fastmcp 4.7.1 → 4.7.2

package/dist/{chunk-YMUXVDGJ.js → chunk-KAGSBU3Z.js}

@@ -1676,7 +1676,9 @@ var FastMCP = class extends FastMCPEventEmitter {
             if (this.#authenticate) {
               auth = await this.#authenticate(request);
               if (auth === void 0 || auth === null) {
-                throw new Error("Authentication required");
+                throw this.#createUnauthorizedResponse(
+                  "Authentication required"
+                );
               }
             }
             const sessionId = Array.isArray(request.headers["mcp-session-id"]) ? request.headers["mcp-session-id"][0] : request.headers["mcp-session-id"];
@@ -1795,7 +1797,7 @@ var FastMCP = class extends FastMCPEventEmitter {
   #createSession(auth, sessionId) {
     if (auth && typeof auth === "object" && "authenticated" in auth && !auth.authenticated) {
       const errorMessage = "error" in auth && typeof auth.error === "string" ? auth.error : "Authentication failed";
-      throw new Error(errorMessage);
+      throw this.#createUnauthorizedResponse(errorMessage);
     }
     const allowedTools = auth ? this.#tools.filter(
       (tool) => tool.canAccess ? tool.canAccess(auth) : true
@@ -1818,6 +1820,46 @@ var FastMCP = class extends FastMCPEventEmitter {
       version: this.#options.version
     });
   }
+  /**
+   * Builds a 401 Unauthorized HTTP Response for authentication failures.
+   *
+   * Throwing a `Response` (rather than a plain `Error`) guarantees that the
+   * transport (e.g. mcp-proxy) surfaces the correct status code directly,
+   * instead of relying on heuristics that infer the status code from the
+   * error message's text (see https://github.com/punkpeye/fastmcp/issues/180).
+   *
+   * The response body matches the JSON-RPC error envelope FastMCP otherwise
+   * produces, and a `WWW-Authenticate` header is included per RFC 7235 (and
+   * RFC 9728 when protected-resource metadata is configured), so HTTP-aware
+   * clients can distinguish "unauthenticated" from a malformed request.
+   */
+  #createUnauthorizedResponse(message) {
+    const oauth = this.#options.oauth;
+    const resource = oauth?.enabled ? oauth.protectedResource?.resource : void 0;
+    const wwwAuthenticateParts = [
+      'error="invalid_token"',
+      `error_description="${message.replace(/"/g, '\\"')}"`
+    ];
+    if (resource) {
+      wwwAuthenticateParts.push(
+        `resource_metadata="${resource}/.well-known/oauth-protected-resource"`
+      );
+    }
+    return new Response(
+      JSON.stringify({
+        error: { code: -32e3, message },
+        id: null,
+        jsonrpc: "2.0"
+      }),
+      {
+        headers: {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": `Bearer ${wwwAuthenticateParts.join(", ")}`
+        },
+        status: 401
+      }
+    );
+  }
   /**
    * Handles unhandled HTTP requests with health, readiness, OAuth endpoints, and custom routes
    */
@@ -2254,4 +2296,4 @@ export {
   FastMCPSession,
   FastMCP
 };
-//# sourceMappingURL=chunk-YMUXVDGJ.js.map
+//# sourceMappingURL=chunk-KAGSBU3Z.js.map