Authorizing...

Authorizing... Click here if not redirected

\n\n`;\n\n return new Response(html, {\n status: 200,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n // Explicitly allow all form actions including claude:// scheme\n \"Content-Security-Policy\":\n \"default-src 'self' 'unsafe-inline'; form-action *; frame-ancestors 'none';\",\n ...corsHeaders(),\n },\n });\n}\n\nasync function handleToken(req) {\n // Parse the form-encoded body\n let bodyText = \"\";\n try {\n bodyText = await req.text();\n console.log(\"TOKEN request body:\", bodyText.slice(0, 500));\n } catch (e) {\n console.log(\"TOKEN: could not read body:\", e.message);\n }\n\n const params = new URLSearchParams(bodyText);\n console.log(\n \"TOKEN grant_type:\",\n params.get(\"grant_type\"),\n \"client_id:\",\n params.get(\"client_id\"),\n );\n\n // Validate client credentials\n if (!validateClient(params)) {\n console.log(\"TOKEN: invalid client credentials\");\n return corsJson({ error: \"invalid_client\" }, 401);\n }\n\n // Issue a bearer token\n const token = \"wc_token_\" + crypto.randomUUID().replace(/-/g, \"\");\n const response = {\n access_token: token,\n token_type: \"Bearer\",\n expires_in: 86400,\n scope: \"read write\",\n refresh_token: \"wc_refresh_\" + crypto.randomUUID().replace(/-/g, \"\"),\n };\n console.log(\"TOKEN response:\", JSON.stringify(response));\n return corsJson(response);\n}\n\n// ── HTTP Router ──\n\nexport default async function (req) {\n const url = new URL(req.url);\n const path = url.pathname;\n\n // Log EVERY request for debugging\n console.log(\n `${req.method} ${path} ${url.search ? url.search.slice(0, 80) : \"\"}`,\n );\n\n // CORS preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders() });\n }\n\n // Force .well-known to 404 — prevents Claude.ai from entering OAuth flow\n if (path.startsWith(\"/.well-known/\")) {\n console.log(\"BLOCKED .well-known:\", path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // MCP endpoint — no auth required\n if (path === \"/mcp\" && req.method === \"POST\") {\n return handleMcp(req);\n }\n\n // OAuth endpoints DISABLED — Claude.ai falls back to these default paths\n // even when .well-known returns 404, triggering a broken OAuth flow.\n // Return 404 to force Claude to use the unauthenticated connection.\n if (\n (path === \"/register\" || path === \"/authorize\" || path === \"/token\") &&\n !url.searchParams.has(\"force_oauth\")\n ) {\n console.log(\"BLOCKED OAuth fallback:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n }\n\n // Seed endpoint (no auth required — called by build.sh)\n if (path === \"/seed\" && req.method === \"POST\") {\n return handleSeed(req);\n }\n\n // Health check\n if (path === \"/\" && req.method === \"GET\") {\n return corsJson({\n name: SERVER_INFO.name,\n version: SERVER_INFO.version,\n status: \"ok\",\n tools: TOOLS.length,\n endpoint: \"/mcp\",\n });\n }\n\n console.log(\"404 UNMATCHED:\", req.method, path);\n return new Response(\"Not found\", { status: 404, headers: corsHeaders() });\n}\n\n// ── Helpers ──\n\nfunction corsHeaders() {\n return {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS, DELETE\",\n \"Access-Control-Allow-Headers\":\n \"Content-Type, Authorization, Accept, Mcp-Session-Id\",\n \"Access-Control-Expose-Headers\": \"Mcp-Session-Id\",\n };\n}\n\nfunction corsJson(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...corsHeaders(),\n },\n });\n}\n\nfunction escapeHtml(str) {\n return str.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction slugify(text) {\n return text\n .toLowerCase()\n .replace(/[^\\w\\s-]/g, \"\")\n .replace(/\\s+/g, \"-\")\n .replace(/-+/g, \"-\")\n .replace(/^-|-$/g, \"\");\n}","deleted","label",[100],"permalink","https://www.val.town/x/nicholasab/woods-castle-mcp/code/main.ts","extension","actionData","errors"]