backend-manager 5.0.180 → 5.0.181

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.0.180",
+  "version": "5.0.181",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/cli/commands/setup-tests/hosting-rewrites.js

@@ -2,6 +2,11 @@ const BaseTest = require('./base-test');
 const jetpack = require('fs-jetpack');
 const _ = require('lodash');
 
+// The expected source pattern for bm_api hosting rewrite
+// Includes /backend-manager/* routes and root-level MCP OAuth paths
+// that Claude Chat sends directly (e.g. /authorize, /token, /.well-known/*)
+const BM_API_SOURCE = '{/backend-manager,/backend-manager/**,/.well-known/oauth-protected-resource,/.well-known/oauth-authorization-server}';
+
 class HostingRewritesTest extends BaseTest {
   getName() {
     return 'hosting rewrites have bm_api';
@@ -11,8 +16,8 @@ class HostingRewritesTest extends BaseTest {
     const rewrites = this.self.firebaseJSON?.hosting?.rewrites || [];
     const firstRewrite = rewrites[0];
 
-    // Check first rule is correct
-    const firstIsCorrect = firstRewrite?.source === '{/backend-manager,/backend-manager/**}' && firstRewrite?.function === 'bm_api';
+    // Check first rule is correct (matches current expected pattern)
+    const firstIsCorrect = firstRewrite?.source === BM_API_SOURCE && firstRewrite?.function === 'bm_api';
 
     // Check no duplicates exist (only one bm_api rule allowed)
     const bmApiCount = rewrites.filter(r => r.function === 'bm_api').length;
@@ -26,12 +31,12 @@ class HostingRewritesTest extends BaseTest {
     // Set default
     hosting.rewrites = hosting.rewrites || [];
 
-    // Remove any existing bm_api rewrites
+    // Remove any existing bm_api rewrites (handles legacy single-pattern rewrites too)
     hosting.rewrites = hosting.rewrites.filter(rewrite => rewrite.function !== 'bm_api');
 
-    // Add to top
+    // Add to top with full pattern including MCP OAuth paths
     hosting.rewrites.unshift({
-      source: '{/backend-manager,/backend-manager/**}',
+      source: BM_API_SOURCE,
       function: 'bm_api',
     });
 

package/src/manager/index.js

@@ -793,11 +793,9 @@ Manager.prototype.setupFunctions = function (exporter, options) {
     const route = self.BemRouter(req, res).resolve();
 
     // MCP endpoint — bypass middleware, handle protocol directly
-    if (route.routePath === 'mcp'
-      || route.routePath.startsWith('mcp/')
-      || route.routePath === '.well-known/oauth-protected-resource'
-      || route.routePath === '.well-known/oauth-authorization-server') {
-      return self._handleMcp(req, res, route.routePath);
+    const mcpRoutePath = resolveMcpRoutePath(route.routePath);
+    if (mcpRoutePath) {
+      return self._handleMcp(req, res, mcpRoutePath);
     }
 
     if (route.isLegacy) {
@@ -1201,4 +1199,26 @@ function requireJSON5(file, throwError) {
   }
 }
 
+/**
+ * Check if a routePath is an MCP-related route and normalize it.
+ * Handles /backend-manager/mcp/* paths and /.well-known/oauth-* discovery.
+ *
+ * @param {string} routePath - Resolved route path from BemRouter
+ * @returns {string|null} - Normalized MCP route path, or null if not MCP
+ */
+function resolveMcpRoutePath(routePath) {
+  // Direct MCP paths (via /backend-manager/mcp/*)
+  if (routePath === 'mcp' || routePath.startsWith('mcp/')) {
+    return routePath;
+  }
+
+  // OAuth discovery (via /.well-known/oauth-*)
+  if (routePath === '.well-known/oauth-protected-resource'
+    || routePath === '.well-known/oauth-authorization-server') {
+    return routePath;
+  }
+
+  return null;
+}
+
 module.exports = Manager;