Function protectedResourceMetadataUrlFor

apps/cloud/src/mcp/auth.ts:96–104

(
  organizationSelector: string | null,
  toolkitSlug: string | null = null,
)

/** The protected-resource-metadata URL for an org selector, or the bare one. */
export const protectedResourceMetadataUrlFor = (
  organizationSelector: string | null,
  toolkitSlug: string | null = null,
): string => {
  const toolkitSuffix = toolkitSlug ? `/toolkits/${toolkitSlug}` : "";
  return organizationSelector
    ? `${RESOURCE_ORIGIN}/.well-known/oauth-protected-resource/${organizationSelector}/mcp${toolkitSuffix}`
    : `${PROTECTED_RESOURCE_METADATA_URL}${toolkitSuffix}`;
};

type McpUnauthorizedReason = "missing_bearer" | "invalid_token";