Authorization

import type { AuthInfo, AuthFunction, OAuthProtectedResourceConfig } from 'sunpeak/mcp';

export const oauth: OAuthProtectedResourceConfig = {
  resource: 'https://mcp.example.com/mcp',
  authorizationServers: ['https://auth.example.com'],
  scopesSupported: ['profile:read', 'files:write'],
  resourceName: 'Example MCP server',
};

export const auth: AuthFunction = async (req) => {
  const token = req.headers.authorization?.replace(/^Bearer\s+/i, '');
  if (!token) return null;

  const claims = await verifyAccessToken(token);
  if (!claims) {
    return {
      authorized: false,
      error: 'invalid_token',
      errorDescription: 'The access token is invalid or expired',
    };
  }

  return {
    token,
    clientId: claims.clientId,
    scopes: claims.scopes,
  } satisfies AuthInfo;
};

/.well-known/oauth-protected-resource/mcp
/.well-known/oauth-protected-resource

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/mcp", scope="profile:read files:write"

import type { AuthFunction } from 'sunpeak/mcp';

export const auth: AuthFunction = async (req, context) => {
  const token = req.headers.authorization?.replace(/^Bearer\s+/i, '');
  if (!token) return null;

  const claims = await verifyAccessToken(token);
  if (!claims) {
    return { authorized: false, error: 'invalid_token' };
  }

  const body = context.body as { method?: string; params?: { name?: string } } | undefined;
  const isWrite = body?.method === 'tools/call' && body.params?.name === 'save-file';

  if (isWrite && !claims.scopes.includes('files:write')) {
    return {
      authorized: false,
      error: 'insufficient_scope',
      scopes: ['profile:read', 'files:write'],
    };
  }

  return { token, clientId: claims.clientId, scopes: claims.scopes };
};

import { createMcpHandler } from 'sunpeak/mcp';

export const handler = createMcpHandler({
  tools,
  resources,
  serverUrl: 'https://mcp.example.com/mcp',
  oauth,
  auth,
});

import { createHandler } from 'sunpeak/mcp';

export const handler = createHandler({
  tools,
  resources,
  serverUrl: 'https://mcp.example.com/mcp',
  oauth,
  auth,
  stateless: true,
});