(
auth: McpAuthProvider["Service"],
request: Request,
outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
)
| 47 | : jsonRpcErrorBody(status, code, message, { challenge }); |
| 48 | |
| 49 | const renderAuthError = ( |
| 50 | auth: McpAuthProvider["Service"], |
| 51 | request: Request, |
| 52 | outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>, |
| 53 | ): Response => { |
| 54 | if (Predicate.isTagged(outcome, "Unauthorized")) { |
| 55 | return jsonRpcResponse( |
| 56 | 401, |
| 57 | -32001, |
| 58 | "Unauthorized", |
| 59 | outcome.challenge ?? `Bearer resource_metadata="${auth.resourceMetadataUrl(request)}"`, |
| 60 | ); |
| 61 | } |
| 62 | if (Predicate.isTagged(outcome, "Forbidden")) { |
| 63 | return jsonRpcResponse(403, outcome.code ?? -32001, outcome.message); |
| 64 | } |
| 65 | // Unavailable: a transient auth-infra failure (JWKS blip OR a WorkOS |
| 66 | // membership-lookup 429/5xx/timeout). Both are retryable, so advertise a |
| 67 | // Retry-After so the client (and any polite retry layer) backs off instead of |
| 68 | // hammering (same rendering as the shared envelope's Unavailable branch). |
| 69 | // Crucially, this path NEVER reaches the session-destroy branch below — a |
| 70 | // transient failure must not condemn a live session. |
| 71 | // |
| 72 | // Note this 503 shares JSON-RPC code -32001 with the terminated-session 404 |
| 73 | // ("Session timed out, please reconnect"); that is intentional — -32001 is |
| 74 | // the generic auth/session envelope code, and the HTTP STATUS is the |
| 75 | // discriminator clients act on: 503 = retry the SAME session id, 404 = the |
| 76 | // id is dead, reconnect. |
| 77 | return jsonRpcErrorBody(503, -32001, outcome.message, { |
| 78 | retryAfterSeconds: UNAVAILABLE_RETRY_AFTER_SECONDS, |
| 79 | }); |
| 80 | }; |
| 81 | |
| 82 | const authenticate = (request: Request) => |
| 83 | Effect.gen(function* () { |
no test coverage detected