(
auth: McpAuthProvider["Service"],
request: Request,
outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
)
| 168 | * session, 404 means the session id is dead and the client must reconnect. |
| 169 | */ |
| 170 | const renderAuthError = ( |
| 171 | auth: McpAuthProvider["Service"], |
| 172 | request: Request, |
| 173 | outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>, |
| 174 | ): Response => |
| 175 | Match.value(outcome).pipe( |
| 176 | Match.tag("Unauthorized", (u) => |
| 177 | jsonRpcResponse( |
| 178 | 401, |
| 179 | -32001, |
| 180 | "Unauthorized", |
| 181 | u.challenge ?? `Bearer resource_metadata="${auth.resourceMetadataUrl(request)}"`, |
| 182 | ), |
| 183 | ), |
| 184 | Match.tag("Forbidden", (f) => jsonRpcResponse(403, f.code ?? -32001, f.message)), |
| 185 | Match.tag("Unavailable", (u) => |
| 186 | jsonRpcErrorBody(503, -32001, u.message, { |
| 187 | retryAfterSeconds: UNAVAILABLE_RETRY_AFTER_SECONDS, |
| 188 | }), |
| 189 | ), |
| 190 | Match.exhaustive, |
| 191 | ); |
| 192 | |
| 193 | /** Render a non-`Response` {@link McpDispatchResult} discriminant. */ |
| 194 | const renderDispatchError = (lookup: "not-found" | "forbidden"): Response => |
no test coverage detected