Function resourceMetadataUrlFor

apps/host-selfhost/src/mcp/auth.ts:121–129

(baseURL: string | undefined, request: Request)

 * `mcpResourcePathFor`) so the MCP SDK's same-origin resource check passes.
 */
const resourceMetadataUrlFor = (baseURL: string | undefined, request: Request): string => {
  const origin = baseURL && baseURL.length > 0 ? baseURL : new URL(request.url).origin;
  const orgScoped = originalOrgScopedPathFor(request);
  if (orgScoped) return `${origin}${PROTECTED_RESOURCE_METADATA_PATH}${orgScoped}`;
  const toolkitSlug = toolkitSlugFromRequest(request);
  return toolkitSlug
    ? `${origin}${PROTECTED_RESOURCE_METADATA_PATH}/mcp/toolkits/${toolkitSlug}`
    : `${origin}${PROTECTED_RESOURCE_METADATA_PATH}`;
};

const resourceUrlFor = (baseURL: string | undefined, request: Request): string => {
  const origin = baseURL && baseURL.length > 0 ? baseURL : new URL(request.url).origin;