diff --git a/src/lib/auth-config.ts b/src/lib/auth-config.ts index 5ee7f49..c8d6910 100644 --- a/src/lib/auth-config.ts +++ b/src/lib/auth-config.ts @@ -5,11 +5,10 @@ import { getActiveOrganizationId } from "@/lib/auth-session"; import { getMcpOrganizationIdClaim, getMcpResource, + MCP_OAUTH_SCOPES, MCP_SCOPE, } from "@/lib/oauth-resource"; -const MCP_OAUTH_SCOPES = ["offline_access", MCP_SCOPE]; - function assertSingleMcpAudience(audiences: string[]) { if (audiences.length !== 1) { throw new Error( diff --git a/src/lib/oauth-resource.ts b/src/lib/oauth-resource.ts index 9ae51c0..afb859b 100644 --- a/src/lib/oauth-resource.ts +++ b/src/lib/oauth-resource.ts @@ -1,5 +1,6 @@ const MCP_RESOURCE_PATH = "/mcp"; export const MCP_SCOPE = "mcp"; +export const MCP_OAUTH_SCOPES = ["offline_access", MCP_SCOPE]; export function getMcpResource(baseUrl: string) { return new URL(MCP_RESOURCE_PATH, baseUrl).toString(); diff --git a/src/routes/[.]well-known/oauth-protected-resource/mcp.ts b/src/routes/[.]well-known/oauth-protected-resource/mcp.ts index c992b91..4979f71 100644 --- a/src/routes/[.]well-known/oauth-protected-resource/mcp.ts +++ b/src/routes/[.]well-known/oauth-protected-resource/mcp.ts @@ -3,7 +3,7 @@ import { env } from "cloudflare:workers"; import { getHostedBaseUrl, hasHostedAuthConfig } from "@/lib/auth"; import { isHostedAuthMode } from "@/lib/auth-mode"; import { getOAuthProviderResourceActions } from "@/lib/oauth-provider-resource-client"; -import { getMcpResource, MCP_SCOPE } from "@/lib/oauth-resource"; +import { getMcpResource, MCP_OAUTH_SCOPES } from "@/lib/oauth-resource"; function unavailableMetadataResponse() { if (!isHostedAuthMode(env.AUTH_MODE)) { @@ -30,7 +30,7 @@ export const Route = createFileRoute( await getOAuthProviderResourceActions().getProtectedResourceMetadata({ resource: getMcpResource(baseUrl), authorization_servers: [`${baseUrl}/api/auth`], - scopes_supported: [MCP_SCOPE], + scopes_supported: [...MCP_OAUTH_SCOPES], resource_name: "OpenSEO MCP", });