Function handleMcpRequest

packages/plugins/mcp/src/testing/server.ts:96–225

(
        request: http.IncomingMessage,
        response: http.ServerResponse,
      )

      let nextSessionRequestStatus: number | undefined;

      const handleMcpRequest = (
        request: http.IncomingMessage,
        response: http.ServerResponse,
      ): Effect.Effect<void> =>
        Effect.gen(function* () {
          const requestUrl = request.url ?? "/";
          const sessionId = Array.isArray(request.headers["mcp-session-id"])
            ? request.headers["mcp-session-id"][0]
            : request.headers["mcp-session-id"];
          const authorization = Array.isArray(request.headers.authorization)
            ? request.headers.authorization[0]
            : request.headers.authorization;
          const origin = request.headers.host
            ? `http://${request.headers.host}`
            : "http://127.0.0.1";

          yield* Ref.update(requests, (all) => [
            ...all,
            {
              method: request.method ?? "GET",
              url: requestUrl,
              authorization,
              sessionId,
            },
          ]);

          if (
            options.auth?.authorizationServerUrls &&
            requestUrl.startsWith(protectedResourcePath)
          ) {
            const resourcePath = requestUrl.slice(protectedResourcePath.length);
            writeJson(response, 200, {
              resource: `${origin}${resourcePath}`,
              authorization_servers: options.auth.authorizationServerUrls,
              bearer_methods_supported: ["header"],
              scopes_supported: options.auth.scopes ?? ["read"],
            });
            return;
          }

          if (!isMcpPath(requestUrl, path)) {
            writeJson(response, 404, { error: "not_found" });
            return;
          }

          if (options.auth) {
            const accepted = yield* options.auth.validateAuthorization(authorization);
            if (!accepted) {
              writeJson(
                response,
                401,
                { error: "invalid_token" },
                {
                  "www-authenticate":
                    options.auth.wwwAuthenticate ??
                    `Bearer resource_metadata="${origin}${protectedResourcePath}${path}", error="invalid_token"`,
                },
              );