46 lines
1.5 KiB
JavaScript
46 lines
1.5 KiB
JavaScript
import { validateMcpToken } from "./mcpTokens.js";
|
|
|
|
const sendJson = (res, status, payload) => {
|
|
res.status(status)
|
|
.setHeader("Content-Type", "application/json")
|
|
.end(JSON.stringify(payload));
|
|
};
|
|
|
|
export function createMcpAuthMiddleware({ validateToken = validateMcpToken } = {}) {
|
|
return async (req, res, next) => {
|
|
if (req.path !== "/mcp" && !req.path?.startsWith("/mcp/")) {
|
|
return next();
|
|
}
|
|
|
|
// Client-provided identity is never trusted on the public MCP transport.
|
|
delete req.headers["x-acai-user"];
|
|
|
|
const secret = req.headers["x-mcp-secret"];
|
|
if (!secret) {
|
|
return sendJson(res, 401, { error: "X-MCP-Secret header required" });
|
|
}
|
|
|
|
try {
|
|
const auth = await validateToken(secret);
|
|
if (!auth?.user) {
|
|
return sendJson(res, 401, { error: "Invalid MCP token" });
|
|
}
|
|
|
|
req.headers["x-acai-user"] = auth.user;
|
|
if (auth.project) {
|
|
req.headers["x-project-name"] = auth.project;
|
|
} else if (!req.headers["x-project-name"]) {
|
|
return sendJson(res, 400, {
|
|
error: "X-Project-Name header required for user-wide token",
|
|
});
|
|
}
|
|
|
|
req.mcpAuth = auth;
|
|
return next();
|
|
} catch (error) {
|
|
console.error("[MCP auth] token validation failed:", error.message);
|
|
return sendJson(res, 401, { error: "Invalid MCP token" });
|
|
}
|
|
};
|
|
}
|