fraim 2.0.225 → 2.0.227

package/dist/src/middleware/auth.js

@@ -30,9 +30,21 @@ class AuthMiddleware {
         // Skip auth for public health check, admin routes, website signup, sales inquiries, and self-serve access flow
         const rawPath = req.path ?? req.originalUrl ?? req.url ?? '';
         const p = (typeof rawPath === 'string' ? rawPath : '').split('?')[0].replace(/\/$/, '') || '';
+        const publicBaseUrl = (process.env.FRAIM_PUBLIC_BASE_URL || 'https://fraim.wellnessatwork.me').replace(/\/+$/, '');
+        const mcpResourceMetadataUrl = `${publicBaseUrl}/.well-known/oauth-protected-resource/mcp`;
+        const isMcpPath = p === '/mcp' || p.startsWith('/mcp/');
+        const setMcpAuthenticateChallenge = () => {
+            if (isMcpPath) {
+                res.setHeader('WWW-Authenticate', `Bearer resource_metadata="${mcpResourceMetadataUrl}"`);
+            }
+        };
         const publicPrefixes = ['/admin', '/dashboard', '/health', '/pricing', '/fraim-brain', '/api/signup', '/api/sales', '/api/request-access', '/api/installer-key', '/api/installer-download', '/api/installer-availability', '/api/payment/bypass', '/api/pricing', '/api/personas/catalog', '/auth', '/portfolio'];
         // Analytics dashboard is public, but API routes are protected
         const isAnalyticsPublic = p === '/analytics' || p === '/analytics/' || p.startsWith('/analytics/') && p.endsWith('.html');
+        const isOAuthMetadataPublic = p === '/.well-known/oauth-authorization-server'
+            || p === '/.well-known/oauth-protected-resource'
+            || p === '/.well-known/oauth-protected-resource/mcp'
+            || p === '/.well-known/openai-apps-challenge';
         // Homepage is public
         if (p === '' || p === '/')
             return next();
@@ -40,7 +52,8 @@ class AuthMiddleware {
         const isPublic = publicPrefixes.some(prefix => p === prefix || p.startsWith(prefix + '/'))
             || publicExtensions.some(ext => p.endsWith(ext))
             || p.startsWith('/css/') || p.startsWith('/js/') || p.startsWith('/images/')
-            || isAnalyticsPublic;
+            || isAnalyticsPublic
+            || isOAuthMetadataPublic;
         if (isPublic) {
             return next();
         }
@@ -102,6 +115,7 @@ class AuthMiddleware {
                         reason: !session ? 'not_found' : session.revoked ? 'revoked' : 'expired',
                         outcome: 'failure',
                     }).catch(() => undefined);
+                    setMcpAuthenticateChallenge();
                     return res.status(401).json({
                         jsonrpc: '2.0',
                         error: { code: -32001, message: 'Unauthorized: Session expired or revoked [AUTH-SESSION-INVALID]' },
@@ -111,6 +125,7 @@ class AuthMiddleware {
                 const apiKeyData = await this.dbService.getApiKeyByUserId(session.userId, false);
                 if (!apiKeyData) {
                     console.error(`[FRAIM AUTH] Session valid but no API key for user ${session.userId}`);
+                    setMcpAuthenticateChallenge();
                     return res.status(401).json({
                         jsonrpc: '2.0',
                         error: { code: -32001, message: 'Unauthorized: No identity for session [AUTH-NO-IDENTITY]' },
@@ -146,6 +161,7 @@ class AuthMiddleware {
                         outcome: 'failure',
                         reason: `session_user=${session.userId}`,
                     }).catch(() => undefined);
+                    setMcpAuthenticateChallenge();
                     return res.status(401).json({
                         jsonrpc: '2.0',
                         error: { code: -32001, message: 'Unauthorized: Mixed identity [AUTH-MIXED-IDENTITY]' },
@@ -169,6 +185,7 @@ class AuthMiddleware {
                 return res.status(404).send('<h1>404</h1><p>Page not found.</p>');
             }
             console.error(`[FRAIM AUTH] Missing API key for ${req.method} ${req.path}`);
+            setMcpAuthenticateChallenge();
             return res.status(401).json({
                 jsonrpc: '2.0',
                 error: { code: -32001, message: 'Unauthorized: Missing API key [AUTH-MISSING]' },
@@ -194,6 +211,7 @@ class AuthMiddleware {
             const apiKeyData = await this.dbService.verifyApiKey(apiKey);
             if (!apiKeyData) {
                 console.error(`❌ FRAIM AUTH: Invalid API key: ${apiKey}`);
+                setMcpAuthenticateChallenge();
                 return res.status(401).json({
                     jsonrpc: '2.0',
                     error: { code: -32001, message: 'Unauthorized: Invalid x-api-key [AUTH-INVALID]' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.225",
+  "version": "2.0.227",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "@octokit/rest": "^22.0.1",
-    "adm-zip": "^0.5.16",
+    "adm-zip": "^0.6.0",
     "axios": "^1.7.0",
     "chalk": "4.1.2",
     "commander": "^14.0.2",