fastmcp 4.18.0 → 4.19.1

package/dist/{chunk-UODI5E6U.js → chunk-XJWV6G5Q.js}

@@ -1,3 +1,7 @@
+import {
+  cancelResponseBody
+} from "./chunk-LRXZYGFR.js";
+
 // src/FastMCP.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -27,17 +31,6 @@ import parseURITemplate from "uri-templates";
 import { strictJsonSchema, toJsonSchema } from "xsschema";
 import { z } from "zod";
 
-// src/cancelResponseBody.ts
-var cancelResponseBody = async (response) => {
-  if (!response.body) {
-    return;
-  }
-  try {
-    await response.body.cancel();
-  } catch {
-  }
-};
-
 // src/DiscoveryDocumentCache.ts
 var DiscoveryDocumentCache = class {
   get size() {
@@ -2089,15 +2082,14 @@ var FastMCP = class extends FastMCPEventEmitter {
         this.#logger.info(
           `[FastMCP info] Starting server in stateless mode on HTTP Stream at ${protocol}://${httpConfig.host}:${httpConfig.port}${streamEndpoint}`
         );
+        const authenticate = this.#authenticate ? this.#memoizedAuthenticate() : void 0;
         this.#httpStreamServer = await startHTTPServer({
-          ...this.#authenticate ? { authenticate: this.#authenticate } : {},
+          ...authenticate ? { authenticate } : {},
           cors: httpConfig.cors,
           createServer: async (request) => {
             let auth;
-            if (this.#authenticate) {
-              auth = this.#requireAuthenticated(
-                await this.#authenticate(request)
-              );
+            if (authenticate) {
+              auth = this.#requireAuthenticated(await authenticate(request));
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId, true);
@@ -2138,15 +2130,14 @@ var FastMCP = class extends FastMCPEventEmitter {
           streamEndpoint
         });
       } else {
+        const authenticate = this.#authenticate ? this.#memoizedAuthenticate() : void 0;
         this.#httpStreamServer = await startHTTPServer({
-          ...this.#authenticate ? { authenticate: this.#authenticate } : {},
+          ...authenticate ? { authenticate } : {},
           cors: httpConfig.cors,
           createServer: async (request) => {
             let auth;
-            if (this.#authenticate) {
-              auth = this.#requireAuthenticated(
-                await this.#authenticate(request)
-              );
+            if (authenticate) {
+              auth = this.#requireAuthenticated(await authenticate(request));
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
             return this.#createSession(auth, sessionId);
@@ -2699,6 +2690,40 @@ var FastMCP = class extends FastMCPEventEmitter {
       }
     }
   };
+  /**
+   * On `httpStream`, `authenticate` is handed to both mcp-proxy (which calls it
+   * once per request to gate the 401) and this server's own `createServer`
+   * callback (which calls it again to obtain the session auth). Both receive
+   * the identical `IncomingMessage`, so a single request would otherwise be
+   * authenticated twice — halving the effective budget of any non-idempotent
+   * `authenticate` (see #352).
+   *
+   * This wraps `#authenticate` in a per-request memo keyed on the request
+   * object, collapsing the two calls into one real invocation. The *promise* is
+   * cached (not the resolved value) so a second call that arrives before the
+   * first settles joins it rather than starting a competing attempt. Keys are
+   * the request objects themselves, so each request is authenticated exactly
+   * once, a distinct request is authenticated afresh, and entries are collected
+   * with their requests — nothing leaks across requests. A rejected or nullish
+   * result is cached as-is, so a failed authentication is never seen as a
+   * success by the second caller.
+   */
+  #memoizedAuthenticate() {
+    const authenticate = this.#authenticate;
+    const cache = /* @__PURE__ */ new WeakMap();
+    return (request) => {
+      if (!request) {
+        return authenticate(request);
+      }
+      const cached = cache.get(request);
+      if (cached) {
+        return cached;
+      }
+      const result = Promise.resolve(authenticate(request));
+      cache.set(request, result);
+      return result;
+    };
+  }
   /**
    * Converts Node.js IncomingMessage to Web Request for Hono
    */
@@ -2867,4 +2892,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-UODI5E6U.js.map
+//# sourceMappingURL=chunk-XJWV6G5Q.js.map