Function renderAuthError

apps/cloud/src/mcp/agent-handler.ts:112–143

(
  auth: McpAuthProvider["Service"],
  request: Request,
  outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
)

    : jsonRpcResponse(404, -32001, message);

const renderAuthError = (
  auth: McpAuthProvider["Service"],
  request: Request,
  outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
): Response => {
  if (Predicate.isTagged(outcome, "Unauthorized")) {
    return jsonRpcResponse(
      401,
      -32001,
      "Unauthorized",
      outcome.challenge ?? `Bearer resource_metadata="${auth.resourceMetadataUrl(request)}"`,
    );
  }
  if (Predicate.isTagged(outcome, "Forbidden")) {
    return jsonRpcResponse(403, outcome.code ?? -32001, outcome.message);
  }
  // Unavailable: a transient auth-infra failure (JWKS blip OR a WorkOS
  // membership-lookup 429/5xx/timeout). Both are retryable, so advertise a
  // Retry-After so the client (and any polite retry layer) backs off instead of
  // hammering (same rendering as the shared envelope's Unavailable branch).
  // Crucially, this path NEVER reaches the session-destroy branch below — a
  // transient failure must not condemn a live session.
  //
  // Note this 503 shares JSON-RPC code -32001 with the terminated-session 404
  // ("Session timed out, please reconnect"); that is intentional — -32001 is
  // the generic auth/session envelope code, and the HTTP STATUS is the
  // discriminator clients act on: 503 = retry the SAME session id, 404 = the
  // id is dead, reconnect.
  return jsonRpcErrorBody(503, -32001, outcome.message, {
    retryAfterSeconds: UNAVAILABLE_RETRY_AFTER_SECONDS,
  });
};

const authenticate = (request: Request, authProvider: Layer.Layer<McpAuthProvider>) =>
  Effect.gen(function* () {