Unified · Split
| @@ -94,29 +94,31 @@ export const McpAuthLive = Layer.succeed(McpAuth, { · 93 unmodified lines | ||
| 94 | 94 | yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_bearer" }); |
| 95 | 95 | return null; |
| 96 | 96 | } |
| 97 | − try { | |
| 98 | − const { payload } = yield* Effect.promise(() => | |
| 97 | + const verified = yield* Effect.either( | |
| 98 | + Effect.promise(() => | |
| 99 | 99 | jwtVerify(authHeader.slice(BEARER_PREFIX.length), jwks, { |
| 100 | 100 | issuer: AUTHKIT_DOMAIN, |
| 101 | 101 | }), |
| 102 | − ).pipe(Effect.withSpan("mcp.auth.jwt_verify")); | |
| 103 | − if (!payload.sub) { | |
| 104 | − yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" }); | |
| 105 | − return null; | |
| 106 | − } | |
| 107 | − const token = { | |
| 108 | − accountId: payload.sub, | |
| 109 | − organizationId: (payload.org_id as string | undefined) ?? null, | |
| 110 | − }; | |
| 111 | − yield* Effect.annotateCurrentSpan({ | |
| 112 | − "mcp.auth.outcome": "verified", | |
| 113 | − "mcp.auth.has_organization": !!token.organizationId, | |
| 114 | − }); | |
| 115 | − return token; | |
| 116 | − } catch { | |
| 102 | + ).pipe(Effect.withSpan("mcp.auth.jwt_verify")), | |
| 103 | + ); | |
| 104 | + if (verified._tag === "Left") { | |
| 117 | 105 | yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "invalid" }); |
| 118 | 106 | return null; |
| 119 | 107 | } |
| 108 | + const { payload } = verified.right; | |
| 109 | + if (!payload.sub) { | |
| 110 | + yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" }); | |
| 111 | + return null; | |
| 112 | + } | |
| 113 | + const token = { | |
| 114 | + accountId: payload.sub, | |
| 115 | + organizationId: (payload.org_id as string | undefined) ?? null, | |
| 116 | + }; | |
| 117 | + yield* Effect.annotateCurrentSpan({ | |
| 118 | + "mcp.auth.outcome": "verified", | |
| 119 | + "mcp.auth.has_organization": !!token.organizationId, | |
| 120 | + }); | |
| 121 | + return token; | |
| 120 | 122 | }).pipe(Effect.withSpan("mcp.auth.verify_bearer")), |
| 121 | 123 | }); |
| 122 | 124 | |