(
auth: McpAuthProvider["Service"],
request: Request,
outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
)
| 57 | : jsonRpcErrorBody(status, code, message, { challenge }); |
| 58 | |
| 59 | const renderAuthError = ( |
| 60 | auth: McpAuthProvider["Service"], |
| 61 | request: Request, |
| 62 | outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>, |
| 63 | ): Response => { |
| 64 | if (Predicate.isTagged(outcome, "Unauthorized")) { |
| 65 | return jsonRpcResponse( |
| 66 | 401, |
| 67 | -32001, |
| 68 | "Unauthorized", |
| 69 | outcome.challenge ?? `Bearer resource_metadata="${auth.resourceMetadataUrl(request)}"`, |
| 70 | ); |
| 71 | } |
| 72 | if (Predicate.isTagged(outcome, "Forbidden")) { |
| 73 | return jsonRpcResponse(403, outcome.code ?? -32001, outcome.message); |
| 74 | } |
| 75 | // Unavailable: a transient auth-infra failure (JWKS blip OR a WorkOS |
| 76 | // membership-lookup 429/5xx/timeout). Both are retryable, so advertise a |
| 77 | // Retry-After so the client (and any polite retry layer) backs off instead of |
| 78 | // hammering (same rendering as the shared envelope's Unavailable branch). |
| 79 | // Crucially, this path NEVER reaches the session-destroy branch below — a |
| 80 | // transient failure must not condemn a live session. |
| 81 | // |
| 82 | // Note this 503 shares JSON-RPC code -32001 with the terminated-session 404 |
| 83 | // ("Session timed out, please reconnect"); that is intentional — -32001 is |
| 84 | // the generic auth/session envelope code, and the HTTP STATUS is the |
| 85 | // discriminator clients act on: 503 = retry the SAME session id, 404 = the |
| 86 | // id is dead, reconnect. |
| 87 | return jsonRpcErrorBody(503, -32001, outcome.message, { |
| 88 | retryAfterSeconds: UNAVAILABLE_RETRY_AFTER_SECONDS, |
| 89 | }); |
| 90 | }; |
| 91 | |
| 92 | /** |
| 93 | * A Cloudflare *platform* Durable Object failure happened at one of this |
no test coverage detected