| 75 | let nextSessionRequestStatus: number | undefined; |
| 76 | |
| 77 | const handleMcpRequest = ( |
| 78 | request: http.IncomingMessage, |
| 79 | response: http.ServerResponse, |
| 80 | ): Effect.Effect<void> => |
| 81 | Effect.gen(function* () { |
| 82 | const requestUrl = request.url ?? "/"; |
| 83 | const sessionId = Array.isArray(request.headers["mcp-session-id"]) |
| 84 | ? request.headers["mcp-session-id"][0] |
| 85 | : request.headers["mcp-session-id"]; |
| 86 | const authorization = Array.isArray(request.headers.authorization) |
| 87 | ? request.headers.authorization[0] |
| 88 | : request.headers.authorization; |
| 89 | const origin = request.headers.host |
| 90 | ? `http://${request.headers.host}` |
| 91 | : "http://127.0.0.1"; |
| 92 | |
| 93 | yield* Ref.update(requests, (all) => [ |
| 94 | ...all, |
| 95 | { |
| 96 | method: request.method ?? "GET", |
| 97 | url: requestUrl, |
| 98 | authorization, |
| 99 | sessionId, |
| 100 | }, |
| 101 | ]); |
| 102 | |
| 103 | if ( |
| 104 | options.auth?.authorizationServerUrls && |
| 105 | requestUrl.startsWith(protectedResourcePath) |
| 106 | ) { |
| 107 | const resourcePath = requestUrl.slice(protectedResourcePath.length); |
| 108 | writeJson(response, 200, { |
| 109 | resource: `${origin}${resourcePath}`, |
| 110 | authorization_servers: options.auth.authorizationServerUrls, |
| 111 | bearer_methods_supported: ["header"], |
| 112 | scopes_supported: options.auth.scopes ?? ["read"], |
| 113 | }); |
| 114 | return; |
| 115 | } |
| 116 | |
| 117 | if (!isMcpPath(requestUrl, path)) { |
| 118 | writeJson(response, 404, { error: "not_found" }); |
| 119 | return; |
| 120 | } |
| 121 | |
| 122 | if (options.auth) { |
| 123 | const accepted = yield* options.auth.validateAuthorization(authorization); |
| 124 | if (!accepted) { |
| 125 | writeJson( |
| 126 | response, |
| 127 | 401, |
| 128 | { error: "invalid_token" }, |
| 129 | { |
| 130 | "www-authenticate": |
| 131 | options.auth.wwwAuthenticate ?? |
| 132 | `Bearer resource_metadata="${origin}${protectedResourcePath}${path}", error="invalid_token"`, |
| 133 | }, |
| 134 | ); |