History

fix mcp invalid bearer handling (#417)

Rhys Sullivan committed 6 months ago

Commit b965f7b1 parent 0f8f8f41 file · +19 −17Browse files

Unified · Split

apps/cloud/src/mcp.ts+19−17
@@ -94,29 +94,31 @@ export const McpAuthLive = Layer.succeed(McpAuth, { · 93 unmodified lines
94 yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_bearer" });94 yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_bearer" });
95 return null;95 return null;
96 }96 }
97 try {97 const verified = yield* Effect.either(
98 const { payload } = yield* Effect.promise(() =>98 Effect.promise(() =>
99 jwtVerify(authHeader.slice(BEARER_PREFIX.length), jwks, {99 jwtVerify(authHeader.slice(BEARER_PREFIX.length), jwks, {
100 issuer: AUTHKIT_DOMAIN,100 issuer: AUTHKIT_DOMAIN,
101 }),101 }),
102 ).pipe(Effect.withSpan("mcp.auth.jwt_verify"));102 ).pipe(Effect.withSpan("mcp.auth.jwt_verify")),
103 if (!payload.sub) {103 );
104 yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" });104 if (verified._tag === "Left") {
105 return null;
106 }
107 const token = {
108 accountId: payload.sub,
109 organizationId: (payload.org_id as string | undefined) ?? null,
110 };
111 yield* Effect.annotateCurrentSpan({
112 "mcp.auth.outcome": "verified",
113 "mcp.auth.has_organization": !!token.organizationId,
114 });
115 return token;
116 } catch {
117 yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "invalid" });105 yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "invalid" });
118 return null;106 return null;
119 }107 }
108 const { payload } = verified.right;
109 if (!payload.sub) {
110 yield* Effect.annotateCurrentSpan({ "mcp.auth.outcome": "missing_subject" });
111 return null;
112 }
113 const token = {
114 accountId: payload.sub,
115 organizationId: (payload.org_id as string | undefined) ?? null,
116 };
117 yield* Effect.annotateCurrentSpan({
118 "mcp.auth.outcome": "verified",
119 "mcp.auth.has_organization": !!token.organizationId,
120 });
121 return token;
120 }).pipe(Effect.withSpan("mcp.auth.verify_bearer")),122 }).pipe(Effect.withSpan("mcp.auth.verify_bearer")),
121});123});
122 124