import{extractTokenFromAuthHeader as s}from"../utils/jwt.js";import{getUserParamsFromCookies as a}from"../../../web-server/auth.js";function l(e){const i=!!e?.config?.requiresLogin,n=!!e?.config?.rbac&&Object.keys(e.config.rbac).length>0;return i||n}async function p(e,i){const n=e.headers.get("Authorization");if(!n)return{isAuthenticated:!1};const r=s(n),o=i?.config?.ssoDirect||{},t=r?await a(o,{authorization:r,idp_access_token:r}):{};return r&&t&&t.isAuthenticated?{isAuthenticated:!0,isTokenValid:!0,currentUser:{teams:t.teams||[],email:t.email||"",claims:t,isAuthenticated:!0,idpAccessToken:t.idpAccessToken||void 0,idpId:t.idpId||void 0}}:{isAuthenticated:!1,isTokenValid:!1}}function h(e){return new Response(JSON.stringify({error:"unauthorized",message:"Authentication required"}),{status:401,headers:{"Content-Type":"application/json","WWW-Authenticate":`Bearer realm="${e}/.well-known/oauth-protected-resource/mcp"`,"Access-Control-Allow-Origin":"*"}})}function f(){return new Response(JSON.stringify({error:"invalid_token",message:"Invalid or expired token"}),{status:401,headers:{"Content-Type":"application/json","WWW-Authenticate":'Bearer error="invalid_token", error_description="Invalid or expired token"',"Access-Control-Allow-Origin":"*"}})}export{f as constructInvalidTokenResponse,h as constructUnauthorizedResponse,p as handleMcpAuth,l as shouldHandleMcpAuth};
