokens carry scopes as a space-separated string in `payload.scope`.
+ * Accepts either `scope: string` (space-separated, standard JWT claim) or
+ * `scopes: string[]` from `verifyToken`. If neither is present and `required`
+ * is non-empty, throws with a descriptive message instead of a silent 403.
  *
  * @example
  * ```typescript

package/dist/index.mjs

@@ -123,7 +123,9 @@ var getIdentity = () => {
 * Throws if any scope is missing — the MCP SDK catches this and returns a
 * tool error to the client. Use inside tool handlers for per-tool authorization.
 *
-* Cognito tokens carry scopes as a space-separated string in `payload.scope`.
+* Accepts either `scope: string` (space-separated, standard JWT claim) or
+* `scopes: string[]` from `verifyToken`. If neither is present and `required`
+* is non-empty, throws with a descriptive message instead of a silent 403.
 *
 * @example
 * ```typescript
@@ -134,7 +136,13 @@ var getIdentity = () => {
 * ```
 */
 var checkScopes = required => {
-  const tokenScopes = (getIdentity()?.scope ?? "").split(" ");
+  const identity = getIdentity();
+  let scopeString = null;
+  if (typeof identity?.scope === "string") scopeString = identity.scope;else if (Array.isArray(identity?.scopes) && identity.scopes.every(s => {
+    return typeof s === "string";
+  })) scopeString = identity.scopes.join(" ");
+  if (scopeString === null && required.length > 0) throw new Error(`verifyToken returned no scope/scopes but requiredScopes is set (${required.join(", ")}). Return either scope: string or scopes: string[] from verifyToken.`);
+  const tokenScopes = scopeString ? scopeString.split(" ") : [];
   if (required.filter(s => {
     return !tokenScopes.includes(s);
   }).length > 0) throw new Error(`Insufficient scopes. Required: ${required.join(", ")}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttoss/http-server-mcp",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Model Context Protocol (MCP) server integration for @ttoss/http-server",
   "keywords": [
     "ai",
@@ -36,8 +36,8 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^4.4.3",
     "@ttoss/auth-core": "^0.7.0",
-    "@ttoss/http-server": "^0.7.1",
-    "@ttoss/http-server-auth": "^0.3.3"
+    "@ttoss/http-server-auth": "^0.3.4",
+    "@ttoss/http-server": "^0.7.1"
   },
   "devDependencies": {
     "@types/koa": "^3.0.3",