Function authenticateOAuthBearer

apps/host-selfhost/src/mcp/auth.ts:223–233

(request: Request)

      /** (a) The mcp() OAuth opaque bearer, with self-enforced expiry. */
      const authenticateOAuthBearer = (request: Request): Effect.Effect<Principal | null> =>
        Effect.gen(function* () {
          const session = yield* Effect.promise(() =>
            auth.api.getMcpSession({ headers: request.headers }),
          );
          if (!session) return null;
          // GOTCHA: getMcpSession does NOT validate accessTokenExpiresAt — an
          // expired token still resolves. Reject it here.
          if (new Date(session.accessTokenExpiresAt).getTime() < Date.now()) return null;
          return yield* principalFromUserId(session.userId);
        }).pipe(Effect.orElseSucceed(() => null));

      /** (b) The existing cookie / bearer-session / x-api-key path. The fallback's
       * api `Principal` shape is byte-identical to host-mcp's `Principal`. */