skybridge 0.0.0-dev.ecf41c9 → 0.0.0-dev.ed81acb

package/dist/server/auth/discovery.js

@@ -0,0 +1,49 @@
+import { OAuthMetadataSchema, } from "@modelcontextprotocol/sdk/shared/auth.js";
+const WELL_KNOWN = [
+    "/.well-known/openid-configuration",
+    "/.well-known/oauth-authorization-server",
+];
+const DISCOVERY_TIMEOUT_MS = 5000;
+/** Fetches and validates an authorization server's discovery document. */
+export async function discoverAuthorizationServer(issuer) {
+    const base = issuer.replace(/\/$/, "");
+    const errors = [];
+    for (const path of WELL_KNOWN) {
+        const url = `${base}${path}`;
+        let res;
+        try {
+            res = await fetch(url, {
+                signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),
+            });
+        }
+        catch (err) {
+            errors.push(`${url}: ${err instanceof Error ? err.message : String(err)}`);
+            continue;
+        }
+        if (!res.ok) {
+            errors.push(`${url}: HTTP ${res.status}`);
+            continue;
+        }
+        let json;
+        try {
+            json = await res.json();
+        }
+        catch {
+            errors.push(`${url}: response is not valid JSON`);
+            continue;
+        }
+        const parsed = OAuthMetadataSchema.safeParse(json);
+        if (!parsed.success) {
+            errors.push(`${url}: invalid metadata (${parsed.error.message})`);
+            continue;
+        }
+        // RFC 8414 §3.3: the document's issuer must match the URL it came from.
+        if (parsed.data.issuer !== base) {
+            errors.push(`${url}: issuer mismatch (${parsed.data.issuer} !== ${base})`);
+            continue;
+        }
+        return parsed.data;
+    }
+    throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join("; ")}`);
+}
+//# sourceMappingURL=discovery.js.map

package/dist/server/auth/discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,mBAAmB,GACpB,MAAM,0CAA0C,CAAC;AAKlD,MAAM,UAAU,GAAG;IACjB,mCAAmC;IACnC,yCAAyC;CAC1C,CAAC;AAEF,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAc;IAEd,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;QAC7B,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,8BAA8B,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,uBAAuB,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACT,GAAG,GAAG,sBAAsB,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,CAC9D,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,MAAM,CAAC,IAA0B,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import {\n  type OAuthMetadata,\n  OAuthMetadataSchema,\n} from \"@modelcontextprotocol/sdk/shared/auth.js\";\n\n/** Discovered metadata; `jwks_uri` is an RFC field the SDK type doesn't expose. */\nexport type DiscoveredMetadata = OAuthMetadata & { jwks_uri?: string };\n\nconst WELL_KNOWN = [\n  \"/.well-known/openid-configuration\",\n  \"/.well-known/oauth-authorization-server\",\n];\n\nconst DISCOVERY_TIMEOUT_MS = 5000;\n\n/** Fetches and validates an authorization server's discovery document. */\nexport async function discoverAuthorizationServer(\n  issuer: string,\n): Promise<DiscoveredMetadata> {\n  const base = issuer.replace(/\\/$/, \"\");\n  const errors: string[] = [];\n\n  for (const path of WELL_KNOWN) {\n    const url = `${base}${path}`;\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS),\n      });\n    } catch (err) {\n      errors.push(\n        `${url}: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      continue;\n    }\n    if (!res.ok) {\n      errors.push(`${url}: HTTP ${res.status}`);\n      continue;\n    }\n    let json: unknown;\n    try {\n      json = await res.json();\n    } catch {\n      errors.push(`${url}: response is not valid JSON`);\n      continue;\n    }\n    const parsed = OAuthMetadataSchema.safeParse(json);\n    if (!parsed.success) {\n      errors.push(`${url}: invalid metadata (${parsed.error.message})`);\n      continue;\n    }\n    // RFC 8414 §3.3: the document's issuer must match the URL it came from.\n    if (parsed.data.issuer !== base) {\n      errors.push(\n        `${url}: issuer mismatch (${parsed.data.issuer} !== ${base})`,\n      );\n      continue;\n    }\n    return parsed.data as DiscoveredMetadata;\n  }\n\n  throw new Error(`OAuth discovery failed for ${issuer}: ${errors.join(\"; \")}`);\n}\n"]}

package/dist/server/auth/discovery.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/discovery.test.js

@@ -0,0 +1,85 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { discoverAuthorizationServer } from "./discovery.js";
+let server;
+afterEach(() => server?.close());
+function doc(origin, extra = {}) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/authorize`,
+        token_endpoint: `${origin}/token`,
+        registration_endpoint: `${origin}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "email"],
+        jwks_uri: `${origin}/jwks`,
+        ...extra,
+    };
+}
+// Serves bodies built from the live origin at their well-known paths; returns
+// the origin. A string body is sent raw (text/html); anything else is JSON.
+async function serve(build) {
+    let origin = "";
+    const srv = http.createServer((req, res) => {
+        const body = build(origin)[req.url ?? ""];
+        if (body === undefined) {
+            res.writeHead(404).end();
+            return;
+        }
+        if (typeof body === "string") {
+            res.writeHead(200, { "content-type": "text/html" }).end(body);
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(body));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    origin = `http://localhost:${srv.address().port}`;
+    return origin;
+}
+describe("discoverAuthorizationServer", () => {
+    it("fetches and validates openid-configuration", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+        expect(meta.jwks_uri).toBe(`${base}/jwks`);
+    });
+    it("falls back to oauth-authorization-server when oidc is 404", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("throws when no well-known doc is reachable", async () => {
+        const base = await serve(() => ({}));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+    it("falls through to oauth-authorization-server when oidc doc is schema-invalid", async () => {
+        const base = await serve((o) => ({
+            "/.well-known/openid-configuration": doc(o, {
+                response_types_supported: undefined,
+            }),
+            "/.well-known/oauth-authorization-server": doc(o),
+        }));
+        const meta = await discoverAuthorizationServer(base);
+        expect(meta.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("rejects a doc whose issuer does not match the fetch origin", async () => {
+        const base = await serve(() => ({
+            "/.well-known/openid-configuration": doc("https://evil.test"),
+        }));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+    it("treats a 200 non-JSON body as unreachable and throws discovery failed", async () => {
+        const base = await serve(() => ({
+            "/.well-known/openid-configuration": "<html>nope</html>",
+            "/.well-known/oauth-authorization-server": "<html>nope</html>",
+        }));
+        await expect(discoverAuthorizationServer(base)).rejects.toThrow(/discovery failed/i);
+    });
+});
+//# sourceMappingURL=discovery.test.js.map

package/dist/server/auth/discovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery.test.js","sourceRoot":"","sources":["../../../src/server/auth/discovery.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,KAAK,UAAU,KAAK,CAAC,KAAkD;IACrE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,CAAC;SAC5C,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/B,mCAAmC,EAAE,GAAG,CAAC,CAAC,EAAE;gBAC1C,wBAAwB,EAAE,SAAS;aACpC,CAAC;YACF,yCAAyC,EAAE,GAAG,CAAC,CAAC,CAAC;SAClD,CAAC,CAAC,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,mCAAmC,EAAE,GAAG,CAAC,mBAAmB,CAAC;SAC9D,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9B,mCAAmC,EAAE,mBAAmB;YACxD,yCAAyC,EAAE,mBAAmB;SAC/D,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC7D,mBAAmB,CACpB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { discoverAuthorizationServer } from \"./discovery.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves bodies built from the live origin at their well-known paths; returns\n// the origin. A string body is sent raw (text/html); anything else is JSON.\nasync function serve(build: (origin: string) => Record<string, unknown>) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    const body = build(origin)[req.url ?? \"\"];\n    if (body === undefined) {\n      res.writeHead(404).end();\n      return;\n    }\n    if (typeof body === \"string\") {\n      res.writeHead(200, { \"content-type\": \"text/html\" }).end(body);\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(body));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"discoverAuthorizationServer\", () => {\n  it(\"fetches and validates openid-configuration\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n    expect(meta.jwks_uri).toBe(`${base}/jwks`);\n  });\n\n  it(\"falls back to oauth-authorization-server when oidc is 404\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"throws when no well-known doc is reachable\", async () => {\n    const base = await serve(() => ({}));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n\n  it(\"falls through to oauth-authorization-server when oidc doc is schema-invalid\", async () => {\n    const base = await serve((o) => ({\n      \"/.well-known/openid-configuration\": doc(o, {\n        response_types_supported: undefined,\n      }),\n      \"/.well-known/oauth-authorization-server\": doc(o),\n    }));\n    const meta = await discoverAuthorizationServer(base);\n    expect(meta.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"rejects a doc whose issuer does not match the fetch origin\", async () => {\n    const base = await serve(() => ({\n      \"/.well-known/openid-configuration\": doc(\"https://evil.test\"),\n    }));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n\n  it(\"treats a 200 non-JSON body as unreachable and throws discovery failed\", async () => {\n    const base = await serve(() => ({\n      \"/.well-known/openid-configuration\": \"<html>nope</html>\",\n      \"/.well-known/oauth-authorization-server\": \"<html>nope</html>\",\n    }));\n    await expect(discoverAuthorizationServer(base)).rejects.toThrow(\n      /discovery failed/i,\n    );\n  });\n});\n"]}

package/dist/server/auth/index.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { JwksVerifyConfig } from "./verify.js";
+/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */
+export type OAuthConfig = {
+    /** Public URL of this server; sets `resourceServerUrl` and the `resource_metadata` URL. */
+    baseUrl: string;
+    /** AS metadata served at `/.well-known/oauth-authorization-server`. */
+    oauthMetadata: OAuthMetadata;
+    verify: JwksVerifyConfig;
+    /** Scopes advertised in protected-resource metadata. */
+    scopesSupported?: string[];
+    /** Server-wide required-scope floor. */
+    requiredScopes?: string[];
+    /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */
+    enforcement?: "required" | "optional";
+};

package/dist/server/auth/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/server/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/auth/index.ts"],"names":[],"mappings":"","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport type { JwksVerifyConfig } from \"./verify.js\";\n\n/** Resource-server OAuth config for `SkybridgeServerOptions.oauth`. */\nexport type OAuthConfig = {\n  /** Public URL of this server; sets `resourceServerUrl` and the `resource_metadata` URL. */\n  baseUrl: string;\n  /** AS metadata served at `/.well-known/oauth-authorization-server`. */\n  oauthMetadata: OAuthMetadata;\n  verify: JwksVerifyConfig;\n  /** Scopes advertised in protected-resource metadata. */\n  scopesSupported?: string[];\n  /** Server-wide required-scope floor. */\n  requiredScopes?: string[];\n  /** `required` (default) gates `/mcp`; `optional` allows anonymous for per-tool checks. */\n  enforcement?: \"required\" | \"optional\";\n};\n"]}

package/dist/server/auth/providers/custom.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
+import type { OAuthConfig } from "../index.js";
+/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */
+export declare function customProvider(opts: {
+    issuer: string;
+    audience: string;
+    baseUrl: string;
+    scopes?: string[];
+    requiredScopes?: string[];
+    enforcement?: "required" | "optional";
+    metadataOverrides?: Partial<OAuthMetadata>;
+}): Promise<OAuthConfig>;

package/dist/server/auth/providers/custom.js

@@ -0,0 +1,28 @@
+import { discoverAuthorizationServer, } from "../discovery.js";
+/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */
+export async function customProvider(opts) {
+    const discovered = await discoverAuthorizationServer(opts.issuer);
+    const oauthMetadata = {
+        ...discovered,
+        ...opts.metadataOverrides,
+    };
+    if (!oauthMetadata.registration_endpoint) {
+        throw new Error(`${opts.issuer} is not DCR-compatible (no registration_endpoint); customProvider only supports DCR IdPs.`);
+    }
+    if (!oauthMetadata.jwks_uri) {
+        throw new Error(`${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`);
+    }
+    return {
+        baseUrl: opts.baseUrl,
+        oauthMetadata,
+        verify: {
+            issuer: oauthMetadata.issuer,
+            audience: opts.audience,
+            jwksUri: oauthMetadata.jwks_uri,
+        },
+        scopesSupported: opts.scopes ?? oauthMetadata.scopes_supported,
+        requiredScopes: opts.requiredScopes,
+        enforcement: opts.enforcement,
+    };
+}
+//# sourceMappingURL=custom.js.map

package/dist/server/auth/providers/custom.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AAGzB,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAQpC;IACC,MAAM,UAAU,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,aAAa,GAAuB;QACxC,GAAG,UAAU;QACb,GAAG,IAAI,CAAC,iBAAiB;KAC1B,CAAC;IAEF,IAAI,CAAC,aAAa,CAAC,qBAAqB,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,2FAA2F,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,MAAM,4DAA4D,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,aAAa;QACb,MAAM,EAAE;YACN,MAAM,EAAE,aAAa,CAAC,MAAM;YAC5B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,aAAa,CAAC,QAAQ;SAChC;QACD,eAAe,EAAE,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,gBAAgB;QAC9D,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC;AACJ,CAAC","sourcesContent":["import type { OAuthMetadata } from \"@modelcontextprotocol/sdk/shared/auth.js\";\nimport {\n  type DiscoveredMetadata,\n  discoverAuthorizationServer,\n} from \"../discovery.js\";\nimport type { OAuthConfig } from \"../index.js\";\n\n/** Builds a complete {@link OAuthConfig} for a DCR-compatible IdP via discovery. */\nexport async function customProvider(opts: {\n  issuer: string;\n  audience: string;\n  baseUrl: string;\n  scopes?: string[];\n  requiredScopes?: string[];\n  enforcement?: \"required\" | \"optional\";\n  metadataOverrides?: Partial<OAuthMetadata>;\n}): Promise<OAuthConfig> {\n  const discovered = await discoverAuthorizationServer(opts.issuer);\n  const oauthMetadata: DiscoveredMetadata = {\n    ...discovered,\n    ...opts.metadataOverrides,\n  };\n\n  if (!oauthMetadata.registration_endpoint) {\n    throw new Error(\n      `${opts.issuer} is not DCR-compatible (no registration_endpoint); customProvider only supports DCR IdPs.`,\n    );\n  }\n  if (!oauthMetadata.jwks_uri) {\n    throw new Error(\n      `${opts.issuer} discovery has no jwks_uri; JWKS verification requires it.`,\n    );\n  }\n\n  return {\n    baseUrl: opts.baseUrl,\n    oauthMetadata,\n    verify: {\n      issuer: oauthMetadata.issuer,\n      audience: opts.audience,\n      jwksUri: oauthMetadata.jwks_uri,\n    },\n    scopesSupported: opts.scopes ?? oauthMetadata.scopes_supported,\n    requiredScopes: opts.requiredScopes,\n    enforcement: opts.enforcement,\n  };\n}\n"]}

package/dist/server/auth/providers/custom.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/custom.test.js

@@ -0,0 +1,83 @@
+// @vitest-environment node
+import http from "node:http";
+import { afterEach, describe, expect, it } from "vitest";
+import { customProvider } from "./custom.js";
+let server;
+afterEach(() => server?.close());
+function doc(origin, extra = {}) {
+    return {
+        issuer: origin,
+        authorization_endpoint: `${origin}/authorize`,
+        token_endpoint: `${origin}/token`,
+        registration_endpoint: `${origin}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid", "email", "profile"],
+        jwks_uri: `${origin}/jwks`,
+        ...extra,
+    };
+}
+// Serves the discovery doc (built from the live origin) at the OIDC well-known path.
+async function serveDiscovery(extra = {}) {
+    let origin = "";
+    const srv = http.createServer((req, res) => {
+        if (req.url !== "/.well-known/openid-configuration") {
+            res.writeHead(404).end();
+            return;
+        }
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify(doc(origin, extra)));
+    });
+    await new Promise((resolve) => srv.listen(0, resolve));
+    server = srv;
+    origin = `http://localhost:${srv.address().port}`;
+    return origin;
+}
+describe("customProvider", () => {
+    it("builds an OAuthConfig from discovery", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "my-api",
+            baseUrl: "https://app.example.test",
+            scopes: ["openid"],
+            enforcement: "optional",
+        });
+        expect(config.baseUrl).toBe("https://app.example.test");
+        expect(config.verify).toEqual({
+            issuer: base,
+            audience: "my-api",
+            jwksUri: `${base}/jwks`,
+        });
+        expect(config.scopesSupported).toEqual(["openid"]);
+        expect(config.enforcement).toBe("optional");
+        expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);
+    });
+    it("defaults scopesSupported to the discovered scopes", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+        });
+        expect(config.scopesSupported).toEqual(["openid", "email", "profile"]);
+    });
+    it("rejects a non-DCR IdP (no registration_endpoint)", async () => {
+        const base = await serveDiscovery({ registration_endpoint: undefined });
+        await expect(customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+        })).rejects.toThrow(/not DCR-compatible/);
+    });
+    it("applies metadataOverrides over discovered values", async () => {
+        const base = await serveDiscovery();
+        const config = await customProvider({
+            issuer: base,
+            audience: "a",
+            baseUrl: "https://app.example.test",
+            metadataOverrides: { token_endpoint: "https://override/token" },
+        });
+        expect(config.oauthMetadata.token_endpoint).toBe("https://override/token");
+    });
+});
+//# sourceMappingURL=custom.test.js.map

package/dist/server/auth/providers/custom.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/custom.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,IAAI,MAA+B,CAAC;AACpC,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAEjC,SAAS,GAAG,CAAC,MAAc,EAAE,QAAiC,EAAE;IAC9D,OAAO;QACL,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,QAAQ,EAAE,GAAG,MAAM,OAAO;QAC1B,GAAG,KAAK;KACT,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAAC,QAAiC,EAAE;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,GAAG,CAAC,GAAG,KAAK,mCAAmC,EAAE,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,CAAC;IACb,MAAM,GAAG,oBAAqB,GAAG,CAAC,OAAO,EAAuB,CAAC,IAAI,EAAE,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QAEpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,0BAA0B;YACnC,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,IAAI,OAAO;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,CACV,cAAc,CAAC;YACb,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;SACpC,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;YAClC,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,0BAA0B;YACnC,iBAAiB,EAAE,EAAE,cAAc,EAAE,wBAAwB,EAAE;SAChE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { customProvider } from \"./custom.js\";\n\nlet server: http.Server | undefined;\nafterEach(() => server?.close());\n\nfunction doc(origin: string, extra: Record<string, unknown> = {}) {\n  return {\n    issuer: origin,\n    authorization_endpoint: `${origin}/authorize`,\n    token_endpoint: `${origin}/token`,\n    registration_endpoint: `${origin}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\", \"email\", \"profile\"],\n    jwks_uri: `${origin}/jwks`,\n    ...extra,\n  };\n}\n\n// Serves the discovery doc (built from the live origin) at the OIDC well-known path.\nasync function serveDiscovery(extra: Record<string, unknown> = {}) {\n  let origin = \"\";\n  const srv = http.createServer((req, res) => {\n    if (req.url !== \"/.well-known/openid-configuration\") {\n      res.writeHead(404).end();\n      return;\n    }\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify(doc(origin, extra)));\n  });\n  await new Promise<void>((resolve) => srv.listen(0, resolve));\n  server = srv;\n  origin = `http://localhost:${(srv.address() as { port: number }).port}`;\n  return origin;\n}\n\ndescribe(\"customProvider\", () => {\n  it(\"builds an OAuthConfig from discovery\", async () => {\n    const base = await serveDiscovery();\n\n    const config = await customProvider({\n      issuer: base,\n      audience: \"my-api\",\n      baseUrl: \"https://app.example.test\",\n      scopes: [\"openid\"],\n      enforcement: \"optional\",\n    });\n\n    expect(config.baseUrl).toBe(\"https://app.example.test\");\n    expect(config.verify).toEqual({\n      issuer: base,\n      audience: \"my-api\",\n      jwksUri: `${base}/jwks`,\n    });\n    expect(config.scopesSupported).toEqual([\"openid\"]);\n    expect(config.enforcement).toBe(\"optional\");\n    expect(config.oauthMetadata.registration_endpoint).toBe(`${base}/register`);\n  });\n\n  it(\"defaults scopesSupported to the discovered scopes\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n    });\n    expect(config.scopesSupported).toEqual([\"openid\", \"email\", \"profile\"]);\n  });\n\n  it(\"rejects a non-DCR IdP (no registration_endpoint)\", async () => {\n    const base = await serveDiscovery({ registration_endpoint: undefined });\n    await expect(\n      customProvider({\n        issuer: base,\n        audience: \"a\",\n        baseUrl: \"https://app.example.test\",\n      }),\n    ).rejects.toThrow(/not DCR-compatible/);\n  });\n\n  it(\"applies metadataOverrides over discovered values\", async () => {\n    const base = await serveDiscovery();\n    const config = await customProvider({\n      issuer: base,\n      audience: \"a\",\n      baseUrl: \"https://app.example.test\",\n      metadataOverrides: { token_endpoint: \"https://override/token\" },\n    });\n    expect(config.oauthMetadata.token_endpoint).toBe(\"https://override/token\");\n  });\n});\n"]}

package/dist/server/auth/setup.d.ts

@@ -0,0 +1,4 @@
+import type { Express } from "express";
+import type { OAuthConfig } from "./index.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export declare function setupOAuth(app: Express, config: OAuthConfig): void;

package/dist/server/auth/setup.js

@@ -0,0 +1,28 @@
+import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { optionalBearerAuth, requireBearerAuth } from "../auth.js";
+import { createJwksVerifier } from "./verify.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export function setupOAuth(app, config) {
+    let baseUrl;
+    try {
+        baseUrl = new URL(config.baseUrl);
+    }
+    catch {
+        throw new Error(`oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(config.baseUrl)}`);
+    }
+    if (!config.verify?.issuer || !config.verify?.audience) {
+        throw new Error("oauth.verify requires both `issuer` and `audience`");
+    }
+    app.use(mcpAuthMetadataRouter({
+        oauthMetadata: config.oauthMetadata,
+        resourceServerUrl: baseUrl,
+        scopesSupported: config.scopesSupported,
+    }));
+    const bearer = config.enforcement === "optional" ? optionalBearerAuth : requireBearerAuth;
+    app.use("/mcp", bearer({
+        verifier: createJwksVerifier(config.verify),
+        requiredScopes: config.requiredScopes,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
+    }));
+}
+//# sourceMappingURL=setup.js.map

package/dist/server/auth/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AAEzD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAmB;IAC1D,IAAI,OAAY,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,iBAAiB,EAAE,OAAO;QAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,CAAC,CACH,CAAC;IAEF,MAAM,MAAM,GACV,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,MAAM,EACN,MAAM,CAAC;QACL,QAAQ,EAAE,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,oCAAoC,CAAC,OAAO,CAAC;KACnE,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport type { Express } from \"express\";\nimport { optionalBearerAuth, requireBearerAuth } from \"../auth.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(app: Express, config: OAuthConfig): void {\n  let baseUrl: URL;\n  try {\n    baseUrl = new URL(config.baseUrl);\n  } catch {\n    throw new Error(\n      `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n        config.baseUrl,\n      )}`,\n    );\n  }\n  if (!config.verify?.issuer || !config.verify?.audience) {\n    throw new Error(\"oauth.verify requires both `issuer` and `audience`\");\n  }\n\n  app.use(\n    mcpAuthMetadataRouter({\n      oauthMetadata: config.oauthMetadata,\n      resourceServerUrl: baseUrl,\n      scopesSupported: config.scopesSupported,\n    }),\n  );\n\n  const bearer =\n    config.enforcement === \"optional\" ? optionalBearerAuth : requireBearerAuth;\n  app.use(\n    \"/mcp\",\n    bearer({\n      verifier: createJwksVerifier(config.verify),\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),\n    }),\n  );\n}\n"]}

package/dist/server/auth/setup.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/setup.test.js

@@ -0,0 +1,161 @@
+// @vitest-environment node
+import http from "node:http";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import * as jose from "jose";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { McpServer } from "../server.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_req, _res, next) => next()),
+}));
+vi.mock("../viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
+const ISSUER = "https://issuer.test";
+const AUDIENCE = "api://default";
+let jwksServer;
+let appServer;
+afterEach(() => {
+    jwksServer?.close();
+    appServer?.close();
+});
+async function startJwks() {
+    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
+    const jwk = {
+        ...(await jose.exportJWK(publicKey)),
+        kid: "test-key",
+        alg: "RS256",
+        use: "sig",
+    };
+    const server = http.createServer((_req, res) => {
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ keys: [jwk] }));
+    });
+    await new Promise((resolve) => server.listen(0, resolve));
+    jwksServer = server;
+    const port = server.address().port;
+    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
+}
+function signToken(key) {
+    return new jose.SignJWT({
+        client_id: "client-1",
+        scope: "openid email",
+        sub: "user-1",
+    })
+        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+        .setIssuer(ISSUER)
+        .setAudience(AUDIENCE)
+        .setExpirationTime("1h")
+        .sign(key);
+}
+async function bootServer(jwksUri, { baseUrl = "https://app.example.test", enforcement = "required", } = {}) {
+    const { createApp } = await import("../express.js");
+    const server = new McpServer({ name: "auth-test", version: "0.0.0" }, { capabilities: {} }, {
+        oauth: {
+            baseUrl,
+            oauthMetadata: {
+                issuer: ISSUER,
+                authorization_endpoint: `${ISSUER}/authorize`,
+                token_endpoint: `${ISSUER}/token`,
+                response_types_supported: ["code"],
+            },
+            verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },
+            scopesSupported: ["openid", "email"],
+            requiredScopes: ["openid"],
+            enforcement,
+        },
+    }).registerTool({
+        name: "whoami",
+        description: "Returns the caller identity.",
+        inputSchema: {},
+    }, (_args, extra) => ({
+        structuredContent: { clientId: extra.authInfo?.clientId ?? null },
+        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
+    }));
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    appServer = listening;
+    const port = listening.address().port;
+    return `http://localhost:${port}`;
+}
+describe("setupOAuth wiring", () => {
+    it("serves protected-resource metadata", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const res = await fetch(`${base}/.well-known/oauth-protected-resource`);
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.resource).toBe("https://app.example.test/");
+        expect(body.authorization_servers).toContain(ISSUER);
+        expect(body.scopes_supported).toEqual(["openid", "email"]);
+    });
+    it("rejects /mcp without a token (401 + WWW-Authenticate)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
+        });
+        expect(res.status).toBe(401);
+        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata=/);
+    });
+    it("threads authInfo into the tool handler for a valid token", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const token = await signToken(privateKey);
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        const transport = new StreamableHTTPClientTransport(new URL(`${base}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${token}` } } });
+        await client.connect(transport);
+        const result = (await client.callTool({
+            name: "whoami",
+            arguments: {},
+        }));
+        expect(result.content[0]?.text).toBe("client-1");
+        await client.close();
+    });
+});
+describe("enforcement: optional", () => {
+    it("lets an anonymous /mcp request through", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { enforcement: "optional" });
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Accept: "application/json, text/event-stream",
+            },
+            body: JSON.stringify({
+                jsonrpc: "2.0",
+                method: "initialize",
+                id: 1,
+                params: {
+                    protocolVersion: "2025-06-18",
+                    capabilities: {},
+                    clientInfo: { name: "anon", version: "0.0.0" },
+                },
+            }),
+        });
+        expect(res.status).toBe(200);
+    });
+});
+describe("oauth config validation", () => {
+    const validMetadata = {
+        issuer: ISSUER,
+        authorization_endpoint: `${ISSUER}/authorize`,
+        token_endpoint: `${ISSUER}/token`,
+        response_types_supported: ["code"],
+    };
+    it("throws on a non-absolute baseUrl", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }, undefined, {
+            oauth: {
+                baseUrl: "not-a-url",
+                oauthMetadata: validMetadata,
+                verify: { issuer: ISSUER, audience: AUDIENCE },
+            },
+        })).toThrow(/baseUrl must be a valid absolute URL/);
+    });
+});
+//# sourceMappingURL=setup.test.js.map

package/dist/server/auth/setup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK,EAAE,cAAc;QACrB,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EACE,OAAO,GAAG,0BAA0B,EACpC,WAAW,GAAG,UAAU,MACuC,EAAE;IAEnE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,OAAO;YACP,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;YACvD,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;YAC1B,WAAW;SACZ;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAEpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY;gBACpB,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,YAAY,EAAE,EAAE;oBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE;iBAC/C;aACF,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC/C;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey) {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope: \"openid email\",\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  {\n    baseUrl = \"https://app.example.test\",\n    enforcement = \"required\",\n  }: { baseUrl?: string; enforcement?: \"required\" | \"optional\" } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        baseUrl,\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n        enforcement,\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"enforcement: optional\", () => {\n  it(\"lets an anonymous /mcp request through\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { enforcement: \"optional\" });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        Accept: \"application/json, text/event-stream\",\n      },\n      body: JSON.stringify({\n        jsonrpc: \"2.0\",\n        method: \"initialize\",\n        id: 1,\n        params: {\n          protocolVersion: \"2025-06-18\",\n          capabilities: {},\n          clientInfo: { name: \"anon\", version: \"0.0.0\" },\n        },\n      }),\n    });\n    expect(res.status).toBe(200);\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verify: { issuer: ISSUER, audience: AUDIENCE },\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}

package/dist/server/auth/verify.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthTokenVerifier } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+export type JwksVerifyConfig = {
+    /** Expected `iss` claim. */
+    issuer: string;
+    /** Expected `aud` claim. */
+    audience: string;
+    /** Defaults to `${issuer}/.well-known/jwks.json`. */
+    jwksUri?: string;
+};
+/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+export declare function createJwksVerifier(config: JwksVerifyConfig): OAuthTokenVerifier;

package/dist/server/auth/verify.js

@@ -0,0 +1,37 @@
+import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import * as jose from "jose";
+/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+export function createJwksVerifier(config) {
+    const jwksUri = config.jwksUri ??
+        `${config.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+    const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+    return {
+        async verifyAccessToken(token) {
+            let payload;
+            try {
+                ({ payload } = await jose.jwtVerify(token, jwks, {
+                    issuer: config.issuer,
+                    audience: config.audience,
+                }));
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                throw new InvalidTokenError(`Token verification failed: ${message}`);
+            }
+            const { client_id, scope, exp, sub, ...rest } = payload;
+            const scopes = Array.isArray(scope)
+                ? scope.map(String)
+                : typeof scope === "string"
+                    ? scope.split(/\s+/).filter(Boolean)
+                    : [];
+            return {
+                token,
+                clientId: client_id ?? "",
+                scopes,
+                expiresAt: exp,
+                extra: { subject: sub, ...rest },
+            };
+        },
+    };
+}
+//# sourceMappingURL=verify.js.map