${serverType}

${config.name}

\n\n

Configuration

\n \n ${configDetails}\n

\n\n

Available Endpoints

\n ${config.type === \"resource\" ? `\n

GET /health

GET ${config.metadataPath || '/.well-known/oauth-protected-resource'}

POST /mcp (requires Bearer token)

\n \n

\n ` : `\n

GET /health

GET /.well-known/openid-configuration

GET /authorize

POST /token

\n \n

\n `}\n

\n\n \n

\n\n

\n Note: This is an MCP OAuth example server for testing and development purposes.\n ${config.type === \"resource\"\n ? `Access to the /mcp endpoint requires a valid Bearer token: ${config.fixedAccessToken}`\n : `This server uses fixed test credentials for demonstration purposes.`\n }\n

\n \n\n`;\n}\n\nfunction createResourceServer(config: ServerConfig) {\n const app = new Hono();\n\n // CORS middleware - apply to all routes\n app.use(\"*\", async (c, next) => {\n // Handle preflight requests\n if (c.req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization, mcp-protocol-version\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n // Add CORS headers to all responses\n await next();\n\n // Add CORS headers after the response is generated\n c.header(\"Access-Control-Allow-Origin\", \"*\");\n c.header(\"Access-Control-Allow-Methods\", \"GET, POST, OPTIONS\");\n c.header(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization\");\n\n // If WWW-Authenticate header is present, expose it\n if (c.res.headers.get(\"WWW-Authenticate\")) {\n c.header(\"Access-Control-Expose-Headers\", \"WWW-Authenticate\");\n }\n });\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // Health check endpoint\n app.get(\"/health\", (c) => c.json({ status: \"ok\", server: config.name }));\n\n // OAuth Protected Resource metadata endpoint\n app.get(config.metadataPath!, (c) => {\n const resourceUrl = `https://${c.req.header(\"host\")}/mcp`;\n const authServers = config.tenantPath\n ? [`${config.authServerUrl}${config.tenantPath}`]\n : [config.authServerUrl!];\n\n return c.json({\n resource: resourceUrl,\n authorization_servers: authServers,\n });\n });\n\n // MCP endpoint with auth\n app.post(\"/mcp\", async (c) => {\n // Check for bearer token\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n const resourceMetadataUrl = `https://${c.req.header(\"host\")}${config.metadataPath}`;\n\n const responseHeaders: Record = {};\n\n // Only include WWW-Authenticate header if configured\n if (config.includeWwwAuthenticate !== false) {\n responseHeaders[\"WWW-Authenticate\"] = `Bearer resource_metadata=\"${resourceMetadataUrl}\"`;\n }\n\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Authentication required\",\n },\n id: null,\n }, {\n status: 401,\n headers: responseHeaders,\n });\n }\n\n const token = authHeader.substring(7);\n if (token !== config.fixedAccessToken) {\n return c.json({\n jsonrpc: \"2.0\",\n error: {\n code: -32001,\n message: \"Invalid token\",\n },\n id: null,\n }, { status: 401 });\n }\n\n // Handle MCP request\n const { req, res } = toReqRes(c.req.raw);\n const server = createMcpServer(config);\n\n try {\n const transport = new StreamableHTTPServerTransport({\n sessionIdGenerator: undefined,\n });\n\n transport.onerror = console.error.bind(console);\n\n await server.connect(transport);\n\n const body = await c.req.json();\n\n await transport.handleRequest(req, res, body);\n\n console.log(`${new Date().toISOString()} MCP request handled`);\n\n res.on(\"close\", () => {\n console.log(`${new Date().toISOString()} Request closed`);\n transport.close();\n server.close();\n });\n\n return toFetchResponse(res);\n } catch (error) {\n console.error(\"Error handling MCP request:\", error);\n\n try {\n server.close();\n } catch (cleanupError) {\n console.error(\"Error during cleanup:\", cleanupError);\n }\n return c.json(\n {\n jsonrpc: \"2.0\",\n error: {\n code: -32603,\n message: \"Internal server error\",\n },\n id: null,\n },\n { status: 500 },\n );\n }\n });\n\n return app;\n}\n\nfunction createAuthServer(config: ServerConfig) {\n const app = new Hono();\n\n // Root index page\n app.get(\"/\", (c) => c.html(generateIndexHtml(config)));\n\n // OAuth Authorization Server Metadata endpoint\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n\n app.get(metadataPath, (c) => {\n const baseUrl = `https://${c.req.header(\"host\")}`;\n const issuer = config.issuer || (config.tenantPath ? `${baseUrl}${config.tenantPath}` : baseUrl);\n\n const metadata = {\n issuer: issuer,\n authorization_endpoint: `${baseUrl}/authorize`,\n token_endpoint: `${baseUrl}/token`,\n registration_endpoint: `${baseUrl}/register`,\n jwks_uri: `${baseUrl}/jwks`,\n response_types_supported: [\"code\"],\n subject_types_supported: [\"public\"],\n id_token_signing_alg_values_supported: [\"RS256\"],\n scopes_supported: [\"openid\", \"profile\", \"email\", \"offline_access\"],\n token_endpoint_auth_methods_supported: [\"client_secret_basic\", \"client_secret_post\"],\n claims_supported: [\"sub\", \"name\", \"email\"],\n code_challenge_methods_supported: [\"plain\", \"S256\"],\n grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n response_modes_supported: [\"query\", \"fragment\"],\n authorization_response_iss_parameter_supported: true,\n backchannel_logout_supported: false,\n frontchannel_logout_supported: false,\n end_session_endpoint: `${baseUrl}/logout`,\n request_parameter_supported: false,\n request_uri_parameter_supported: false,\n };\n\n return c.json(metadata);\n });\n\n // Mock authorization endpoint\n app.get(\"/authorize\", (c) => {\n const redirectUri = c.req.query(\"redirect_uri\");\n const state = c.req.query(\"state\");\n const codeChallenge = c.req.query(\"code_challenge\");\n const codeChallengeMethod = c.req.query(\"code_challenge_method\");\n const resource = c.req.query(\"resource\");\n\n if (!redirectUri) {\n return c.text(\"redirect_uri is required\", 400);\n }\n\n console.log(`RESORUCe ${resource}`)\n if (!resource) {\n return c.text(\"resource is required\", 400);\n }\n\n // Store code challenge for PKCE validation (in real impl, store in DB)\n console.log(\"PKCE:\", { codeChallenge, codeChallengeMethod });\n\n // In real implementation, show login/consent screen\n // For testing, immediately redirect with code\n const code = config.fixedAuthCode || \"test_auth_code_123\";\n const params = new URLSearchParams({\n code,\n ...(state && { state }),\n });\n\n const authorizeRedirectUrl = `${redirectUri}?${params}`;\n return c.redirect(authorizeRedirectUrl);\n });\n\n // Mock token endpoint\n app.post(\"/token\", async (c) => {\n const contentType = c.req.header(\"Content-Type\");\n let grantType, code, refreshToken, codeVerifier, resource;\n\n if (contentType?.includes(\"application/x-www-form-urlencoded\")) {\n const body = await c.req.text();\n const params = new URLSearchParams(body);\n grantType = params.get(\"grant_type\");\n code = params.get(\"code\");\n refreshToken = params.get(\"refresh_token\");\n codeVerifier = params.get(\"code_verifier\");\n resource = params.get(\"resource\");\n } else {\n const body = await c.req.json();\n grantType = body.grant_type;\n code = body.code;\n refreshToken = body.refresh_token;\n codeVerifier = body.code_verifier;\n resource = body.resource;\n }\n\n if (!resource) {\n return c.json({ error: \"invalid_request\", error_description: \"resource is required\" }, 400);\n }\n\n // Validate PKCE if provided\n if (codeVerifier) {\n console.log(\"PKCE verification:\", { codeVerifier });\n // In real impl, verify against stored code_challenge\n }\n\n if (grantType === \"authorization_code\") {\n if (code !== (config.fixedAuthCode || \"test_auth_code_123\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n } else if (grantType === \"refresh_token\") {\n if (refreshToken !== (config.fixedRefreshToken || \"test_refresh_token_xyz\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n\n return c.json({\n access_token: config.fixedAccessToken,\n token_type: \"Bearer\",\n expires_in: 3600,\n refresh_token: config.fixedRefreshToken || \"test_refresh_token_xyz\",\n scope: \"openid profile email\",\n });\n }\n\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n });\n\n // Mock JWKS endpoint\n app.get(\"/jwks\", (c) => {\n return c.json({\n keys: [\n {\n kty: \"RSA\",\n use: \"sig\",\n kid: \"test-key-1\",\n alg: \"RS256\",\n n: \"xGOr-H7A-PWG\",\n e: \"AQAB\",\n },\n ],\n });\n });\n\n // Mock client registration endpoint\n app.post(\"/register\", async (c) => {\n const body = await c.req.json();\n\n return c.json({\n client_id: config.fixedClientId || \"test_client_id\",\n client_secret: \"test_client_secret\",\n client_id_issued_at: Math.floor(Date.now() / 1000),\n client_secret_expires_at: 0,\n redirect_uris: body.redirect_uris || [],\n token_endpoint_auth_method: \"client_secret_basic\",\n grant_types: [\"authorization_code\", \"refresh_token\"],\n response_types: [\"code\"],\n client_name: body.client_name || \"Test Client\",\n scope: body.scope || \"openid profile email\",\n });\n });\n\n // Mock logout endpoint\n app.get(\"/logout\", (c) => {\n return c.text(\"Logged out successfully\");\n });\n\n // Health check\n app.get(\"/health\", (c) => {\n return c.json({ status: \"ok\", server: config.name });\n });\n\n return app;\n}\n\nexport function createServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n return app.fetch;\n}\n\nexport function startServer(config: ServerConfig) {\n const app = config.type === \"resource\"\n ? createResourceServer(config)\n : createAuthServer(config);\n\n const port = config.type === \"resource\" ? 3000 : 3001\n\n const serverType = config.type === \"resource\" ? \"Resource\" : \"Auth\";\n console.log(`${serverType} Server (${config.name}) running at http://localhost:${port}`);\n\n if (config.type === \"resource\") {\n console.log(\"\\nEndpoints:\");\n console.log(` MCP: http://localhost:${port}/mcp`);\n console.log(` Metadata: http://localhost:${port}${config.metadataPath}`);\n console.log(` Health: http://localhost:${port}/health`);\n if (config.authServerUrl) {\n console.log(` Auth Server: ${config.authServerUrl}`);\n }\n } else {\n const metadataPath = config.tenantPath\n ? `/.well-known/oauth-authorization-server${config.tenantPath}`\n : \"/.well-known/oauth-authorization-server\";\n console.log(\"\\nEndpoints:\");\n console.log(` Metadata: http://localhost:${port}${metadataPath}`);\n console.log(` Authorize: http://localhost:${port}/authorize`);\n console.log(` Token: http://localhost:${port}/token`);\n console.log(` Health: http://localhost:${port}/health`);\n }\n\n Deno.serve({ port, hostname: \"127.0.0.1\" }, app.fetch);\n}","deleted","label",[99],"permalink","https://www.val.town/x/pcarleton/mcp-oauth-as1/code/mcp-server.ts","extension","ts","actionData","errors"]