feedback

Author: brendan-kellam

packages/web/src/app/api/(server)/ee/.well-known/oauth-protected-resource/route.ts

@@ -0,0 +1,16 @@
+import { apiHandler } from '@/lib/apiHandler';
+import { env } from '@sourcebot/shared';
+
+// RFC 9728: OAuth 2.0 Protected Resource Metadata
+// Tells OAuth clients which authorization server protects this resource.
+// @see: https://datatracker.ietf.org/doc/html/rfc9728
+export const GET = apiHandler(async () => {
+    const issuer = env.AUTH_URL.replace(/\/$/, '');
+
+    return Response.json({
+        resource: `${issuer}/api/mcp`,
+        authorization_servers: [
+            issuer
+        ],
+    });
+}, { track: false });