inspector/core/auth/ema/resourceContext.ts

import { discoverAuthorizationServerMetadata, discoverOAuthProtectedResourceMetadata, selectResourceURL } from "@modelcontextprotocol/client";
import type { OAuthClientProvider } from "@modelcontextprotocol/client";
import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
import { getAuthorizationServerUrl } from "../discovery.js";

export interface EmaResourceContext {
  resourceMetadata: OAuthProtectedResourceMetadata;
  resourceAsUrl: URL;
  resourceUrl?: URL;
  scope?: string;
}

export function resolveEmaScopes(
  resourceMetadata: OAuthProtectedResourceMetadata | null | undefined,
  configuredScope?: string,
): string | undefined {
  const trimmed = configuredScope?.trim();
  if (trimmed) return trimmed;
  const supported = resourceMetadata?.scopes_supported;
  if (supported && supported.length > 0) {
    return supported.join(" ");
  }
  return undefined;
}

export async function discoverEmaResourceContext(
  serverUrl: string,
  configuredScope?: string,
  fetchFn?: typeof fetch,
): Promise<EmaResourceContext> {
  const resourceMetadata = await discoverOAuthProtectedResourceMetadata(
    serverUrl,
    undefined,
    fetchFn,
  );
  /* v8 ignore start -- defensive: the SDK's discoverOAuthProtectedResourceMetadata
     validates the response against a Zod schema that requires `resource` to be a
     valid URL, so a metadata object reaching here always has a truthy `resource`.
     This guard is unreachable through the public discovery path. */
  if (!resourceMetadata.resource) {
    throw new Error(
      "EMA requires protected resource metadata with a resource identifier",
    );
  }
  /* v8 ignore stop */
  const resourceAsUrl = getAuthorizationServerUrl(serverUrl, resourceMetadata);
  const resourceUrl = await selectResourceURL(
    serverUrl,
    {
      clientMetadata: {
        scope: configuredScope ?? "",
        redirect_uris: [],
      },
    } as unknown as OAuthClientProvider,
    resourceMetadata,
  );
  const scope = resolveEmaScopes(resourceMetadata, configuredScope);
  return {
    resourceMetadata,
    resourceAsUrl,
    resourceUrl: resourceUrl ?? undefined,
    scope,
  };
}

export async function discoverResourceAsMetadata(
  resourceAsUrl: URL,
  fetchFn?: typeof fetch,
) {
  const metadata = await discoverAuthorizationServerMetadata(resourceAsUrl, {
    fetchFn,
  });
  if (!metadata) {
    throw new Error(
      "Failed to discover resource authorization server metadata",
    );
  }
  return metadata;
}