akanjs 3.0.0-alpha.69 → 3.0.0-alpha.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.0.0-alpha.69",
+  "version": "3.0.0-alpha.70",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {

package/server/mcp/McpAuth.ts

@@ -21,8 +21,9 @@ interface McpAuthFailure {
 }
 
 /**
- * The OAuth 2.1 protected-resource half of the MCP authorization spec: the RFC 9728 metadata document, the
- * `WWW-Authenticate` challenge that points at it, and the token checks that can be made without an issuer.
+ * The OAuth 2.1 protected-resource half of the MCP authorization spec: the RFC 9728 metadata document (served
+ * only once an authorization server is named), the `WWW-Authenticate` challenge that points at it, and the
+ * token checks that can be made without an issuer.
  *
  * The authorization server itself is a separate project. What lives here is what a resource server owes a
  * client regardless of who mints the tokens, so wiring one up later needs no change on this side.
@@ -39,8 +40,12 @@ export class McpAuth {
   /**
    * Both spellings of the metadata path. RFC 9728 inserts the resource's path into the well-known URL, and MCP
    * clients try that form first and the bare one second; serving only one leaves half the clients at a 404.
+   *
+   * Absent until an issuer is named: an unprotected resource that still advertises `bearer_methods_supported`
+   * is treated by Cursor (and similar clients) as an OAuth mandate.
    */
   createRoutes(): HttpRoutes {
+    if (!this.#hasIssuer()) return {};
     const handler = { GET: (req: Request) => this.#metadata(req) };
     return {
       [McpAuth.wellKnownPath]: handler,
@@ -84,7 +89,7 @@ export class McpAuth {
       (value): value is string => typeof value === "string",
     );
 
-    if (this.#props.authorizationServers?.length && !audience.length)
+    if (this.#hasIssuer() && !audience.length)
       return { status: 401, error: "invalid_token", description: "The access token names no resource." };
     if (audience.length && !audience.includes(this.#resource(req)))
       return { status: 401, error: "invalid_token", description: "The access token was issued for another resource." };
@@ -128,7 +133,9 @@ export class McpAuth {
     return [
       "Bearer",
       [
-        `resource_metadata="${new URL(McpAuth.wellKnownPath + this.#props.path, McpAuth.origin(req)).href}"`,
+        ...(this.#hasIssuer()
+          ? [`resource_metadata="${new URL(McpAuth.wellKnownPath + this.#props.path, McpAuth.origin(req)).href}"`]
+          : []),
         `error="${error}"`,
         `error_description="${description}"`,
         ...(scopes.length ? [`scope="${scopes.join(" ")}"`] : []),
@@ -136,6 +143,10 @@ export class McpAuth {
     ].join(" ");
   }
 
+  #hasIssuer() {
+    return Boolean(this.#props.authorizationServers?.length);
+  }
+
   #resource(req: Request) {
     return this.#props.resource ?? new URL(this.#props.path, McpAuth.origin(req)).href;
   }

package/types/server/mcp/McpAuth.d.ts

@@ -17,8 +17,9 @@ interface McpAuthFailure {
     description: string;
 }
 /**
- * The OAuth 2.1 protected-resource half of the MCP authorization spec: the RFC 9728 metadata document, the
- * `WWW-Authenticate` challenge that points at it, and the token checks that can be made without an issuer.
+ * The OAuth 2.1 protected-resource half of the MCP authorization spec: the RFC 9728 metadata document (served
+ * only once an authorization server is named), the `WWW-Authenticate` challenge that points at it, and the
+ * token checks that can be made without an issuer.
  *
  * The authorization server itself is a separate project. What lives here is what a resource server owes a
  * client regardless of who mints the tokens, so wiring one up later needs no change on this side.
@@ -30,6 +31,9 @@ export declare class McpAuth {
     /**
      * Both spellings of the metadata path. RFC 9728 inserts the resource's path into the well-known URL, and MCP
      * clients try that form first and the bare one second; serving only one leaves half the clients at a 404.
+     *
+     * Absent until an issuer is named: an unprotected resource that still advertises `bearer_methods_supported`
+     * is treated by Cursor (and similar clients) as an OAuth mandate.
      */
     createRoutes(): HttpRoutes;
     unauthorized(req: Request, failure?: McpAuthFailure): Response;