Function selfHostHttpMiddleware

apps/host-selfhost/src/serve.ts:50–92

(betterAuth: BetterAuthHandle)

// aside from scrubbing any client-supplied value of that header so it can't be
// spoofed into an unrewritten request.
const selfHostHttpMiddleware = (betterAuth: BetterAuthHandle) =>
  HttpMiddleware.make((httpApp) =>
    Effect.gen(function* () {
      const request = yield* HttpServerRequest.HttpServerRequest;
      const url = new URL(request.url, "http://host.internal");
      if (
        url.pathname === OAUTH_CALLBACK_PATH &&
        (request.method === "GET" || request.method === "HEAD")
      ) {
        const headers = new Headers(request.headers as Record<string, string>);
        const webRequest = new Request(url, { method: request.method, headers });
        const location = yield* Effect.promise(() =>
          oauthCallbackSignInRedirectLocation(webRequest, betterAuth.auth),
        );
        if (location) return HttpServerResponse.redirect(location, { status: 302 });
      }

      const rewritten = stripMcpOrgSegment(url.pathname);
      if (rewritten === null) {
        // Never let a client dictate the org-scoped echo below by smuggling
        // this header in directly — it's only ever trustworthy when WE set it
        // a few lines down, for a request we ourselves just rewrote.
        if (!EffectHeaders.has(request.headers, MCP_ORIGINAL_PATH_HEADER)) return yield* httpApp;
        return yield* httpApp.pipe(
          Effect.provideService(
            HttpServerRequest.HttpServerRequest,
            request.modify({
              headers: EffectHeaders.remove(request.headers, MCP_ORIGINAL_PATH_HEADER),
            }),
          ),
        );
      }
      return yield* httpApp.pipe(
        Effect.provideService(
          HttpServerRequest.HttpServerRequest,
          request.modify({
            url: `${rewritten}${url.search}`,
            headers: EffectHeaders.set(request.headers, MCP_ORIGINAL_PATH_HEADER, url.pathname),
          }),
        ),
      );
    }),
  );

export const startServer = async (): Promise<void> => {
  const config = loadConfig();