Function mintBearerFlow

e2e/src/surfaces/mcp.ts:211–290

(target: Target, email: string)

};

const mintBearerFlow = async (target: Target, email: string): Promise<string> => {
  const consent = target.mcpConsent?.({
    label: email,
    credentials: { email, password: "" },
  });
  if (!consent) throw new Error(`target ${target.name} has no mcpConsent strategy`);

  const mcpPath = new URL(target.mcpUrl).pathname;
  let resourceResponse = await fetch(
    new URL(`/.well-known/oauth-protected-resource${mcpPath}`, target.baseUrl),
  );
  if (resourceResponse.status === 404) {
    resourceResponse = await fetch(
      new URL("/.well-known/oauth-protected-resource", target.baseUrl),
    );
  }
  const resource = await jsonFrom<{ authorization_servers?: ReadonlyArray<string> }>(
    resourceResponse,
    "mintBearer: protected-resource metadata",
  );
  const issuer = resource.authorization_servers?.[0];
  if (!issuer) throw new Error("mintBearer: no authorization server advertised");
  const metadata = await jsonFrom<{
    readonly authorization_endpoint: string;
    readonly token_endpoint: string;
    readonly registration_endpoint: string;
  }>(
    await fetch(new URL("/.well-known/oauth-authorization-server", issuer)),
    "mintBearer: authorization-server metadata",
  );

  const redirectUri = "http://127.0.0.1:9/callback";
  const registered = await jsonFrom<{ readonly client_id: string }>(
    await fetch(metadata.registration_endpoint, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({
        client_name: "executor-e2e",
        redirect_uris: [redirectUri],
        grant_types: ["authorization_code", "refresh_token"],
        response_types: ["code"],
        token_endpoint_auth_method: "none",
      }),
    }),
    "mintBearer: dynamic client registration",
  );

  const verifier = randomBytes(32).toString("base64url");
  const authorizeUrl = new URL(metadata.authorization_endpoint);
  authorizeUrl.searchParams.set("client_id", registered.client_id);
  authorizeUrl.searchParams.set("redirect_uri", redirectUri);
  authorizeUrl.searchParams.set("response_type", "code");
  authorizeUrl.searchParams.set("state", randomUUID());
  authorizeUrl.searchParams.set(
    "code_challenge",
    createHash("sha256").update(verifier).digest("base64url"),
  );
  authorizeUrl.searchParams.set("code_challenge_method", "S256");