import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi";import { Schema } from "effect";import { createSchema, createYoga } from "graphql-yoga";import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";import z from "zod"; type ClientRecord = { readonly clientSecret: string | null; readonly redirectUris: ReadonlySet<string>;}; type AuthorizationTransaction = { readonly clientId: string; readonly redirectUri: string; readonly state: string; readonly codeChallenge: string; readonly scope: string | null;}; type AuthorizationCode = AuthorizationTransaction & { readonly username: string;}; const clients = new Map<string, ClientRecord>([ ["test-client", { clientSecret: "test-secret", redirectUris: new Set() }],]);const transactions = new Map<string, AuthorizationTransaction>();const authorizationCodes = new Map<string, AuthorizationCode>();const issuedAccessTokens = new Set<string>(); const json = (body: unknown, init?: ResponseInit) => new Response(JSON.stringify(body), { ...init, headers: { "content-type": "application/json", ...init?.headers }, }); const text = (body: string, init?: ResponseInit) => new Response(body, { ...init, headers: { "content-type": "text/plain; charset=utf-8", ...init?.headers }, }); const redirect = (location: string) => new Response(null, { status: 302, headers: { location } }); const decodeBasic = ( header: string | null,): { readonly username: string; readonly password: string } | null => { if (!header?.startsWith("Basic ")) return null; const decoded = atob(header.slice("Basic ".length)); const separator = decoded.indexOf(":"); if (separator < 0) return null; return { username: decoded.slice(0, separator), password: decoded.slice(separator + 1) };}; const base64url = (buffer: ArrayBuffer): string => { const bytes = new Uint8Array(buffer); let binary = ""; for (const byte of bytes) binary += String.fromCharCode(byte); return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");}; const codeChallengeForVerifier = async (verifier: string): Promise<string> => base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))); const bearerToken = (request: Request): string | null => { const header = request.headers.get("authorization"); return header?.replace(/^Bearer\s+/i, "") ?? null;}; const isAuthorized = (request: Request): boolean => { const token = bearerToken(request); return token ? issuedAccessTokens.has(token) : false;}; const unauthorized = (request: Request) => { const url = new URL(request.url); return json( { error: "invalid_token" }, { status: 401, headers: { "www-authenticate": `Bearer resource_metadata="${url.origin}/.well-known/oauth-protected-resource${url.pathname}", error="invalid_token"`, }, }, );}; const oauthMetadata = (request: Request) => { const url = new URL(request.url); return json({ issuer: url.origin, authorization_endpoint: `${url.origin}/authorize`, token_endpoint: `${url.origin}/token`, registration_endpoint: `${url.origin}/register`, response_types_supported: ["code"], grant_types_supported: ["authorization_code"], code_challenge_methods_supported: ["S256"], token_endpoint_auth_methods_supported: ["none", "client_secret_post", "client_secret_basic"], scopes_supported: ["read", "write"], });}; const protectedResourceMetadata = (request: Request) => { const url = new URL(request.url); const suffix = url.pathname.slice("/.well-known/oauth-protected-resource".length); return json({ resource: `${url.origin}${suffix}`, authorization_servers: [url.origin], bearer_methods_supported: ["header"], scopes_supported: ["read", "write"], });}; const handleRegister = async (request: Request) => { const body = (await request.json()) as { readonly redirect_uris?: readonly string[]; readonly token_endpoint_auth_method?: string; }; const clientId = `client_${crypto.randomUUID()}`; const authMethod = body.token_endpoint_auth_method ?? "none"; const clientSecret = authMethod === "none" ? null : `secret_${crypto.randomUUID()}`; clients.set(clientId, { clientSecret, redirectUris: new Set(body.redirect_uris ?? []), }); return json( { client_id: clientId, ...(clientSecret ? { client_secret: clientSecret } : {}), token_endpoint_auth_method: authMethod, redirect_uris: body.redirect_uris ?? [], grant_types: ["authorization_code"], response_types: ["code"], scope: "read write", }, { status: 201, headers: { "cache-control": "no-store" } }, );}; const handleAuthorize = (request: Request) => { const url = new URL(request.url); const clientId = url.searchParams.get("client_id"); const redirectUri = url.searchParams.get("redirect_uri"); const state = url.searchParams.get("state"); const codeChallenge = url.searchParams.get("code_challenge"); if (!clientId || !redirectUri || !state || !codeChallenge) { return json({ error: "invalid_request" }, { status: 400 }); } const client = clients.get(clientId); if (client?.redirectUris.size && !client.redirectUris.has(redirectUri)) { return json( { error: "invalid_request", error_description: "redirect_uri is not registered" }, { status: 400 }, ); } if (!client) { clients.set(clientId, { clientSecret: null, redirectUris: new Set([redirectUri]) }); } const transaction = `txn_${crypto.randomUUID()}`; transactions.set(transaction, { clientId, redirectUri, state, codeChallenge, scope: url.searchParams.get("scope"), }); return redirect(`${url.origin}/login?transaction=${encodeURIComponent(transaction)}`);}; const handleLogin = async (request: Request) => { const url = new URL(request.url); const transactionId = url.searchParams.get("transaction"); const transaction = transactionId ? transactions.get(transactionId) : undefined; if (!transactionId || !transaction) return json({ error: "invalid_request" }, { status: 400 }); if (request.method === "GET") return text("OAuth test login"); const basic = decodeBasic(request.headers.get("authorization")); if (!basic || basic.username !== "alice" || basic.password !== "password") { return json( { error: "access_denied" }, { status: 401, headers: { "www-authenticate": 'Basic realm="Executor test servers"' } }, ); } const code = `code_${crypto.randomUUID()}`; transactions.delete(transactionId); authorizationCodes.set(code, { ...transaction, username: basic.username }); const callback = new URL(transaction.redirectUri); callback.searchParams.set("code", code); callback.searchParams.set("state", transaction.state); return redirect(callback.toString());}; const handleToken = async (request: Request) => { const params = new URLSearchParams(await request.text()); const basic = decodeBasic(request.headers.get("authorization")); const clientId = basic?.username ?? params.get("client_id"); const clientSecret = basic?.password ?? params.get("client_secret"); const client = clientId ? clients.get(clientId) : undefined; if (!clientId || !client) return json({ error: "invalid_client" }, { status: 401 }); if (client.clientSecret !== null && client.clientSecret !== clientSecret) { return json({ error: "invalid_client" }, { status: 401 }); } const code = params.get("code"); const redirectUri = params.get("redirect_uri"); const verifier = params.get("code_verifier"); const record = code ? authorizationCodes.get(code) : undefined; if (!code || !redirectUri || !verifier || !record) { return json({ error: "invalid_grant" }, { status: 400 }); } if ( record.clientId !== clientId || record.redirectUri !== redirectUri || record.codeChallenge !== (await codeChallengeForVerifier(verifier)) ) { return json({ error: "invalid_grant" }, { status: 400 }); } authorizationCodes.delete(code); const accessToken = `at_${crypto.randomUUID()}`; const refreshToken = `rt_${crypto.randomUUID()}`; issuedAccessTokens.add(accessToken); return json( { access_token: accessToken, refresh_token: refreshToken, token_type: "Bearer", expires_in: 3600, ...(record.scope ? { scope: record.scope } : {}), }, { headers: { "cache-control": "no-store" } }, );}; const OpenApiEchoItem = Schema.Struct({ id: Schema.Number, name: Schema.String });const OpenApiEchoItemsGroup = HttpApiGroup.make("items").add( HttpApiEndpoint.get("listItems", "/items", { success: Schema.Array(OpenApiEchoItem) }),);const OpenApiEchoApi = HttpApi.make("executorOpenApiWorkerTest") .add(OpenApiEchoItemsGroup) .annotateMerge( OpenApi.annotations({ title: "Executor Worker OpenAPI Test Server", version: "1.0.0" }), ); const openApiSpec = (request: Request) => { const url = new URL(request.url); const apiBaseUrl = `${url.origin}/openapi`; const spec = OpenApi.fromApi( (OpenApiEchoApi as HttpApi.AnyWithProps).annotateMerge( OpenApi.annotations({ servers: [{ url: apiBaseUrl }], transform: (source) => ({ ...source, components: { ...(typeof source.components === "object" && source.components !== null ? source.components : {}), securitySchemes: { oauth2: { type: "oauth2", flows: { authorizationCode: { authorizationUrl: `${url.origin}/authorize`, tokenUrl: `${url.origin}/token`, scopes: { read: "Read test resources" }, }, }, }, }, }, security: [{ oauth2: ["read"] }], }), }), ), ); return json(spec);}; const handleOpenApi = (request: Request) => { const url = new URL(request.url); if (url.pathname === "/openapi/spec.json") return openApiSpec(request); if (!isAuthorized(request)) return unauthorized(request); if (url.pathname === "/openapi/items") { return json([ { id: 1, name: "Widget" }, { id: 2, name: "Gadget" }, ]); } return json({ error: "not_found" }, { status: 404 });}; const yoga = createYoga({ schema: createSchema({ typeDefs: /* GraphQL */ ` type Query { hello(name: String): String } type Mutation { setGreeting(message: String!): String } `, resolvers: { Query: { hello: (_source: unknown, args: { readonly name?: string }) => `Hello ${args.name ?? "world"}`, }, Mutation: { setGreeting: (_source: unknown, args: { readonly message: string }) => args.message, }, }, }), graphqlEndpoint: "/graphql", graphiql: false, logging: false, maskedErrors: false,}); const handleGraphql = (request: Request) => isAuthorized(request) ? yoga.handle(request, {}) : unauthorized(request); const createMcpServer = () => { const server = new McpServer( { name: "executor-worker-mcp-test", version: "1.0.0" }, { capabilities: {} }, ); server.registerTool( "hello", { description: "Greets a person", inputSchema: { name: z.string() } }, async ({ name }: { readonly name: string }) => ({ content: [{ type: "text" as const, text: `Hello ${name}` }], }), ); return server;}; const mcpTransports = new Map<string, WebStandardStreamableHTTPServerTransport>(); const handleMcp = async (request: Request) => { if (!isAuthorized(request)) return unauthorized(request); const sessionId = request.headers.get("mcp-session-id") ?? undefined; const existing = sessionId ? mcpTransports.get(sessionId) : undefined; if (sessionId && !existing) return text("Session not found", { status: 404 }); if (existing) return existing.handleRequest(request); const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: () => crypto.randomUUID(), onsessioninitialized: (sid) => { mcpTransports.set(sid, transport); }, }); await createMcpServer().connect(transport); return transport.handleRequest(request);}; const handleRequest = async (request: Request): Promise<Response> => { const url = new URL(request.url); if (url.pathname === "/health") return json({ ok: true }); if ( url.pathname === "/.well-known/oauth-authorization-server" || url.pathname === "/.well-known/openid-configuration" ) { return oauthMetadata(request); } if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) { return protectedResourceMetadata(request); } if (url.pathname === "/register" && request.method === "POST") return handleRegister(request); if (url.pathname === "/authorize" && request.method === "GET") return handleAuthorize(request); if (url.pathname === "/login") return handleLogin(request); if (url.pathname === "/token" && request.method === "POST") return handleToken(request); if (url.pathname.startsWith("/openapi/")) return handleOpenApi(request); if (url.pathname === "/graphql") return handleGraphql(request); if (url.pathname === "/mcp") return handleMcp(request); return json({ error: "not_found" }, { status: 404 });}; export default { fetch: handleRequest,};
import { HttpApi, HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi";
import { Schema } from "effect";
import { createSchema, createYoga } from "graphql-yoga";
import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
import z from "zod";
type ClientRecord = {
readonly clientSecret: string | null;
readonly redirectUris: ReadonlySet<string>;
};
type AuthorizationTransaction = {
readonly clientId: string;
readonly redirectUri: string;
readonly state: string;
readonly codeChallenge: string;
readonly scope: string | null;
};
type AuthorizationCode = AuthorizationTransaction & {
readonly username: string;
};
const clients = new Map<string, ClientRecord>([
["test-client", { clientSecret: "test-secret", redirectUris: new Set() }],
]);
const transactions = new Map<string, AuthorizationTransaction>();
const authorizationCodes = new Map<string, AuthorizationCode>();
const issuedAccessTokens = new Set<string>();
const json = (body: unknown, init?: ResponseInit) =>
new Response(JSON.stringify(body), {
...init,
headers: { "content-type": "application/json", ...init?.headers },
});
const text = (body: string, init?: ResponseInit) =>
new Response(body, {
...init,
headers: { "content-type": "text/plain; charset=utf-8", ...init?.headers },
});
const redirect = (location: string) => new Response(null, { status: 302, headers: { location } });
const decodeBasic = (
header: string | null,
): { readonly username: string; readonly password: string } | null => {
if (!header?.startsWith("Basic ")) return null;
const decoded = atob(header.slice("Basic ".length));
const separator = decoded.indexOf(":");
if (separator < 0) return null;
return { username: decoded.slice(0, separator), password: decoded.slice(separator + 1) };
};
const base64url = (buffer: ArrayBuffer): string => {
const bytes = new Uint8Array(buffer);
let binary = "";
for (const byte of bytes) binary += String.fromCharCode(byte);
return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
};
const codeChallengeForVerifier = async (verifier: string): Promise<string> =>
base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
const bearerToken = (request: Request): string | null => {
const header = request.headers.get("authorization");
return header?.replace(/^Bearer\s+/i, "") ?? null;
};
const isAuthorized = (request: Request): boolean => {
const token = bearerToken(request);
return token ? issuedAccessTokens.has(token) : false;
};
const unauthorized = (request: Request) => {
const url = new URL(request.url);
return json(
{ error: "invalid_token" },
{
status: 401,
headers: {
"www-authenticate": `Bearer resource_metadata="${url.origin}/.well-known/oauth-protected-resource${url.pathname}", error="invalid_token"`,
},
},
);
};
const oauthMetadata = (request: Request) => {
const url = new URL(request.url);
return json({
issuer: url.origin,
authorization_endpoint: `${url.origin}/authorize`,
token_endpoint: `${url.origin}/token`,
registration_endpoint: `${url.origin}/register`,
response_types_supported: ["code"],
grant_types_supported: ["authorization_code"],
code_challenge_methods_supported: ["S256"],
token_endpoint_auth_methods_supported: ["none", "client_secret_post", "client_secret_basic"],
scopes_supported: ["read", "write"],
});
};
const protectedResourceMetadata = (request: Request) => {
const url = new URL(request.url);
const suffix = url.pathname.slice("/.well-known/oauth-protected-resource".length);
return json({
resource: `${url.origin}${suffix}`,
authorization_servers: [url.origin],
bearer_methods_supported: ["header"],
scopes_supported: ["read", "write"],
});
};
const handleRegister = async (request: Request) => {
const body = (await request.json()) as {
readonly redirect_uris?: readonly string[];
readonly token_endpoint_auth_method?: string;
};
const clientId = `client_${crypto.randomUUID()}`;
const authMethod = body.token_endpoint_auth_method ?? "none";
const clientSecret = authMethod === "none" ? null : `secret_${crypto.randomUUID()}`;
clients.set(clientId, {
clientSecret,
redirectUris: new Set(body.redirect_uris ?? []),
});
return json(
{
client_id: clientId,
...(clientSecret ? { client_secret: clientSecret } : {}),
token_endpoint_auth_method: authMethod,
redirect_uris: body.redirect_uris ?? [],
grant_types: ["authorization_code"],
response_types: ["code"],
scope: "read write",
},
{ status: 201, headers: { "cache-control": "no-store" } },
);
};
const handleAuthorize = (request: Request) => {
const url = new URL(request.url);
const clientId = url.searchParams.get("client_id");
const redirectUri = url.searchParams.get("redirect_uri");
const state = url.searchParams.get("state");
const codeChallenge = url.searchParams.get("code_challenge");
if (!clientId || !redirectUri || !state || !codeChallenge) {
return json({ error: "invalid_request" }, { status: 400 });
}
const client = clients.get(clientId);
if (client?.redirectUris.size && !client.redirectUris.has(redirectUri)) {
return json(
{ error: "invalid_request", error_description: "redirect_uri is not registered" },
{ status: 400 },
);
}
if (!client) {
clients.set(clientId, { clientSecret: null, redirectUris: new Set([redirectUri]) });
}
const transaction = `txn_${crypto.randomUUID()}`;
transactions.set(transaction, {
clientId,
redirectUri,
state,
codeChallenge,
scope: url.searchParams.get("scope"),
});
return redirect(`${url.origin}/login?transaction=${encodeURIComponent(transaction)}`);
};
const handleLogin = async (request: Request) => {
const url = new URL(request.url);
const transactionId = url.searchParams.get("transaction");
const transaction = transactionId ? transactions.get(transactionId) : undefined;
if (!transactionId || !transaction) return json({ error: "invalid_request" }, { status: 400 });
if (request.method === "GET") return text("OAuth test login");
const basic = decodeBasic(request.headers.get("authorization"));
if (!basic || basic.username !== "alice" || basic.password !== "password") {
return json(
{ error: "access_denied" },
{ status: 401, headers: { "www-authenticate": 'Basic realm="Executor test servers"' } },
);
}
const code = `code_${crypto.randomUUID()}`;
transactions.delete(transactionId);
authorizationCodes.set(code, { ...transaction, username: basic.username });
const callback = new URL(transaction.redirectUri);
callback.searchParams.set("code", code);
callback.searchParams.set("state", transaction.state);
return redirect(callback.toString());
};
const handleToken = async (request: Request) => {
const params = new URLSearchParams(await request.text());
const basic = decodeBasic(request.headers.get("authorization"));
const clientId = basic?.username ?? params.get("client_id");
const clientSecret = basic?.password ?? params.get("client_secret");
const client = clientId ? clients.get(clientId) : undefined;
if (!clientId || !client) return json({ error: "invalid_client" }, { status: 401 });
if (client.clientSecret !== null && client.clientSecret !== clientSecret) {
return json({ error: "invalid_client" }, { status: 401 });
}
const code = params.get("code");
const redirectUri = params.get("redirect_uri");
const verifier = params.get("code_verifier");
const record = code ? authorizationCodes.get(code) : undefined;
if (!code || !redirectUri || !verifier || !record) {
return json({ error: "invalid_grant" }, { status: 400 });
}
if (
record.clientId !== clientId ||
record.redirectUri !== redirectUri ||
record.codeChallenge !== (await codeChallengeForVerifier(verifier))
) {
return json({ error: "invalid_grant" }, { status: 400 });
}
authorizationCodes.delete(code);
const accessToken = `at_${crypto.randomUUID()}`;
const refreshToken = `rt_${crypto.randomUUID()}`;
issuedAccessTokens.add(accessToken);
return json(
{
access_token: accessToken,
refresh_token: refreshToken,
token_type: "Bearer",
expires_in: 3600,
...(record.scope ? { scope: record.scope } : {}),
},
{ headers: { "cache-control": "no-store" } },
);
};
const OpenApiEchoItem = Schema.Struct({ id: Schema.Number, name: Schema.String });
const OpenApiEchoItemsGroup = HttpApiGroup.make("items").add(
HttpApiEndpoint.get("listItems", "/items", { success: Schema.Array(OpenApiEchoItem) }),
);
const OpenApiEchoApi = HttpApi.make("executorOpenApiWorkerTest")
.add(OpenApiEchoItemsGroup)
.annotateMerge(
OpenApi.annotations({ title: "Executor Worker OpenAPI Test Server", version: "1.0.0" }),
);
const openApiSpec = (request: Request) => {
const url = new URL(request.url);
const apiBaseUrl = `${url.origin}/openapi`;
const spec = OpenApi.fromApi(
(OpenApiEchoApi as HttpApi.AnyWithProps).annotateMerge(
OpenApi.annotations({
servers: [{ url: apiBaseUrl }],
transform: (source) => ({
...source,
components: {
...(typeof source.components === "object" && source.components !== null
? source.components
: {}),
securitySchemes: {
oauth2: {
type: "oauth2",
flows: {
authorizationCode: {
authorizationUrl: `${url.origin}/authorize`,
tokenUrl: `${url.origin}/token`,
scopes: { read: "Read test resources" },
},
},
},
},
},
security: [{ oauth2: ["read"] }],
}),
}),
),
);
return json(spec);
};
const handleOpenApi = (request: Request) => {
const url = new URL(request.url);
if (url.pathname === "/openapi/spec.json") return openApiSpec(request);
if (!isAuthorized(request)) return unauthorized(request);
if (url.pathname === "/openapi/items") {
return json([
{ id: 1, name: "Widget" },
{ id: 2, name: "Gadget" },
]);
}
return json({ error: "not_found" }, { status: 404 });
};
const yoga = createYoga({
schema: createSchema({
typeDefs: /* GraphQL */ `
type Query {
hello(name: String): String
}
type Mutation {
setGreeting(message: String!): String
}
`,
resolvers: {
Query: {
hello: (_source: unknown, args: { readonly name?: string }) =>
`Hello ${args.name ?? "world"}`,
},
Mutation: {
setGreeting: (_source: unknown, args: { readonly message: string }) => args.message,
},
},
}),
graphqlEndpoint: "/graphql",
graphiql: false,
logging: false,
maskedErrors: false,
});
const handleGraphql = (request: Request) =>
isAuthorized(request) ? yoga.handle(request, {}) : unauthorized(request);
const createMcpServer = () => {
const server = new McpServer(
{ name: "executor-worker-mcp-test", version: "1.0.0" },
{ capabilities: {} },
);
server.registerTool(
"hello",
{ description: "Greets a person", inputSchema: { name: z.string() } },
async ({ name }: { readonly name: string }) => ({
content: [{ type: "text" as const, text: `Hello ${name}` }],
}),
);
return server;
};
const mcpTransports = new Map<string, WebStandardStreamableHTTPServerTransport>();
const handleMcp = async (request: Request) => {
if (!isAuthorized(request)) return unauthorized(request);
const sessionId = request.headers.get("mcp-session-id") ?? undefined;
const existing = sessionId ? mcpTransports.get(sessionId) : undefined;
if (sessionId && !existing) return text("Session not found", { status: 404 });
if (existing) return existing.handleRequest(request);
const transport = new WebStandardStreamableHTTPServerTransport({
sessionIdGenerator: () => crypto.randomUUID(),
onsessioninitialized: (sid) => {
mcpTransports.set(sid, transport);
},
});
await createMcpServer().connect(transport);
return transport.handleRequest(request);
};
const handleRequest = async (request: Request): Promise<Response> => {
const url = new URL(request.url);
if (url.pathname === "/health") return json({ ok: true });
if (
url.pathname === "/.well-known/oauth-authorization-server" ||
url.pathname === "/.well-known/openid-configuration"
) {
return oauthMetadata(request);
}
if (url.pathname.startsWith("/.well-known/oauth-protected-resource")) {
return protectedResourceMetadata(request);
}
if (url.pathname === "/register" && request.method === "POST") return handleRegister(request);
if (url.pathname === "/authorize" && request.method === "GET") return handleAuthorize(request);
if (url.pathname === "/login") return handleLogin(request);
if (url.pathname === "/token" && request.method === "POST") return handleToken(request);
if (url.pathname.startsWith("/openapi/")) return handleOpenApi(request);
if (url.pathname === "/graphql") return handleGraphql(request);
if (url.pathname === "/mcp") return handleMcp(request);
return json({ error: "not_found" }, { status: 404 });
};
export default {
fetch: handleRequest,
};