@wervt/nuxt 0.3.0 → 0.3.1

package/dist/module.js

@@ -275,6 +275,10 @@ var module_default = defineNuxtModule({
 			method: "get",
 			handler: resolver.resolve("./runtime/server/user-route")
 		});
+		if (nitroMajor >= 3) addServerHandler({
+			route: "/.well-known/oauth-protected-resource",
+			handler: resolver.resolve("./runtime/server/mcp-metadata")
+		});
 		addPlugin({
 			src: resolver.resolve("./runtime/app/plugins/user.client"),
 			mode: "client"

package/dist/runtime/server/mcp-auth.d.ts

@@ -17,7 +17,9 @@ declare module 'nuxt/schema' {
   }
 }
 export interface McpEndpoint {
-  /** This app's `/mcp`, the audience its access tokens must carry. */
+  /** This app's origin, a resource too: tokens for the whole app (native apps) work on `/mcp`. */
+  app: string;
+  /** This app's `/mcp`, the audience MCP clients' access tokens carry. */
   resource: string;
   /** wervt's login as OAuth issuer, e.g. `https://auth.wervt.app/api/auth`. */
   issuer: string;
@@ -36,8 +38,8 @@ export declare const CORS: {
   'access-control-allow-headers': string;
   'access-control-max-age': string;
 };
-/** RFC 9728: tells MCP clients which login issues tokens for `/mcp`. */
-export declare function protectedResourceMetadata(endpoint: McpEndpoint): {
+/** RFC 9728: tells clients which login issues tokens for `resource` (`/mcp` or the app). */
+export declare function protectedResourceMetadata(endpoint: McpEndpoint, resource?: string): {
   resource: string;
   authorization_servers: string[];
   bearer_methods_supported: string[];

package/dist/runtime/server/mcp-auth.js

@@ -12,6 +12,7 @@ function mcpEndpoint(event) {
 	if (!authUrl) return void 0;
 	const appUrl = trimSlash(process.env.WERVT_APP_URL ?? getRequestURL(event).origin);
 	return {
+		app: appUrl,
 		resource: `${appUrl}/mcp`,
 		issuer: `${trimSlash(authUrl)}/api/auth`,
 		metadataUrl: `${appUrl}/.well-known/oauth-protected-resource/mcp`
@@ -24,10 +25,10 @@ const CORS = {
 	"access-control-allow-headers": "*",
 	"access-control-max-age": "86400"
 };
-/** RFC 9728: tells MCP clients which login issues tokens for `/mcp`. */
-function protectedResourceMetadata(endpoint) {
+/** RFC 9728: tells clients which login issues tokens for `resource` (`/mcp` or the app). */
+function protectedResourceMetadata(endpoint, resource = endpoint.resource) {
 	return {
-		resource: endpoint.resource,
+		resource,
 		authorization_servers: [endpoint.issuer],
 		bearer_methods_supported: ["header"],
 		scopes_supported: [
@@ -36,7 +37,7 @@ function protectedResourceMetadata(endpoint) {
 			"email",
 			"offline_access"
 		],
-		resource_name: new URL(endpoint.resource).hostname.split(".")[0]
+		resource_name: new URL(resource).hostname.split(".")[0]
 	};
 }
 /**
@@ -69,7 +70,7 @@ async function verifyAccessToken(token, endpoint) {
 	try {
 		const { payload } = await jwtVerify(token, keySet(endpoint.issuer), {
 			issuer: endpoint.issuer,
-			audience: endpoint.resource,
+			audience: [endpoint.resource, endpoint.app],
 			requiredClaims: ["exp", "sub"],
 			clockTolerance: 5
 		});

package/dist/runtime/server/mcp-metadata.js

@@ -1,5 +1,5 @@
 import { CORS, mcpEndpoint, protectedResourceMetadata } from "./mcp-auth.js";
-import { defineEventHandler } from "nuxt/server";
+import { defineEventHandler, getRequestURL } from "nuxt/server";
 //#region src/runtime/server/mcp-metadata.ts
 var mcp_metadata_default = defineEventHandler((event) => {
 	const endpoint = mcpEndpoint(event);
@@ -8,7 +8,8 @@ var mcp_metadata_default = defineEventHandler((event) => {
 		headers: CORS
 	});
 	if (!endpoint) return Response.json({ error: "No login configured." }, { status: 404 });
-	return Response.json(protectedResourceMetadata(endpoint), { headers: CORS });
+	const mcp = getRequestURL(event).pathname.endsWith("/mcp");
+	return Response.json(protectedResourceMetadata(endpoint, mcp ? endpoint.resource : endpoint.app), { headers: CORS });
 });
 //#endregion
 export { mcp_metadata_default as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wervt/nuxt",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Nuxt module for apps hosted on wervt: database, live data, MCP and runtime setup.",
   "keywords": [
     "drizzle",