{"version":3,"file":"index.mjs","names":["#handler","#metadata","#authorize","#anonymous","getOAuthProtectedResourceMetadataUrl","requireBearerAuth","oauthMetadataResponse"],"sources":["../../src/auth/mcp-resource-server.ts"],"sourcesContent":["import {\n\tgetOAuthProtectedResourceMetadataUrl,\n\toauthMetadataResponse,\n\trequireBearerAuth,\n} from \"@modelcontextprotocol/server\";\nimport type {\n\tAuthInfo,\n\tAuthMetadataOptions,\n\tBearerAuthOptions,\n\tMcpHandlerRequestOptions,\n\tServerEventBus,\n\tServerNotifier,\n} from \"@modelcontextprotocol/server\";\n\nexport interface McpFetchHandler {\n\tfetch(request: Request, options?: McpHandlerRequestOptions): Promise<Response>;\n\tclose(): Promise<void>;\n\treadonly notify: ServerNotifier;\n\treadonly bus: ServerEventBus;\n}\n\nexport interface McpResourceServerOptions {\n\treadonly bearerAuth: BearerAuthOptions;\n\treadonly metadata?: AuthMetadataOptions;\n\t/**\n\t * Fail-closed anonymous fallback. When bearer verification refuses a\n\t * request, this policy is consulted with the raw request; returning an\n\t * `AuthInfo` admits the request under that identity, and returning\n\t * `undefined` keeps the original `401`/`403`. Absent, every request must\n\t * carry a valid bearer token. Metadata (well-known) responses bypass it.\n\t */\n\treadonly anonymous?: (request: Request) => AuthInfo | undefined | Promise<AuthInfo | undefined>;\n}\n\n/**\n * OAuth resource-server facade around an MCP HTTP handler.\n *\n * It serves RFC 9728/RFC 8414 discovery when configured, validates bearer tokens before MCP\n * dispatch, and passes the resulting `AuthInfo` into the official handler context.\n */\nexport class McpResourceServer implements McpFetchHandler {\n\treadonly notify: ServerNotifier;\n\treadonly bus: ServerEventBus;\n\n\treadonly #handler: McpFetchHandler;\n\treadonly #metadata: AuthMetadataOptions | undefined;\n\treadonly #authorize: ReturnType<typeof requireBearerAuth>;\n\treadonly #anonymous: McpResourceServerOptions[\"anonymous\"];\n\n\tconstructor(handler: McpFetchHandler, options: McpResourceServerOptions) {\n\t\tthis.#handler = handler;\n\t\tthis.#metadata = options.metadata;\n\t\tthis.#anonymous = options.anonymous;\n\t\tconst resourceMetadataUrl =\n\t\t\toptions.bearerAuth.resourceMetadataUrl ??\n\t\t\t(options.metadata === undefined\n\t\t\t\t? undefined\n\t\t\t\t: getOAuthProtectedResourceMetadataUrl(options.metadata.resourceServerUrl));\n\t\tthis.#authorize = requireBearerAuth({\n\t\t\t...options.bearerAuth,\n\t\t\t...(resourceMetadataUrl === undefined ? {} : { resourceMetadataUrl }),\n\t\t});\n\t\tthis.notify = handler.notify;\n\t\tthis.bus = handler.bus;\n\t}\n\n\tasync fetch(request: Request, options?: McpHandlerRequestOptions): Promise<Response> {\n\t\tconst metadataResponse =\n\t\t\tthis.#metadata === undefined ? undefined : oauthMetadataResponse(request, this.#metadata);\n\t\tif (metadataResponse !== undefined) return metadataResponse;\n\n\t\tconst authorization = await this.#authorize(request);\n\t\tif (authorization instanceof Response) {\n\t\t\tif (this.#anonymous === undefined) return authorization;\n\t\t\tconst anonymous = await this.#anonymous(request);\n\t\t\tif (anonymous === undefined) return authorization;\n\t\t\treturn this.#handler.fetch(request, { ...options, authInfo: anonymous });\n\t\t}\n\t\treturn this.#handler.fetch(request, { ...options, authInfo: authorization });\n\t}\n\n\tclose(): Promise<void> {\n\t\treturn this.#handler.close();\n\t}\n}\n"],"mappings":";;;;;;;;AAwCA,IAAa,oBAAb,MAA0D;CACzD;CACA;CAEA;CACA;CACA;CACA;CAEA,YAAY,SAA0B,SAAmC;EACxE,KAAKA,WAAW;EAChB,KAAKC,YAAY,QAAQ;EACzB,KAAKE,aAAa,QAAQ;EAC1B,MAAM,sBACL,QAAQ,WAAW,wBAClB,QAAQ,aAAa,KAAA,IACnB,KAAA,IACAC,uCAAqC,QAAQ,SAAS,iBAAiB;EAC3E,KAAKF,aAAaG,oBAAkB;GACnC,GAAG,QAAQ;GACX,GAAI,wBAAwB,KAAA,IAAY,CAAC,IAAI,EAAE,oBAAoB;EACpE,CAAC;EACD,KAAK,SAAS,QAAQ;EACtB,KAAK,MAAM,QAAQ;CACpB;CAEA,MAAM,MAAM,SAAkB,SAAuD;EACpF,MAAM,mBACL,KAAKJ,cAAc,KAAA,IAAY,KAAA,IAAYK,wBAAsB,SAAS,KAAKL,SAAS;EACzF,IAAI,qBAAqB,KAAA,GAAW,OAAO;EAE3C,MAAM,gBAAgB,MAAM,KAAKC,WAAW,OAAO;EACnD,IAAI,yBAAyB,UAAU;GACtC,IAAI,KAAKC,eAAe,KAAA,GAAW,OAAO;GAC1C,MAAM,YAAY,MAAM,KAAKA,WAAW,OAAO;GAC/C,IAAI,cAAc,KAAA,GAAW,OAAO;GACpC,OAAO,KAAKH,SAAS,MAAM,SAAS;IAAE,GAAG;IAAS,UAAU;GAAU,CAAC;EACxE;EACA,OAAO,KAAKA,SAAS,MAAM,SAAS;GAAE,GAAG;GAAS,UAAU;EAAc,CAAC;CAC5E;CAEA,QAAuB;EACtB,OAAO,KAAKA,SAAS,MAAM;CAC5B;AACD"}