Function validateMcpAuth

apps/sim/lib/mcp/middleware.ts:112–211

* Validates MCP authentication and authorization

(
  request: NextRequest,
  permissionLevel: McpPermissionLevel
)

 * Validates MCP authentication and authorization
 */
async function validateMcpAuth(
  request: NextRequest,
  permissionLevel: McpPermissionLevel
): Promise<AuthValidationResult> {
  const requestId = generateRequestId()

  try {
    const auth = await checkSessionOrInternalAuth(request, { requireWorkflowId: false })
    if (!auth.success || !auth.userId) {
      logger.warn(`[${requestId}] Authentication failed: ${auth.error}`)
      return {
        success: false,
        errorResponse: createMcpErrorResponse(
          new Error(auth.error || 'Authentication required'),
          'Authentication failed',
          401
        ),
      }
    }

    let workspaceId: string | null = null

    const { searchParams } = new URL(request.url)
    workspaceId = searchParams.get('workspaceId')

    if (!workspaceId) {
      try {
        const contentType = request.headers.get('content-type')
        if (contentType?.includes('application/json')) {
          const body = await readMcpJsonBodyWithLimit(request)
          const bodyWorkspaceId =
            body && typeof body === 'object' && 'workspaceId' in body
              ? (body as { workspaceId?: unknown }).workspaceId
              : undefined
          workspaceId = typeof bodyWorkspaceId === 'string' ? bodyWorkspaceId : null
        }
      } catch (error) {
        const errorResponse = mcpBodyReadErrorResponse(error, request)
        if (errorResponse) return { success: false, errorResponse }
      }
    }

    if (!workspaceId) {
      return {
        success: false,
        errorResponse: createMcpErrorResponse(
          new Error('workspaceId is required'),
          'Missing required parameter',
          400
        ),
      }
    }

    const userPermissions = await getUserEntityPermissions(auth.userId, 'workspace', workspaceId)
    if (!userPermissions) {
      return {
        success: false,
        errorResponse: createMcpErrorResponse(