Function authenticateToken

packages/mcp/src/auth.ts:36–131

(
  token: string | undefined,
)

 * - root clients get null projectId + organizationId (multi-project access)
 */
export async function authenticateToken(
  token: string | undefined,
): Promise<McpAuthContext> {
  if (!token) {
    throw new McpAuthError('Missing authentication token');
  }

  let decoded: string;
  try {
    decoded = Buffer.from(token, 'base64').toString('utf-8');
  } catch {
    throw new McpAuthError('Invalid token encoding');
  }

  const colonIndex = decoded.indexOf(':');
  if (colonIndex === -1) {
    logger.warn(
      { decodedLength: decoded.length },
      'MCP auth: token has no colon separator',
    );
    throw new McpAuthError(
      'Invalid token format — expected base64(clientId:clientSecret)',
    );
  }

  const clientId = decoded.slice(0, colonIndex);
  const clientSecret = decoded.slice(colonIndex + 1);

  logger.info(
    { clientId, secretPrefix: clientSecret.slice(0, 6) },
    'MCP auth: decoded token',
  );

  if (
    !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(
      clientId,
    )
  ) {
    logger.warn({ clientId }, 'MCP auth: invalid client ID format');
    throw new McpAuthError('Invalid client ID format');
  }

  if (!clientSecret) {
    throw new McpAuthError('Client secret is required');
  }

  const client = await getClientByIdCached(clientId);
  if (!client) {
    logger.warn({ clientId }, 'MCP auth: client not found');
    throw new McpAuthError('Invalid credentials');
  }

  logger.info(
    { clientId, type: client.type, hasSecret: !!client.secret },
    'MCP auth: client found',
  );

  if (!client.secret) {