skybridge 0.0.0-dev.cad6ad9 → 0.0.0-dev.cafa059
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/server/auth/security-schemes.d.ts +8 -10
- package/dist/server/auth/security-schemes.js +37 -20
- package/dist/server/auth/security-schemes.js.map +1 -1
- package/dist/server/auth/security-schemes.test.js +51 -17
- package/dist/server/auth/security-schemes.test.js.map +1 -1
- package/dist/server/auth/setup.d.ts +3 -1
- package/dist/server/auth/setup.js +52 -20
- package/dist/server/auth/setup.js.map +1 -1
- package/dist/server/auth/setup.test.js +155 -41
- package/dist/server/auth/setup.test.js.map +1 -1
- package/dist/server/server.d.ts +14 -7
- package/dist/server/server.js +57 -30
- package/dist/server/server.js.map +1 -1
- package/dist/web/bridges/adaptor.js +2 -2
- package/dist/web/bridges/adaptor.js.map +1 -1
- package/package.json +1 -1
|
@@ -2,14 +2,12 @@ import type { AuthInfo } from "../auth.js";
|
|
|
2
2
|
import type { SecurityScheme, ToolAuth } from "../server.js";
|
|
3
3
|
export declare function authToSecuritySchemes(auth: ToolAuth): SecurityScheme[];
|
|
4
4
|
export declare function securitySchemesAllowAnonymous(schemes: SecurityScheme[] | undefined): boolean;
|
|
5
|
-
export type
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
text: string;
|
|
10
|
-
}[];
|
|
11
|
-
_meta: {
|
|
12
|
-
"mcp/www_authenticate": string;
|
|
13
|
-
};
|
|
5
|
+
export type SchemeFailure = {
|
|
6
|
+
error: "invalid_token" | "insufficient_scope";
|
|
7
|
+
description: string;
|
|
8
|
+
scopes: string[];
|
|
14
9
|
};
|
|
15
|
-
export declare function
|
|
10
|
+
export declare function evaluateSecuritySchemes(schemes: SecurityScheme[] | undefined, authInfo: AuthInfo | undefined): SchemeFailure | undefined;
|
|
11
|
+
export declare function httpStatusForFailure(failure: SchemeFailure): 401 | 403;
|
|
12
|
+
export declare function clientPrefersInBandChallenge(userAgent: string | undefined): boolean;
|
|
13
|
+
export declare function wwwAuthenticateHeader(failure: SchemeFailure, resourceMetadataUrl?: string): string;
|
|
@@ -1,36 +1,53 @@
|
|
|
1
1
|
export function authToSecuritySchemes(auth) {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
}
|
|
8
|
-
return [{ type: "oauth2", scopes: auth.scopes }];
|
|
2
|
+
const oauth2 = {
|
|
3
|
+
type: "oauth2",
|
|
4
|
+
...(auth.scopes?.length ? { scopes: auth.scopes } : {}),
|
|
5
|
+
};
|
|
6
|
+
return auth.public ? [{ type: "noauth" }, oauth2] : [oauth2];
|
|
9
7
|
}
|
|
10
8
|
export function securitySchemesAllowAnonymous(schemes) {
|
|
11
9
|
return !!schemes?.some((scheme) => scheme.type === "noauth");
|
|
12
10
|
}
|
|
13
|
-
export function
|
|
11
|
+
export function evaluateSecuritySchemes(schemes, authInfo) {
|
|
14
12
|
if (securitySchemesAllowAnonymous(schemes)) {
|
|
15
13
|
return undefined;
|
|
16
14
|
}
|
|
17
|
-
if (!authInfo) {
|
|
18
|
-
return deny("invalid_token", "Sign in to use this tool.");
|
|
19
|
-
}
|
|
20
15
|
const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === "oauth2");
|
|
21
16
|
const required = oauth2.length ? oauth2 : [{ type: "oauth2" }];
|
|
17
|
+
const scopes = [
|
|
18
|
+
...new Set(required.flatMap((scheme) => scheme.scopes ?? [])),
|
|
19
|
+
];
|
|
20
|
+
if (!authInfo) {
|
|
21
|
+
return {
|
|
22
|
+
error: "invalid_token",
|
|
23
|
+
description: "Sign in to use this tool.",
|
|
24
|
+
scopes,
|
|
25
|
+
};
|
|
26
|
+
}
|
|
22
27
|
const satisfied = required.some((scheme) => (scheme.scopes ?? []).every((scope) => authInfo.scopes.includes(scope)));
|
|
23
28
|
return satisfied
|
|
24
29
|
? undefined
|
|
25
|
-
:
|
|
30
|
+
: {
|
|
31
|
+
error: "insufficient_scope",
|
|
32
|
+
description: "Missing required scope for this tool.",
|
|
33
|
+
scopes,
|
|
34
|
+
};
|
|
26
35
|
}
|
|
27
|
-
function
|
|
28
|
-
return
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
36
|
+
export function httpStatusForFailure(failure) {
|
|
37
|
+
return failure.error === "insufficient_scope" ? 403 : 401;
|
|
38
|
+
}
|
|
39
|
+
export function clientPrefersInBandChallenge(userAgent) {
|
|
40
|
+
const ua = (userAgent ?? "").toLowerCase();
|
|
41
|
+
return ua.includes("openai") || ua.includes("chatgpt");
|
|
42
|
+
}
|
|
43
|
+
export function wwwAuthenticateHeader(failure, resourceMetadataUrl) {
|
|
44
|
+
let header = `Bearer error="${failure.error}", error_description="${failure.description}"`;
|
|
45
|
+
if (failure.scopes.length) {
|
|
46
|
+
header += `, scope="${failure.scopes.join(" ")}"`;
|
|
47
|
+
}
|
|
48
|
+
if (resourceMetadataUrl) {
|
|
49
|
+
header += `, resource_metadata="${resourceMetadataUrl}"`;
|
|
50
|
+
}
|
|
51
|
+
return header;
|
|
35
52
|
}
|
|
36
53
|
//# sourceMappingURL=security-schemes.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,
|
|
1
|
+
{"version":3,"file":"security-schemes.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,qBAAqB,CAAC,IAAc;IAClD,MAAM,MAAM,GAAmB;QAC7B,IAAI,EAAE,QAAQ;QACd,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAqC;IAErC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAQD,MAAM,UAAU,uBAAuB,CACrC,OAAqC,EACrC,QAA8B;IAE9B,IAAI,6BAA6B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;KAC9D,CAAC;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2BAA2B;YACxC,MAAM;SACP,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CACzC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACxE,CAAC;IACF,OAAO,SAAS;QACd,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uCAAuC;YACpD,MAAM;SACP,CAAC;AACR,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,OAAO,OAAO,CAAC,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,SAA6B;IAE7B,MAAM,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAsB,EACtB,mBAA4B;IAE5B,IAAI,MAAM,GAAG,iBAAiB,OAAO,CAAC,KAAK,yBAAyB,OAAO,CAAC,WAAW,GAAG,CAAC;IAC3F,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpD,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,IAAI,wBAAwB,mBAAmB,GAAG,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { AuthInfo } from \"../auth.js\";\nimport type { SecurityScheme, ToolAuth } from \"../server.js\";\n\nexport function authToSecuritySchemes(auth: ToolAuth): SecurityScheme[] {\n const oauth2: SecurityScheme = {\n type: \"oauth2\",\n ...(auth.scopes?.length ? { scopes: auth.scopes } : {}),\n };\n return auth.public ? [{ type: \"noauth\" }, oauth2] : [oauth2];\n}\n\nexport function securitySchemesAllowAnonymous(\n schemes: SecurityScheme[] | undefined,\n): boolean {\n return !!schemes?.some((scheme) => scheme.type === \"noauth\");\n}\n\nexport type SchemeFailure = {\n error: \"invalid_token\" | \"insufficient_scope\";\n description: string;\n scopes: string[];\n};\n\nexport function evaluateSecuritySchemes(\n schemes: SecurityScheme[] | undefined,\n authInfo: AuthInfo | undefined,\n): SchemeFailure | undefined {\n if (securitySchemesAllowAnonymous(schemes)) {\n return undefined;\n }\n const oauth2 = (schemes ?? []).filter((scheme) => scheme.type === \"oauth2\");\n const required = oauth2.length ? oauth2 : [{ type: \"oauth2\" as const }];\n const scopes = [\n ...new Set(required.flatMap((scheme) => scheme.scopes ?? [])),\n ];\n if (!authInfo) {\n return {\n error: \"invalid_token\",\n description: \"Sign in to use this tool.\",\n scopes,\n };\n }\n const satisfied = required.some((scheme) =>\n (scheme.scopes ?? []).every((scope) => authInfo.scopes.includes(scope)),\n );\n return satisfied\n ? undefined\n : {\n error: \"insufficient_scope\",\n description: \"Missing required scope for this tool.\",\n scopes,\n };\n}\n\nexport function httpStatusForFailure(failure: SchemeFailure): 401 | 403 {\n return failure.error === \"insufficient_scope\" ? 403 : 401;\n}\n\nexport function clientPrefersInBandChallenge(\n userAgent: string | undefined,\n): boolean {\n const ua = (userAgent ?? \"\").toLowerCase();\n return ua.includes(\"openai\") || ua.includes(\"chatgpt\");\n}\n\nexport function wwwAuthenticateHeader(\n failure: SchemeFailure,\n resourceMetadataUrl?: string,\n): string {\n let header = `Bearer error=\"${failure.error}\", error_description=\"${failure.description}\"`;\n if (failure.scopes.length) {\n header += `, scope=\"${failure.scopes.join(\" \")}\"`;\n }\n if (resourceMetadataUrl) {\n header += `, resource_metadata=\"${resourceMetadataUrl}\"`;\n }\n return header;\n}\n"]}
|
|
@@ -1,15 +1,24 @@
|
|
|
1
1
|
import { describe, expect, it } from "vitest";
|
|
2
|
-
import { authToSecuritySchemes,
|
|
2
|
+
import { authToSecuritySchemes, clientPrefersInBandChallenge, evaluateSecuritySchemes, securitySchemesAllowAnonymous, wwwAuthenticateHeader, } from "./security-schemes.js";
|
|
3
|
+
describe("clientPrefersInBandChallenge", () => {
|
|
4
|
+
it("detects ChatGPT / OpenAI user agents", () => {
|
|
5
|
+
expect(clientPrefersInBandChallenge("openai-mcp/1.0")).toBe(true);
|
|
6
|
+
expect(clientPrefersInBandChallenge("ChatGPT")).toBe(true);
|
|
7
|
+
expect(clientPrefersInBandChallenge("Claude-User/1.0")).toBe(false);
|
|
8
|
+
expect(clientPrefersInBandChallenge(undefined)).toBe(false);
|
|
9
|
+
});
|
|
10
|
+
});
|
|
3
11
|
describe("authToSecuritySchemes", () => {
|
|
4
|
-
it("maps the
|
|
5
|
-
expect(authToSecuritySchemes(
|
|
12
|
+
it("maps the auth shorthand", () => {
|
|
13
|
+
expect(authToSecuritySchemes({ public: true })).toEqual([
|
|
6
14
|
{ type: "noauth" },
|
|
7
15
|
{ type: "oauth2" },
|
|
8
16
|
]);
|
|
9
|
-
expect(authToSecuritySchemes(
|
|
17
|
+
expect(authToSecuritySchemes({})).toEqual([{ type: "oauth2" }]);
|
|
10
18
|
expect(authToSecuritySchemes({ scopes: ["checkout"] })).toEqual([
|
|
11
19
|
{ type: "oauth2", scopes: ["checkout"] },
|
|
12
20
|
]);
|
|
21
|
+
expect(authToSecuritySchemes({ public: true, scopes: ["checkout"] })).toEqual([{ type: "noauth" }, { type: "oauth2", scopes: ["checkout"] }]);
|
|
13
22
|
});
|
|
14
23
|
});
|
|
15
24
|
const authInfo = (scopes) => ({
|
|
@@ -25,32 +34,57 @@ describe("securitySchemesAllowAnonymous", () => {
|
|
|
25
34
|
expect(securitySchemesAllowAnonymous(undefined)).toBe(false);
|
|
26
35
|
});
|
|
27
36
|
});
|
|
28
|
-
describe("
|
|
37
|
+
describe("evaluateSecuritySchemes", () => {
|
|
29
38
|
it("lets anonymous callers through a noauth tool", () => {
|
|
30
39
|
const schemes = [{ type: "noauth" }, { type: "oauth2" }];
|
|
31
|
-
expect(
|
|
40
|
+
expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();
|
|
32
41
|
});
|
|
33
|
-
it("
|
|
34
|
-
|
|
35
|
-
expect(denial?.isError).toBe(true);
|
|
36
|
-
expect(denial?._meta["mcp/www_authenticate"]).toContain('error="invalid_token"');
|
|
42
|
+
it("fails an oauth2-only tool with no token (invalid_token / 401)", () => {
|
|
43
|
+
expect(evaluateSecuritySchemes([{ type: "oauth2" }], undefined)?.error).toBe("invalid_token");
|
|
37
44
|
});
|
|
38
|
-
it("
|
|
45
|
+
it("fails when the token is missing a required scope (insufficient_scope / 403)", () => {
|
|
39
46
|
const schemes = [
|
|
40
47
|
{ type: "oauth2", scopes: ["checkout"] },
|
|
41
48
|
];
|
|
42
|
-
|
|
43
|
-
expect(denial?._meta["mcp/www_authenticate"]).toContain('error="insufficient_scope"');
|
|
49
|
+
expect(evaluateSecuritySchemes(schemes, authInfo(["openid"]))?.error).toBe("insufficient_scope");
|
|
44
50
|
});
|
|
45
|
-
it("
|
|
51
|
+
it("passes when the token carries every required scope", () => {
|
|
46
52
|
const schemes = [
|
|
47
53
|
{ type: "oauth2", scopes: ["checkout"] },
|
|
48
54
|
];
|
|
49
|
-
expect(
|
|
55
|
+
expect(evaluateSecuritySchemes(schemes, authInfo(["openid", "checkout"]))).toBeUndefined();
|
|
50
56
|
});
|
|
51
57
|
it("treats an undeclared tool as auth-required, satisfied by any valid token", () => {
|
|
52
|
-
expect(
|
|
53
|
-
expect(
|
|
58
|
+
expect(evaluateSecuritySchemes(undefined, undefined)?.error).toBe("invalid_token");
|
|
59
|
+
expect(evaluateSecuritySchemes(undefined, authInfo([]))).toBeUndefined();
|
|
60
|
+
});
|
|
61
|
+
it("carries the tool's required scopes on the failure", () => {
|
|
62
|
+
const schemes = [
|
|
63
|
+
{ type: "oauth2", scopes: ["checkout"] },
|
|
64
|
+
];
|
|
65
|
+
expect(evaluateSecuritySchemes(schemes, undefined)?.scopes).toEqual([
|
|
66
|
+
"checkout",
|
|
67
|
+
]);
|
|
68
|
+
expect(evaluateSecuritySchemes(schemes, authInfo(["openid"]))?.scopes).toEqual(["checkout"]);
|
|
69
|
+
});
|
|
70
|
+
});
|
|
71
|
+
describe("wwwAuthenticateHeader", () => {
|
|
72
|
+
it("names the required scopes so the client can step up", () => {
|
|
73
|
+
const header = wwwAuthenticateHeader({
|
|
74
|
+
error: "insufficient_scope",
|
|
75
|
+
description: "Missing required scope for this tool.",
|
|
76
|
+
scopes: ["checkout"],
|
|
77
|
+
});
|
|
78
|
+
expect(header).toContain('error="insufficient_scope"');
|
|
79
|
+
expect(header).toContain('scope="checkout"');
|
|
80
|
+
});
|
|
81
|
+
it("omits the scope parameter when there are none", () => {
|
|
82
|
+
const header = wwwAuthenticateHeader({
|
|
83
|
+
error: "invalid_token",
|
|
84
|
+
description: "Sign in to use this tool.",
|
|
85
|
+
scopes: [],
|
|
86
|
+
});
|
|
87
|
+
expect(header).not.toContain("scope=");
|
|
54
88
|
});
|
|
55
89
|
});
|
|
56
90
|
//# sourceMappingURL=security-schemes.test.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security-schemes.test.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,
|
|
1
|
+
{"version":3,"file":"security-schemes.test.js","sourceRoot":"","sources":["../../../src/server/auth/security-schemes.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACtD,EAAE,IAAI,EAAE,QAAQ,EAAE;YAClB,EAAE,IAAI,EAAE,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC9D,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC,CAAC;QACH,MAAM,CACJ,qBAAqB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAC9D,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAgB,EAAY,EAAE,CAAC,CAAC;IAChD,KAAK,EAAE,GAAG;IACV,QAAQ,EAAE,GAAG;IACb,MAAM;CACP,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,6BAA6B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,CACJ,6BAA6B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CACxE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,6BAA6B,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,OAAO,GAAqB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,CACJ,uBAAuB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,CAChE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CACxE,oBAAoB,CACrB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CACJ,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CACnE,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAC/D,eAAe,CAChB,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAqB;YAChC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;SACzC,CAAC;QACF,MAAM,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC;YAClE,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CACJ,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAC/D,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,uCAAuC;YACpD,MAAM,EAAE,CAAC,UAAU,CAAC;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,qBAAqB,CAAC;YACnC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,2BAA2B;YACxC,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport type { AuthInfo } from \"../auth.js\";\nimport type { SecurityScheme } from \"../server.js\";\nimport {\n authToSecuritySchemes,\n clientPrefersInBandChallenge,\n evaluateSecuritySchemes,\n securitySchemesAllowAnonymous,\n wwwAuthenticateHeader,\n} from \"./security-schemes.js\";\n\ndescribe(\"clientPrefersInBandChallenge\", () => {\n it(\"detects ChatGPT / OpenAI user agents\", () => {\n expect(clientPrefersInBandChallenge(\"openai-mcp/1.0\")).toBe(true);\n expect(clientPrefersInBandChallenge(\"ChatGPT\")).toBe(true);\n expect(clientPrefersInBandChallenge(\"Claude-User/1.0\")).toBe(false);\n expect(clientPrefersInBandChallenge(undefined)).toBe(false);\n });\n});\n\ndescribe(\"authToSecuritySchemes\", () => {\n it(\"maps the auth shorthand\", () => {\n expect(authToSecuritySchemes({ public: true })).toEqual([\n { type: \"noauth\" },\n { type: \"oauth2\" },\n ]);\n expect(authToSecuritySchemes({})).toEqual([{ type: \"oauth2\" }]);\n expect(authToSecuritySchemes({ scopes: [\"checkout\"] })).toEqual([\n { type: \"oauth2\", scopes: [\"checkout\"] },\n ]);\n expect(\n authToSecuritySchemes({ public: true, scopes: [\"checkout\"] }),\n ).toEqual([{ type: \"noauth\" }, { type: \"oauth2\", scopes: [\"checkout\"] }]);\n });\n});\n\nconst authInfo = (scopes: string[]): AuthInfo => ({\n token: \"t\",\n clientId: \"c\",\n scopes,\n});\n\ndescribe(\"securitySchemesAllowAnonymous\", () => {\n it(\"is true only when a noauth scheme is present\", () => {\n expect(securitySchemesAllowAnonymous([{ type: \"noauth\" }])).toBe(true);\n expect(\n securitySchemesAllowAnonymous([{ type: \"noauth\" }, { type: \"oauth2\" }]),\n ).toBe(true);\n expect(securitySchemesAllowAnonymous([{ type: \"oauth2\" }])).toBe(false);\n expect(securitySchemesAllowAnonymous(undefined)).toBe(false);\n });\n});\n\ndescribe(\"evaluateSecuritySchemes\", () => {\n it(\"lets anonymous callers through a noauth tool\", () => {\n const schemes: SecurityScheme[] = [{ type: \"noauth\" }, { type: \"oauth2\" }];\n expect(evaluateSecuritySchemes(schemes, undefined)).toBeUndefined();\n });\n\n it(\"fails an oauth2-only tool with no token (invalid_token / 401)\", () => {\n expect(\n evaluateSecuritySchemes([{ type: \"oauth2\" }], undefined)?.error,\n ).toBe(\"invalid_token\");\n });\n\n it(\"fails when the token is missing a required scope (insufficient_scope / 403)\", () => {\n const schemes: SecurityScheme[] = [\n { type: \"oauth2\", scopes: [\"checkout\"] },\n ];\n expect(evaluateSecuritySchemes(schemes, authInfo([\"openid\"]))?.error).toBe(\n \"insufficient_scope\",\n );\n });\n\n it(\"passes when the token carries every required scope\", () => {\n const schemes: SecurityScheme[] = [\n { type: \"oauth2\", scopes: [\"checkout\"] },\n ];\n expect(\n evaluateSecuritySchemes(schemes, authInfo([\"openid\", \"checkout\"])),\n ).toBeUndefined();\n });\n\n it(\"treats an undeclared tool as auth-required, satisfied by any valid token\", () => {\n expect(evaluateSecuritySchemes(undefined, undefined)?.error).toBe(\n \"invalid_token\",\n );\n expect(evaluateSecuritySchemes(undefined, authInfo([]))).toBeUndefined();\n });\n\n it(\"carries the tool's required scopes on the failure\", () => {\n const schemes: SecurityScheme[] = [\n { type: \"oauth2\", scopes: [\"checkout\"] },\n ];\n expect(evaluateSecuritySchemes(schemes, undefined)?.scopes).toEqual([\n \"checkout\",\n ]);\n expect(\n evaluateSecuritySchemes(schemes, authInfo([\"openid\"]))?.scopes,\n ).toEqual([\"checkout\"]);\n });\n});\n\ndescribe(\"wwwAuthenticateHeader\", () => {\n it(\"names the required scopes so the client can step up\", () => {\n const header = wwwAuthenticateHeader({\n error: \"insufficient_scope\",\n description: \"Missing required scope for this tool.\",\n scopes: [\"checkout\"],\n });\n expect(header).toContain('error=\"insufficient_scope\"');\n expect(header).toContain('scope=\"checkout\"');\n });\n\n it(\"omits the scope parameter when there are none\", () => {\n const header = wwwAuthenticateHeader({\n error: \"invalid_token\",\n description: \"Sign in to use this tool.\",\n scopes: [],\n });\n expect(header).not.toContain(\"scope=\");\n });\n});\n"]}
|
|
@@ -1,4 +1,6 @@
|
|
|
1
1
|
import type { Express } from "express";
|
|
2
|
+
import type { SecurityScheme } from "../server.js";
|
|
2
3
|
import type { OAuthConfig } from "./index.js";
|
|
4
|
+
export type ResourceMetadataUrlResolver = (getHeader: (key: string) => string | undefined) => string;
|
|
3
5
|
/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
|
|
4
|
-
export declare function setupOAuth(app: Express, config: OAuthConfig,
|
|
6
|
+
export declare function setupOAuth(app: Express, config: OAuthConfig, schemesByTool: Map<string, SecurityScheme[] | undefined>): ResourceMetadataUrlResolver;
|
|
@@ -2,18 +2,21 @@ import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@m
|
|
|
2
2
|
import cors from "cors";
|
|
3
3
|
import { optionalBearerAuth, requireBearerAuth } from "../auth.js";
|
|
4
4
|
import { resolveServerOrigin } from "../requestOrigin.js";
|
|
5
|
+
import { clientPrefersInBandChallenge, evaluateSecuritySchemes, httpStatusForFailure, securitySchemesAllowAnonymous, wwwAuthenticateHeader, } from "./security-schemes.js";
|
|
5
6
|
import { createJwksVerifier } from "./verify.js";
|
|
6
7
|
/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
|
|
7
|
-
export function setupOAuth(app, config,
|
|
8
|
+
export function setupOAuth(app, config, schemesByTool) {
|
|
8
9
|
if (!config.verify?.issuer) {
|
|
9
10
|
throw new Error("oauth.verify requires an `issuer`");
|
|
10
11
|
}
|
|
12
|
+
const acceptsAnonymous = () => [...schemesByTool.values()].some(securitySchemesAllowAnonymous);
|
|
11
13
|
const verifier = createJwksVerifier(config.verify);
|
|
12
14
|
const bearer = (options) => {
|
|
13
15
|
const required = requireBearerAuth(options);
|
|
14
16
|
const optional = optionalBearerAuth(options);
|
|
15
|
-
return (req, res, next) => (acceptsAnonymous
|
|
17
|
+
return (req, res, next) => (acceptsAnonymous() ? optional : required)(req, res, next);
|
|
16
18
|
};
|
|
19
|
+
let resourceMetadataUrl;
|
|
17
20
|
// baseUrl known at boot: bake the resource URLs once, no Host-header trust.
|
|
18
21
|
if (config.baseUrl !== undefined) {
|
|
19
22
|
let baseUrl;
|
|
@@ -28,29 +31,58 @@ export function setupOAuth(app, config, acceptsAnonymous) {
|
|
|
28
31
|
resourceServerUrl: baseUrl,
|
|
29
32
|
scopesSupported: config.scopesSupported,
|
|
30
33
|
}));
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
requiredScopes: config.requiredScopes,
|
|
34
|
-
resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
|
|
35
|
-
}));
|
|
36
|
-
return;
|
|
34
|
+
const url = getOAuthProtectedResourceMetadataUrl(baseUrl);
|
|
35
|
+
resourceMetadataUrl = () => url;
|
|
37
36
|
}
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
37
|
+
else {
|
|
38
|
+
// No baseUrl: resolve the resource origin per request from forwarded headers
|
|
39
|
+
// (same precedence the framework uses for view serverUrl). Origin headers are
|
|
40
|
+
// pathless, so the PRM path stays at root, matching the SDK's static layout.
|
|
41
|
+
const resolveOrigin = (getHeader) => new URL(resolveServerOrigin(getHeader));
|
|
42
|
+
app.use("/.well-known/oauth-authorization-server", cors(), (_req, res) => void res.json(config.oauthMetadata));
|
|
43
|
+
app.use("/.well-known/oauth-protected-resource", cors(), (req, res) => {
|
|
44
|
+
res.json({
|
|
45
|
+
resource: resolveOrigin((key) => req.get(key)).href,
|
|
46
|
+
authorization_servers: [config.oauthMetadata.issuer],
|
|
47
|
+
scopes_supported: config.scopesSupported,
|
|
48
|
+
});
|
|
48
49
|
});
|
|
49
|
-
|
|
50
|
+
resourceMetadataUrl = (getHeader) => getOAuthProtectedResourceMetadataUrl(resolveOrigin(getHeader));
|
|
51
|
+
}
|
|
50
52
|
app.use("/mcp", (req, res, next) => bearer({
|
|
51
53
|
verifier,
|
|
52
54
|
requiredScopes: config.requiredScopes,
|
|
53
|
-
resourceMetadataUrl:
|
|
55
|
+
resourceMetadataUrl: resourceMetadataUrl((key) => req.get(key)),
|
|
54
56
|
})(req, res, next));
|
|
57
|
+
app.use("/mcp", (req, res, next) => {
|
|
58
|
+
const body = req.body;
|
|
59
|
+
const tool = body?.params?.name;
|
|
60
|
+
if (body?.method !== "tools/call" || !tool || !schemesByTool.has(tool)) {
|
|
61
|
+
return next();
|
|
62
|
+
}
|
|
63
|
+
const failure = evaluateSecuritySchemes(schemesByTool.get(tool), req.auth);
|
|
64
|
+
if (!failure) {
|
|
65
|
+
return next();
|
|
66
|
+
}
|
|
67
|
+
const challenge = wwwAuthenticateHeader(failure, resourceMetadataUrl((key) => req.get(key)));
|
|
68
|
+
if (clientPrefersInBandChallenge(req.get("user-agent"))) {
|
|
69
|
+
res.json({
|
|
70
|
+
jsonrpc: "2.0",
|
|
71
|
+
id: body.id ?? null,
|
|
72
|
+
result: {
|
|
73
|
+
content: [{ type: "text", text: failure.description }],
|
|
74
|
+
isError: true,
|
|
75
|
+
_meta: { "mcp/www_authenticate": [challenge] },
|
|
76
|
+
},
|
|
77
|
+
});
|
|
78
|
+
return;
|
|
79
|
+
}
|
|
80
|
+
res.set("WWW-Authenticate", challenge);
|
|
81
|
+
res.status(httpStatusForFailure(failure)).json({
|
|
82
|
+
error: failure.error,
|
|
83
|
+
error_description: failure.description,
|
|
84
|
+
});
|
|
85
|
+
});
|
|
86
|
+
return resourceMetadataUrl;
|
|
55
87
|
}
|
|
56
88
|
//# sourceMappingURL=setup.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AACzD,OAAO,IAAI,MAAM,MAAM,CAAC;
|
|
1
|
+
{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AACA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AACzD,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAG1D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAMjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CACxB,GAAY,EACZ,MAAmB,EACnB,aAAwD;IAExD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,EAAE,CAC5B,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,OAAoC,EAAkB,EAAE;QACtE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACxB,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC;IAEF,IAAI,mBAAgD,CAAC;IAErD,4EAA4E;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;YACpB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,OAAO;YAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;QAC1D,mBAAmB,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,MAAM,aAAa,GAAG,CAAC,SAA8C,EAAE,EAAE,CACvE,IAAI,GAAG,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,IAAI,EAAE,EACN,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACnD,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpE,GAAG,CAAC,IAAI,CAAC;gBACP,QAAQ,EAAE,aAAa,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;gBACnD,qBAAqB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;gBACpD,gBAAgB,EAAE,MAAM,CAAC,eAAe;aACzC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,mBAAmB,GAAG,CAAC,SAAS,EAAE,EAAE,CAClC,oCAAoC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjC,MAAM,CAAC;QACL,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;KAChE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CACnB,CAAC;IAEF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAMJ,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC;QAChC,IAAI,IAAI,EAAE,MAAM,KAAK,YAAY,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,OAAO,GAAG,uBAAuB,CACrC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EACtB,GAAqC,CAAC,IAAI,CAC5C,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,qBAAqB,CACrC,OAAO,EACP,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC3C,CAAC;QACF,IAAI,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;gBACnB,MAAM,EAAE;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;oBACtD,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,EAAE,sBAAsB,EAAE,CAAC,SAAS,CAAC,EAAE;iBAC/C;aACF,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACvC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,mBAAmB,CAAC;AAC7B,CAAC","sourcesContent":["import type { BearerAuthMiddlewareOptions } from \"@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js\";\nimport {\n getOAuthProtectedResourceMetadataUrl,\n mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport cors from \"cors\";\nimport type { Express, Request, RequestHandler } from \"express\";\nimport type { AuthInfo } from \"../auth.js\";\nimport { optionalBearerAuth, requireBearerAuth } from \"../auth.js\";\nimport { resolveServerOrigin } from \"../requestOrigin.js\";\nimport type { SecurityScheme } from \"../server.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport {\n clientPrefersInBandChallenge,\n evaluateSecuritySchemes,\n httpStatusForFailure,\n securitySchemesAllowAnonymous,\n wwwAuthenticateHeader,\n} from \"./security-schemes.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\nexport type ResourceMetadataUrlResolver = (\n getHeader: (key: string) => string | undefined,\n) => string;\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(\n app: Express,\n config: OAuthConfig,\n schemesByTool: Map<string, SecurityScheme[] | undefined>,\n): ResourceMetadataUrlResolver {\n if (!config.verify?.issuer) {\n throw new Error(\"oauth.verify requires an `issuer`\");\n }\n\n const acceptsAnonymous = () =>\n [...schemesByTool.values()].some(securitySchemesAllowAnonymous);\n const verifier = createJwksVerifier(config.verify);\n const bearer = (options: BearerAuthMiddlewareOptions): RequestHandler => {\n const required = requireBearerAuth(options);\n const optional = optionalBearerAuth(options);\n return (req, res, next) =>\n (acceptsAnonymous() ? optional : required)(req, res, next);\n };\n\n let resourceMetadataUrl: ResourceMetadataUrlResolver;\n\n // baseUrl known at boot: bake the resource URLs once, no Host-header trust.\n if (config.baseUrl !== undefined) {\n let baseUrl: URL;\n try {\n baseUrl = new URL(config.baseUrl);\n } catch {\n throw new Error(\n `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n config.baseUrl,\n )}`,\n );\n }\n app.use(\n mcpAuthMetadataRouter({\n oauthMetadata: config.oauthMetadata,\n resourceServerUrl: baseUrl,\n scopesSupported: config.scopesSupported,\n }),\n );\n const url = getOAuthProtectedResourceMetadataUrl(baseUrl);\n resourceMetadataUrl = () => url;\n } else {\n // No baseUrl: resolve the resource origin per request from forwarded headers\n // (same precedence the framework uses for view serverUrl). Origin headers are\n // pathless, so the PRM path stays at root, matching the SDK's static layout.\n const resolveOrigin = (getHeader: (key: string) => string | undefined) =>\n new URL(resolveServerOrigin(getHeader));\n app.use(\n \"/.well-known/oauth-authorization-server\",\n cors(),\n (_req, res) => void res.json(config.oauthMetadata),\n );\n app.use(\"/.well-known/oauth-protected-resource\", cors(), (req, res) => {\n res.json({\n resource: resolveOrigin((key) => req.get(key)).href,\n authorization_servers: [config.oauthMetadata.issuer],\n scopes_supported: config.scopesSupported,\n });\n });\n resourceMetadataUrl = (getHeader) =>\n getOAuthProtectedResourceMetadataUrl(resolveOrigin(getHeader));\n }\n\n app.use(\"/mcp\", (req, res, next) =>\n bearer({\n verifier,\n requiredScopes: config.requiredScopes,\n resourceMetadataUrl: resourceMetadataUrl((key) => req.get(key)),\n })(req, res, next),\n );\n\n app.use(\"/mcp\", (req, res, next) => {\n const body = req.body as\n | {\n id?: string | number | null;\n method?: string;\n params?: { name?: string };\n }\n | undefined;\n const tool = body?.params?.name;\n if (body?.method !== \"tools/call\" || !tool || !schemesByTool.has(tool)) {\n return next();\n }\n const failure = evaluateSecuritySchemes(\n schemesByTool.get(tool),\n (req as Request & { auth?: AuthInfo }).auth,\n );\n if (!failure) {\n return next();\n }\n const challenge = wwwAuthenticateHeader(\n failure,\n resourceMetadataUrl((key) => req.get(key)),\n );\n if (clientPrefersInBandChallenge(req.get(\"user-agent\"))) {\n res.json({\n jsonrpc: \"2.0\",\n id: body.id ?? null,\n result: {\n content: [{ type: \"text\", text: failure.description }],\n isError: true,\n _meta: { \"mcp/www_authenticate\": [challenge] },\n },\n });\n return;\n }\n res.set(\"WWW-Authenticate\", challenge);\n res.status(httpStatusForFailure(failure)).json({\n error: failure.error,\n error_description: failure.description,\n });\n });\n\n return resourceMetadataUrl;\n}\n"]}
|