skybridge 0.0.0-dev.fff2bae → 0.0.0-next.1ec1c19

package/dist/server/auth/providers/descope.d.ts

@@ -0,0 +1,15 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery
+ * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.
+ * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your
+ * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR
+ * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`
+ * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to
+ * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client
+ * id, project id], not the server URL; pass `audience` to override.
+ */
+export declare function descopeProvider(opts: {
+    url: string;
+} & Omit<CustomProviderOptions, "issuer">): Promise<OAuthConfig>;

package/dist/server/auth/providers/descope.js

@@ -0,0 +1,33 @@
+import { customProvider } from "./custom.js";
+/**
+ * Derives the Descope Project ID from an MCP Server URL
+ * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the
+ * project id, so it doubles as the audience.
+ */
+function projectIdFromUrl(url) {
+    const projectId = url.match(/\/agentic\/([^/]+)\/[^/]+/)?.[1];
+    if (!projectId) {
+        throw new Error(`Could not derive the Descope project id from "${url}"; pass an explicit \`audience\`.`);
+    }
+    return projectId;
+}
+/**
+ * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery
+ * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.
+ * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your
+ * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR
+ * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`
+ * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to
+ * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client
+ * id, project id], not the server URL; pass `audience` to override.
+ */
+export function descopeProvider(opts) {
+    const { url, audience, ...rest } = opts;
+    const issuer = url.replace(/\/\.well-known\/[^?#]*$/, "").replace(/\/$/, "");
+    return customProvider({
+        issuer,
+        audience: audience ?? projectIdFromUrl(issuer),
+        ...rest,
+    });
+}
+//# sourceMappingURL=descope.js.map

package/dist/server/auth/providers/descope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descope.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AAEzE;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iDAAiD,GAAG,mCAAmC,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAA6D;IAE7D,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,cAAc,CAAC;QACpB,MAAM;QACN,QAAQ,EAAE,QAAQ,IAAI,gBAAgB,CAAC,MAAM,CAAC;QAC9C,GAAG,IAAI;KACR,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\n\n/**\n * Derives the Descope Project ID from an MCP Server URL\n * (`…/agentic/<projectId>/<mcpServerId>`). Descope binds the token `aud` to the\n * project id, so it doubles as the audience.\n */\nfunction projectIdFromUrl(url: string): string {\n  const projectId = url.match(/\\/agentic\\/([^/]+)\\/[^/]+/)?.[1];\n  if (!projectId) {\n    throw new Error(\n      `Could not derive the Descope project id from \"${url}\"; pass an explicit \\`audience\\`.`,\n    );\n  }\n  return projectId;\n}\n\n/**\n * OAuth provider for a Descope MCP Server. `url` is the MCP Server's **Discovery\n * URL** (a.k.a. Issuer) from the console's Connection Information, e.g.\n * `https://api.descope.com/v1/apps/agentic/<projectId>/<mcpServerId>` (or your\n * custom domain). Requires DCR enabled on the MCP Server. For Descope with DCR\n * disabled and Alpic's DCR proxy, use {@link customProvider} with `serverUrl`\n * instead (see `examples/auth-descope-alpic`). The token `audience` defaults to\n * the **Project ID** derived from the URL — Descope binds `aud` to [DCR client\n * id, project id], not the server URL; pass `audience` to override.\n */\nexport function descopeProvider(\n  opts: { url: string } & Omit<CustomProviderOptions, \"issuer\">,\n): Promise<OAuthConfig> {\n  const { url, audience, ...rest } = opts;\n  const issuer = url.replace(/\\/\\.well-known\\/[^?#]*$/, \"\").replace(/\\/$/, \"\");\n  return customProvider({\n    issuer,\n    audience: audience ?? projectIdFromUrl(issuer),\n    ...rest,\n  });\n}\n"]}

package/dist/server/auth/providers/descope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/descope.test.js

@@ -0,0 +1,37 @@
+// @vitest-environment node
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { descopeProvider } from "./descope.js";
+afterEach(() => vi.restoreAllMocks());
+function discoveryDoc(issuer) {
+    return {
+        issuer,
+        authorization_endpoint: `${issuer}/authorize`,
+        token_endpoint: `${issuer}/token`,
+        registration_endpoint: `${issuer}/register`,
+        response_types_supported: ["code"],
+        scopes_supported: ["openid"],
+        jwks_uri: `${issuer}/.well-known/jwks.json`,
+    };
+}
+function mockDiscovery(issuer) {
+    return vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(discoveryDoc(issuer)), {
+        headers: { "content-type": "application/json" },
+    }));
+}
+describe("descopeProvider", () => {
+    it("derives issuer and audience (project id) from the MCP Server URL", async () => {
+        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+        const fetchSpy = mockDiscovery(issuer);
+        const config = await descopeProvider({ url: issuer });
+        expect(fetchSpy).toHaveBeenCalledWith(`${issuer}/.well-known/openid-configuration`, expect.anything());
+        expect(config.verify.issuer).toBe(issuer);
+        expect(config.verify.audience).toBe("P123");
+    });
+    it("lets an explicit audience override the derived project id", async () => {
+        const issuer = "https://api.descope.com/v1/apps/agentic/P123/MS456";
+        mockDiscovery(issuer);
+        const config = await descopeProvider({ url: issuer, audience: "custom" });
+        expect(config.verify.audience).toBe("custom");
+    });
+});
+//# sourceMappingURL=descope.test.js.map

package/dist/server/auth/providers/descope.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descope.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/descope.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;AAEtC,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,qBAAqB,EAAE,GAAG,MAAM,WAAW;QAC3C,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gBAAgB,EAAE,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,GAAG,MAAM,wBAAwB;KAC5C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAc;IACnC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE;QACjD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CACH,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,GAAG,MAAM,mCAAmC,EAC5C,MAAM,CAAC,QAAQ,EAAE,CAClB,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,oDAAoD,CAAC;QACpE,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE1E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { descopeProvider } from \"./descope.js\";\n\nafterEach(() => vi.restoreAllMocks());\n\nfunction discoveryDoc(issuer: string) {\n  return {\n    issuer,\n    authorization_endpoint: `${issuer}/authorize`,\n    token_endpoint: `${issuer}/token`,\n    registration_endpoint: `${issuer}/register`,\n    response_types_supported: [\"code\"],\n    scopes_supported: [\"openid\"],\n    jwks_uri: `${issuer}/.well-known/jwks.json`,\n  };\n}\n\nfunction mockDiscovery(issuer: string) {\n  return vi.spyOn(globalThis, \"fetch\").mockResolvedValue(\n    new Response(JSON.stringify(discoveryDoc(issuer)), {\n      headers: { \"content-type\": \"application/json\" },\n    }),\n  );\n}\n\ndescribe(\"descopeProvider\", () => {\n  it(\"derives issuer and audience (project id) from the MCP Server URL\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    const fetchSpy = mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer });\n\n    expect(fetchSpy).toHaveBeenCalledWith(\n      `${issuer}/.well-known/openid-configuration`,\n      expect.anything(),\n    );\n    expect(config.verify.issuer).toBe(issuer);\n    expect(config.verify.audience).toBe(\"P123\");\n  });\n\n  it(\"lets an explicit audience override the derived project id\", async () => {\n    const issuer = \"https://api.descope.com/v1/apps/agentic/P123/MS456\";\n    mockDiscovery(issuer);\n\n    const config = await descopeProvider({ url: issuer, audience: \"custom\" });\n\n    expect(config.verify.audience).toBe(\"custom\");\n  });\n});\n"]}

package/dist/server/auth/providers/shared.d.ts

@@ -0,0 +1,2 @@
+/** Normalises a bare host to an https issuer URL and strips a trailing slash. */
+export declare function toIssuerUrl(domain: string): string;

package/dist/server/auth/providers/shared.js

@@ -0,0 +1,6 @@
+/** Normalises a bare host to an https issuer URL and strips a trailing slash. */
+export function toIssuerUrl(domain) {
+    const withScheme = /^https?:\/\//.test(domain) ? domain : `https://${domain}`;
+    return withScheme.replace(/\/$/, "");
+}
+//# sourceMappingURL=shared.js.map

package/dist/server/auth/providers/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/shared.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC;IAC9E,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC","sourcesContent":["/** Normalises a bare host to an https issuer URL and strips a trailing slash. */\nexport function toIssuerUrl(domain: string): string {\n  const withScheme = /^https?:\\/\\//.test(domain) ? domain : `https://${domain}`;\n  return withScheme.replace(/\\/$/, \"\");\n}\n"]}

package/dist/server/auth/providers/shared.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/providers/shared.test.js

@@ -0,0 +1,10 @@
+import { describe, expect, it } from "vitest";
+import { toIssuerUrl } from "./shared.js";
+describe("toIssuerUrl", () => {
+    it("adds https to a bare host, preserves an explicit scheme, strips a trailing slash", () => {
+        expect(toIssuerUrl("acme.authkit.app")).toBe("https://acme.authkit.app");
+        expect(toIssuerUrl("https://acme.authkit.app/")).toBe("https://acme.authkit.app");
+        expect(toIssuerUrl("http://localhost:3000")).toBe("http://localhost:3000");
+    });
+});
+//# sourceMappingURL=shared.test.js.map

package/dist/server/auth/providers/shared.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.test.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/shared.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzE,MAAM,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC,CAAC,IAAI,CACnD,0BAA0B,CAC3B,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { describe, expect, it } from \"vitest\";\nimport { toIssuerUrl } from \"./shared.js\";\n\ndescribe(\"toIssuerUrl\", () => {\n  it(\"adds https to a bare host, preserves an explicit scheme, strips a trailing slash\", () => {\n    expect(toIssuerUrl(\"acme.authkit.app\")).toBe(\"https://acme.authkit.app\");\n    expect(toIssuerUrl(\"https://acme.authkit.app/\")).toBe(\n      \"https://acme.authkit.app\",\n    );\n    expect(toIssuerUrl(\"http://localhost:3000\")).toBe(\"http://localhost:3000\");\n  });\n});\n"]}

package/dist/server/auth/providers/stytch.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for Stytch Connected Apps. `domain` is the project domain,
+ * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires
+ * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID
+ * (the default token audience).
+ */
+export declare function stytchProvider(opts: {
+    domain: string;
+    audience: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/stytch.js

@@ -0,0 +1,13 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for Stytch Connected Apps. `domain` is the project domain,
+ * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires
+ * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID
+ * (the default token audience).
+ */
+export function stytchProvider(opts) {
+    const { domain, ...rest } = opts;
+    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+}
+//# sourceMappingURL=stytch.js.map

package/dist/server/auth/providers/stytch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stytch.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/stytch.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for Stytch Connected Apps. `domain` is the project domain,\n * e.g. `acme.customers.stytch.dev`, or a configured custom domain. Requires\n * DCR enabled in the Stytch dashboard. `audience` is the Stytch Project ID\n * (the default token audience).\n */\nexport function stytchProvider(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}

package/dist/server/auth/providers/workos.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthConfig } from "../index.js";
+import { type CustomProviderOptions } from "./custom.js";
+/**
+ * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.
+ * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard
+ * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.
+ */
+export declare function workosProvider(opts: {
+    domain: string;
+    audience: string;
+} & Omit<CustomProviderOptions, "issuer" | "audience">): Promise<OAuthConfig>;

package/dist/server/auth/providers/workos.js

@@ -0,0 +1,12 @@
+import { customProvider } from "./custom.js";
+import { toIssuerUrl } from "./shared.js";
+/**
+ * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.
+ * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard
+ * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.
+ */
+export function workosProvider(opts) {
+    const { domain, ...rest } = opts;
+    return customProvider({ issuer: toIssuerUrl(domain), ...rest });
+}
+//# sourceMappingURL=workos.js.map

package/dist/server/auth/providers/workos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workos.js","sourceRoot":"","sources":["../../../../src/server/auth/providers/workos.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,cAAc,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAGC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IACjC,OAAO,cAAc,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC","sourcesContent":["import type { OAuthConfig } from \"../index.js\";\nimport { type CustomProviderOptions, customProvider } from \"./custom.js\";\nimport { toIssuerUrl } from \"./shared.js\";\n\n/**\n * OAuth provider for WorkOS AuthKit. `domain` is the AuthKit domain, e.g.\n * `acme.authkit.app`. Requires DCR enabled in the WorkOS dashboard\n * (Connect → Configuration). `audience` is the MCP server's Resource Indicator.\n */\nexport function workosProvider(\n  opts: { domain: string; audience: string } & Omit<\n    CustomProviderOptions,\n    \"issuer\" | \"audience\"\n  >,\n): Promise<OAuthConfig> {\n  const { domain, ...rest } = opts;\n  return customProvider({ issuer: toIssuerUrl(domain), ...rest });\n}\n"]}

package/dist/server/auth/setup.d.ts

@@ -0,0 +1,4 @@
+import type { Express } from "express";
+import type { OAuthConfig } from "./index.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export declare function setupOAuth(app: Express, config: OAuthConfig): void;

package/dist/server/auth/setup.js

@@ -0,0 +1,51 @@
+import { getOAuthProtectedResourceMetadataUrl, mcpAuthMetadataRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import cors from "cors";
+import { requireBearerAuth } from "../auth.js";
+import { resolveServerOrigin } from "../requestOrigin.js";
+import { createJwksVerifier } from "./verify.js";
+/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */
+export function setupOAuth(app, config) {
+    if (!config.verify?.issuer) {
+        throw new Error("oauth.verify requires an `issuer`");
+    }
+    const verifier = createJwksVerifier(config.verify);
+    // baseUrl known at boot: bake the resource URLs once, no Host-header trust.
+    if (config.baseUrl !== undefined) {
+        let baseUrl;
+        try {
+            baseUrl = new URL(config.baseUrl);
+        }
+        catch {
+            throw new Error(`oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(config.baseUrl)}`);
+        }
+        app.use(mcpAuthMetadataRouter({
+            oauthMetadata: config.oauthMetadata,
+            resourceServerUrl: baseUrl,
+            scopesSupported: config.scopesSupported,
+        }));
+        app.use("/mcp", requireBearerAuth({
+            verifier,
+            requiredScopes: config.requiredScopes,
+            resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),
+        }));
+        return;
+    }
+    // No baseUrl: resolve the resource origin per request from forwarded headers
+    // (same precedence the framework uses for view serverUrl). Origin headers are
+    // pathless, so the PRM path stays at root, matching the SDK's static layout.
+    const resolveOrigin = (req) => new URL(resolveServerOrigin((key) => req.get(key)));
+    app.use("/.well-known/oauth-authorization-server", cors(), (_req, res) => void res.json(config.oauthMetadata));
+    app.use("/.well-known/oauth-protected-resource", cors(), (req, res) => {
+        res.json({
+            resource: resolveOrigin(req).href,
+            authorization_servers: [config.oauthMetadata.issuer],
+            scopes_supported: config.scopesSupported,
+        });
+    });
+    app.use("/mcp", (req, res, next) => requireBearerAuth({
+        verifier,
+        requiredScopes: config.requiredScopes,
+        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(resolveOrigin(req)),
+    })(req, res, next));
+}
+//# sourceMappingURL=setup.js.map

package/dist/server/auth/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/server/auth/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oCAAoC,EACpC,qBAAqB,GACtB,MAAM,iDAAiD,CAAC;AACzD,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,GAAY,EAAE,MAAmB;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAEnD,4EAA4E;IAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAY,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAChE,MAAM,CAAC,OAAO,CACf,EAAE,CACJ,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,GAAG,CACL,qBAAqB,CAAC;YACpB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,iBAAiB,EAAE,OAAO;YAC1B,eAAe,EAAE,MAAM,CAAC,eAAe;SACxC,CAAC,CACH,CAAC;QACF,GAAG,CAAC,GAAG,CACL,MAAM,EACN,iBAAiB,CAAC;YAChB,QAAQ;YACR,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,mBAAmB,EAAE,oCAAoC,CAAC,OAAO,CAAC;SACnE,CAAC,CACH,CAAC;QACF,OAAO;IACT,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CACrC,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEtD,GAAG,CAAC,GAAG,CACL,yCAAyC,EACzC,IAAI,EAAE,EACN,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CACnD,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,uCAAuC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpE,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI;YACjC,qBAAqB,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;YACpD,gBAAgB,EAAE,MAAM,CAAC,eAAe;SACzC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CACjC,iBAAiB,CAAC;QAChB,QAAQ;QACR,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,mBAAmB,EAAE,oCAAoC,CACvD,aAAa,CAAC,GAAG,CAAC,CACnB;KACF,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  getOAuthProtectedResourceMetadataUrl,\n  mcpAuthMetadataRouter,\n} from \"@modelcontextprotocol/sdk/server/auth/router.js\";\nimport cors from \"cors\";\nimport type { Express, Request } from \"express\";\nimport { requireBearerAuth } from \"../auth.js\";\nimport { resolveServerOrigin } from \"../requestOrigin.js\";\nimport type { OAuthConfig } from \"./index.js\";\nimport { createJwksVerifier } from \"./verify.js\";\n\n/** Mounts the well-known OAuth metadata and bearer auth on `/mcp`. */\nexport function setupOAuth(app: Express, config: OAuthConfig): void {\n  if (!config.verify?.issuer) {\n    throw new Error(\"oauth.verify requires an `issuer`\");\n  }\n\n  const verifier = createJwksVerifier(config.verify);\n\n  // baseUrl known at boot: bake the resource URLs once, no Host-header trust.\n  if (config.baseUrl !== undefined) {\n    let baseUrl: URL;\n    try {\n      baseUrl = new URL(config.baseUrl);\n    } catch {\n      throw new Error(\n        `oauth.baseUrl must be a valid absolute URL, got: ${JSON.stringify(\n          config.baseUrl,\n        )}`,\n      );\n    }\n    app.use(\n      mcpAuthMetadataRouter({\n        oauthMetadata: config.oauthMetadata,\n        resourceServerUrl: baseUrl,\n        scopesSupported: config.scopesSupported,\n      }),\n    );\n    app.use(\n      \"/mcp\",\n      requireBearerAuth({\n        verifier,\n        requiredScopes: config.requiredScopes,\n        resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(baseUrl),\n      }),\n    );\n    return;\n  }\n\n  // No baseUrl: resolve the resource origin per request from forwarded headers\n  // (same precedence the framework uses for view serverUrl). Origin headers are\n  // pathless, so the PRM path stays at root, matching the SDK's static layout.\n  const resolveOrigin = (req: Request) =>\n    new URL(resolveServerOrigin((key) => req.get(key)));\n\n  app.use(\n    \"/.well-known/oauth-authorization-server\",\n    cors(),\n    (_req, res) => void res.json(config.oauthMetadata),\n  );\n  app.use(\"/.well-known/oauth-protected-resource\", cors(), (req, res) => {\n    res.json({\n      resource: resolveOrigin(req).href,\n      authorization_servers: [config.oauthMetadata.issuer],\n      scopes_supported: config.scopesSupported,\n    });\n  });\n  app.use(\"/mcp\", (req, res, next) =>\n    requireBearerAuth({\n      verifier,\n      requiredScopes: config.requiredScopes,\n      resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(\n        resolveOrigin(req),\n      ),\n    })(req, res, next),\n  );\n}\n"]}

package/dist/server/auth/setup.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/server/auth/setup.test.js

@@ -0,0 +1,185 @@
+// @vitest-environment node
+import http from "node:http";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import * as jose from "jose";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { McpServer } from "../server.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_req, _res, next) => next()),
+}));
+vi.mock("../viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
+const ISSUER = "https://issuer.test";
+const AUDIENCE = "api://default";
+let jwksServer;
+let appServer;
+afterEach(() => {
+    jwksServer?.close();
+    appServer?.close();
+});
+async function startJwks() {
+    const { publicKey, privateKey } = await jose.generateKeyPair("RS256");
+    const jwk = {
+        ...(await jose.exportJWK(publicKey)),
+        kid: "test-key",
+        alg: "RS256",
+        use: "sig",
+    };
+    const server = http.createServer((_req, res) => {
+        res.setHeader("content-type", "application/json");
+        res.end(JSON.stringify({ keys: [jwk] }));
+    });
+    await new Promise((resolve) => server.listen(0, resolve));
+    jwksServer = server;
+    const port = server.address().port;
+    return { privateKey, jwksUri: `http://localhost:${port}/jwks` };
+}
+function signToken(key) {
+    return new jose.SignJWT({
+        client_id: "client-1",
+        scope: "openid email",
+        sub: "user-1",
+    })
+        .setProtectedHeader({ alg: "RS256", kid: "test-key" })
+        .setIssuer(ISSUER)
+        .setAudience(AUDIENCE)
+        .setExpirationTime("1h")
+        .sign(key);
+}
+async function bootServer(jwksUri, { baseUrl = "https://app.example.test" } = {}) {
+    const { createApp } = await import("../express.js");
+    const server = new McpServer({ name: "auth-test", version: "0.0.0" }, { capabilities: {} }, {
+        oauth: {
+            ...(baseUrl === null ? {} : { baseUrl }),
+            oauthMetadata: {
+                issuer: ISSUER,
+                authorization_endpoint: `${ISSUER}/authorize`,
+                token_endpoint: `${ISSUER}/token`,
+                response_types_supported: ["code"],
+            },
+            verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },
+            scopesSupported: ["openid", "email"],
+            requiredScopes: ["openid"],
+        },
+    }).registerTool({
+        name: "whoami",
+        description: "Returns the caller identity.",
+        inputSchema: {},
+    }, (_args, extra) => ({
+        structuredContent: { clientId: extra.authInfo?.clientId ?? null },
+        content: [{ type: "text", text: extra.authInfo?.clientId ?? "anon" }],
+    }));
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    appServer = listening;
+    const port = listening.address().port;
+    return `http://localhost:${port}`;
+}
+describe("setupOAuth wiring", () => {
+    it("serves protected-resource metadata", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const res = await fetch(`${base}/.well-known/oauth-protected-resource`);
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.resource).toBe("https://app.example.test/");
+        expect(body.authorization_servers).toContain(ISSUER);
+        expect(body.scopes_supported).toEqual(["openid", "email"]);
+    });
+    it("rejects /mcp without a token (401 + WWW-Authenticate)", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
+        });
+        expect(res.status).toBe(401);
+        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata=/);
+    });
+    it("threads authInfo into the tool handler for a valid token", async () => {
+        const { privateKey, jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri);
+        const token = await signToken(privateKey);
+        const client = new Client({ name: "test-client", version: "0.0.0" });
+        const transport = new StreamableHTTPClientTransport(new URL(`${base}/mcp`), { requestInit: { headers: { Authorization: `Bearer ${token}` } } });
+        await client.connect(transport);
+        const result = (await client.callTool({
+            name: "whoami",
+            arguments: {},
+        }));
+        expect(result.content[0]?.text).toBe("client-1");
+        await client.close();
+    });
+});
+describe("baseUrl inferred from headers", () => {
+    it("derives the resource origin from x-forwarded-host", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { baseUrl: null });
+        const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {
+            headers: { "x-forwarded-host": "infer.example.test" },
+        });
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.resource).toBe("https://infer.example.test/");
+    });
+    it("uses the first hop of a forwarded-host chain", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { baseUrl: null });
+        const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {
+            headers: {
+                "x-forwarded-host": "public.example, internal.local",
+                "x-forwarded-proto": "https, http",
+            },
+        });
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.resource).toBe("https://public.example/");
+    });
+    it("ignores the client Origin header, using Host instead", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { baseUrl: null });
+        const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {
+            headers: { origin: "https://chatgpt.com" },
+        });
+        expect(res.status).toBe(200);
+        const body = (await res.json());
+        expect(body.resource).toMatch(/^http:\/\/(localhost|127\.0\.0\.1):/);
+    });
+    it("points the 401 WWW-Authenticate at the inferred host", async () => {
+        const { jwksUri } = await startJwks();
+        const base = await bootServer(jwksUri, { baseUrl: null });
+        const res = await fetch(`${base}/mcp`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "x-forwarded-host": "infer.example.test",
+            },
+            body: JSON.stringify({ jsonrpc: "2.0", method: "initialize", id: 1 }),
+        });
+        expect(res.status).toBe(401);
+        expect(res.headers.get("www-authenticate")).toMatch(/resource_metadata="https:\/\/infer\.example\.test\//);
+    });
+});
+describe("oauth config validation", () => {
+    const validMetadata = {
+        issuer: ISSUER,
+        authorization_endpoint: `${ISSUER}/authorize`,
+        token_endpoint: `${ISSUER}/token`,
+        response_types_supported: ["code"],
+    };
+    it("throws on a non-absolute baseUrl", () => {
+        expect(() => new McpServer({ name: "t", version: "0" }, undefined, {
+            oauth: {
+                baseUrl: "not-a-url",
+                oauthMetadata: validMetadata,
+                verify: { issuer: ISSUER, audience: AUDIENCE },
+            },
+        })).toThrow(/baseUrl must be a valid absolute URL/);
+    });
+});
+//# sourceMappingURL=setup.test.js.map

package/dist/server/auth/setup.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.test.js","sourceRoot":"","sources":["../../../src/server/auth/setup.test.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAEJ,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,QAAQ,GAAG,eAAe,CAAC;AAEjC,IAAI,UAAmC,CAAC;AACxC,IAAI,SAAkC,CAAC;AACvC,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,EAAE,KAAK,EAAE,CAAC;IACpB,SAAS,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,SAAS;IACtB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG;QACV,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACpC,GAAG,EAAE,UAAU;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,KAAK;KACX,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7C,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,UAAU,GAAG,MAAM,CAAC;IACpB,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,IAAI,OAAO,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAAC,GAAc;IAC/B,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;QACtB,SAAS,EAAE,UAAU;QACrB,KAAK,EAAE,cAAc;QACrB,GAAG,EAAE,QAAQ;KACd,CAAC;SACC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;SACrD,SAAS,CAAC,MAAM,CAAC;SACjB,WAAW,CAAC,QAAQ,CAAC;SACrB,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAe,EACf,EAAE,OAAO,GAAG,0BAA0B,KAAkC,EAAE;IAE1E,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,EACvC,EAAE,YAAY,EAAE,EAAE,EAAE,EACpB;QACE,KAAK,EAAE;YACL,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,aAAa,EAAE;gBACb,MAAM,EAAE,MAAM;gBACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;gBAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;gBACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;aACnC;YACD,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE;YACvD,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;YACpC,cAAc,EAAE,CAAC,QAAQ,CAAC;SAC3B;KACF,CACF,CAAC,YAAY,CACZ;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,8BAA8B;QAC3C,WAAW,EAAE,EAAE;KAChB,EACD,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjB,iBAAiB,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,IAAI,EAAE;QACjE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,IAAI,MAAM,EAAE,CAAC;KACtE,CAAC,CACH,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,SAAS,GAAG,SAAS,CAAC;IACtB,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAC5D,OAAO,oBAAoB,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,QAAQ,CAAC,mBAAmB,EAAE,GAAG,EAAE;IACjC,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,EACtB,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAAE,CACnE,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAEhC,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC;YACpC,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,EAAE;SACd,CAAC,CAED,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEjD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,kBAAkB,EAAE,oBAAoB,EAAE;SACtD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE;gBACP,kBAAkB,EAAE,gCAAgC;gBACpD,mBAAmB,EAAE,aAAa;aACnC;SACF,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uCAAuC,EAAE;YACtE,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,oBAAoB;aACzC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;SACtE,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CACjD,qDAAqD,CACtD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,aAAa,GAAG;QACpB,MAAM,EAAE,MAAM;QACd,sBAAsB,EAAE,GAAG,MAAM,YAAY;QAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;QACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;KACnC,CAAC;IAEF,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CACJ,GAAG,EAAE,CACH,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE;YACpD,KAAK,EAAE;gBACL,OAAO,EAAE,WAAW;gBACpB,aAAa,EAAE,aAAa;gBAC5B,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;aAC/C;SACF,CAAC,CACL,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["// @vitest-environment node\nimport http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { RequestHandler } from \"express\";\nimport * as jose from \"jose\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { McpServer } from \"../server.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"../viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\nconst ISSUER = \"https://issuer.test\";\nconst AUDIENCE = \"api://default\";\n\nlet jwksServer: http.Server | undefined;\nlet appServer: http.Server | undefined;\nafterEach(() => {\n  jwksServer?.close();\n  appServer?.close();\n});\n\nasync function startJwks() {\n  const { publicKey, privateKey } = await jose.generateKeyPair(\"RS256\");\n  const jwk = {\n    ...(await jose.exportJWK(publicKey)),\n    kid: \"test-key\",\n    alg: \"RS256\",\n    use: \"sig\",\n  };\n  const server = http.createServer((_req, res) => {\n    res.setHeader(\"content-type\", \"application/json\");\n    res.end(JSON.stringify({ keys: [jwk] }));\n  });\n  await new Promise<void>((resolve) => server.listen(0, resolve));\n  jwksServer = server;\n  const port = (server.address() as { port: number }).port;\n  return { privateKey, jwksUri: `http://localhost:${port}/jwks` };\n}\n\nfunction signToken(key: CryptoKey) {\n  return new jose.SignJWT({\n    client_id: \"client-1\",\n    scope: \"openid email\",\n    sub: \"user-1\",\n  })\n    .setProtectedHeader({ alg: \"RS256\", kid: \"test-key\" })\n    .setIssuer(ISSUER)\n    .setAudience(AUDIENCE)\n    .setExpirationTime(\"1h\")\n    .sign(key);\n}\n\nasync function bootServer(\n  jwksUri: string,\n  { baseUrl = \"https://app.example.test\" }: { baseUrl?: string | null } = {},\n) {\n  const { createApp } = await import(\"../express.js\");\n  const server = new McpServer(\n    { name: \"auth-test\", version: \"0.0.0\" },\n    { capabilities: {} },\n    {\n      oauth: {\n        ...(baseUrl === null ? {} : { baseUrl }),\n        oauthMetadata: {\n          issuer: ISSUER,\n          authorization_endpoint: `${ISSUER}/authorize`,\n          token_endpoint: `${ISSUER}/token`,\n          response_types_supported: [\"code\"],\n        },\n        verify: { issuer: ISSUER, audience: AUDIENCE, jwksUri },\n        scopesSupported: [\"openid\", \"email\"],\n        requiredScopes: [\"openid\"],\n      },\n    },\n  ).registerTool(\n    {\n      name: \"whoami\",\n      description: \"Returns the caller identity.\",\n      inputSchema: {},\n    },\n    (_args, extra) => ({\n      structuredContent: { clientId: extra.authInfo?.clientId ?? null },\n      content: [{ type: \"text\", text: extra.authInfo?.clientId ?? \"anon\" }],\n    }),\n  );\n\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  appServer = listening;\n  const port = (listening.address() as { port: number }).port;\n  return `http://localhost:${port}`;\n}\n\ndescribe(\"setupOAuth wiring\", () => {\n  it(\"serves protected-resource metadata\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`);\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as {\n      resource: string;\n      authorization_servers: string[];\n      scopes_supported: string[];\n    };\n    expect(body.resource).toBe(\"https://app.example.test/\");\n    expect(body.authorization_servers).toContain(ISSUER);\n    expect(body.scopes_supported).toEqual([\"openid\", \"email\"]);\n  });\n\n  it(\"rejects /mcp without a token (401 + WWW-Authenticate)\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/json\" },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(/resource_metadata=/);\n  });\n\n  it(\"threads authInfo into the tool handler for a valid token\", async () => {\n    const { privateKey, jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri);\n    const token = await signToken(privateKey);\n\n    const client = new Client({ name: \"test-client\", version: \"0.0.0\" });\n    const transport = new StreamableHTTPClientTransport(\n      new URL(`${base}/mcp`),\n      { requestInit: { headers: { Authorization: `Bearer ${token}` } } },\n    );\n    await client.connect(transport);\n\n    const result = (await client.callTool({\n      name: \"whoami\",\n      arguments: {},\n    })) as unknown as {\n      content: { type: string; text: string }[];\n    };\n    expect(result.content[0]?.text).toBe(\"client-1\");\n\n    await client.close();\n  });\n});\n\ndescribe(\"baseUrl inferred from headers\", () => {\n  it(\"derives the resource origin from x-forwarded-host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { \"x-forwarded-host\": \"infer.example.test\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://infer.example.test/\");\n  });\n\n  it(\"uses the first hop of a forwarded-host chain\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: {\n        \"x-forwarded-host\": \"public.example, internal.local\",\n        \"x-forwarded-proto\": \"https, http\",\n      },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toBe(\"https://public.example/\");\n  });\n\n  it(\"ignores the client Origin header, using Host instead\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/.well-known/oauth-protected-resource`, {\n      headers: { origin: \"https://chatgpt.com\" },\n    });\n    expect(res.status).toBe(200);\n    const body = (await res.json()) as { resource: string };\n    expect(body.resource).toMatch(/^http:\\/\\/(localhost|127\\.0\\.0\\.1):/);\n  });\n\n  it(\"points the 401 WWW-Authenticate at the inferred host\", async () => {\n    const { jwksUri } = await startJwks();\n    const base = await bootServer(jwksUri, { baseUrl: null });\n\n    const res = await fetch(`${base}/mcp`, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n        \"x-forwarded-host\": \"infer.example.test\",\n      },\n      body: JSON.stringify({ jsonrpc: \"2.0\", method: \"initialize\", id: 1 }),\n    });\n    expect(res.status).toBe(401);\n    expect(res.headers.get(\"www-authenticate\")).toMatch(\n      /resource_metadata=\"https:\\/\\/infer\\.example\\.test\\//,\n    );\n  });\n});\n\ndescribe(\"oauth config validation\", () => {\n  const validMetadata = {\n    issuer: ISSUER,\n    authorization_endpoint: `${ISSUER}/authorize`,\n    token_endpoint: `${ISSUER}/token`,\n    response_types_supported: [\"code\"],\n  };\n\n  it(\"throws on a non-absolute baseUrl\", () => {\n    expect(\n      () =>\n        new McpServer({ name: \"t\", version: \"0\" }, undefined, {\n          oauth: {\n            baseUrl: \"not-a-url\",\n            oauthMetadata: validMetadata,\n            verify: { issuer: ISSUER, audience: AUDIENCE },\n          },\n        }),\n    ).toThrow(/baseUrl must be a valid absolute URL/);\n  });\n});\n"]}

package/dist/server/auth/verify.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthTokenVerifier } from "@modelcontextprotocol/sdk/server/auth/provider.js";
+export type JwksVerifyConfig = {
+    /** Expected `iss` claim. */
+    issuer: string;
+    /** Expected `aud` claim. Omit to skip audience verification — for IdPs that
+     * don't bind an audience to their access tokens (e.g. Clerk). */
+    audience?: string;
+    /** Defaults to `${issuer}/.well-known/jwks.json`. */
+    jwksUri?: string;
+};
+/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+export declare function createJwksVerifier(config: JwksVerifyConfig): OAuthTokenVerifier;

package/dist/server/auth/verify.js

@@ -0,0 +1,38 @@
+import { InvalidTokenError } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+import * as jose from "jose";
+/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */
+export function createJwksVerifier(config) {
+    const jwksUri = config.jwksUri ??
+        `${config.issuer.replace(/\/$/, "")}/.well-known/jwks.json`;
+    const jwks = jose.createRemoteJWKSet(new URL(jwksUri));
+    return {
+        async verifyAccessToken(token) {
+            let payload;
+            try {
+                ({ payload } = await jose.jwtVerify(token, jwks, {
+                    issuer: config.issuer,
+                    // jose skips the aud check when `audience` is undefined.
+                    ...(config.audience !== undefined && { audience: config.audience }),
+                }));
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                throw new InvalidTokenError(`Token verification failed: ${message}`);
+            }
+            const { client_id, scope, exp, sub, ...rest } = payload;
+            const scopes = Array.isArray(scope)
+                ? scope.map(String)
+                : typeof scope === "string"
+                    ? scope.split(/\s+/).filter(Boolean)
+                    : [];
+            return {
+                token,
+                clientId: client_id ?? "",
+                scopes,
+                expiresAt: exp,
+                extra: { subject: sub, ...rest },
+            };
+        },
+    };
+}
+//# sourceMappingURL=verify.js.map

package/dist/server/auth/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/server/auth/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAGpF,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAY7B,oGAAoG;AACpG,MAAM,UAAU,kBAAkB,CAChC,MAAwB;IAExB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO;QACd,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAEvD,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,KAAa;YACnC,IAAI,OAAwB,CAAC;YAC7B,IAAI,CAAC;gBACH,CAAC,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;oBAC/C,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,yDAAyD;oBACzD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;iBACpE,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,IAAI,iBAAiB,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,OAQ/C,CAAC;YAEF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACjC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACnB,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;oBACzB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACpC,CAAC,CAAC,EAAE,CAAC;YAET,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,SAAS,IAAI,EAAE;gBACzB,MAAM;gBACN,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE;aACd,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import { InvalidTokenError } from \"@modelcontextprotocol/sdk/server/auth/errors.js\";\nimport type { OAuthTokenVerifier } from \"@modelcontextprotocol/sdk/server/auth/provider.js\";\nimport type { AuthInfo } from \"@modelcontextprotocol/sdk/server/auth/types.js\";\nimport * as jose from \"jose\";\n\nexport type JwksVerifyConfig = {\n  /** Expected `iss` claim. */\n  issuer: string;\n  /** Expected `aud` claim. Omit to skip audience verification — for IdPs that\n   * don't bind an audience to their access tokens (e.g. Clerk). */\n  audience?: string;\n  /** Defaults to `${issuer}/.well-known/jwks.json`. */\n  jwksUri?: string;\n};\n\n/** Builds an `OAuthTokenVerifier` validating JWTs against a remote JWKS. Internal, not exported. */\nexport function createJwksVerifier(\n  config: JwksVerifyConfig,\n): OAuthTokenVerifier {\n  const jwksUri =\n    config.jwksUri ??\n    `${config.issuer.replace(/\\/$/, \"\")}/.well-known/jwks.json`;\n  const jwks = jose.createRemoteJWKSet(new URL(jwksUri));\n\n  return {\n    async verifyAccessToken(token: string): Promise<AuthInfo> {\n      let payload: jose.JWTPayload;\n      try {\n        ({ payload } = await jose.jwtVerify(token, jwks, {\n          issuer: config.issuer,\n          // jose skips the aud check when `audience` is undefined.\n          ...(config.audience !== undefined && { audience: config.audience }),\n        }));\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        throw new InvalidTokenError(`Token verification failed: ${message}`);\n      }\n\n      const { client_id, scope, exp, sub, ...rest } = payload as Record<\n        string,\n        unknown\n      > & {\n        client_id?: string;\n        scope?: string | string[];\n        exp?: number;\n        sub?: string;\n      };\n\n      const scopes = Array.isArray(scope)\n        ? scope.map(String)\n        : typeof scope === \"string\"\n          ? scope.split(/\\s+/).filter(Boolean)\n          : [];\n\n      return {\n        token,\n        clientId: client_id ?? \"\",\n        scopes,\n        expiresAt: exp,\n        extra: { subject: sub, ...rest },\n      } satisfies AuthInfo;\n    },\n  };\n}\n"]}

package/dist/server/auth/verify.test.d.ts

@@ -0,0 +1 @@
+export {};