@upstash/context7-mcp/dist/lib/vercelMarketplaceJwt.js

MCP server for Context7

import * as jose from "jose";
const VERCEL_INTEGRATIONS_ORIGIN = "https://integrations.vercel.com";
const VERCEL_ISSUER_PATH = /^\/oac_[A-Za-z0-9]+$/;
const VERCEL_AUDIENCE_PATH = /^\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\/icfg_[A-Za-z0-9]+$/;
let jwks;
function isExpectedVercelUrl(value, pathPattern) {
    try {
        const url = new URL(value);
        return (url.origin === VERCEL_INTEGRATIONS_ORIGIN &&
            !url.username &&
            !url.password &&
            !url.search &&
            !url.hash &&
            pathPattern.test(url.pathname));
    }
    catch {
        return false;
    }
}
function getConfig() {
    const issuer = process.env.VERCEL_MARKETPLACE_OIDC_ISSUER ?? "";
    const audience = process.env.VERCEL_MARKETPLACE_OIDC_AUDIENCE ?? "";
    if (!isVercelMarketplaceIssuer(issuer) || !isExpectedVercelUrl(audience, VERCEL_AUDIENCE_PATH)) {
        return null;
    }
    return { issuer, audience };
}
function getJwks(issuer) {
    if (!jwks) {
        jwks = jose.createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks`));
    }
    return jwks;
}
export function isVercelMarketplaceIssuer(issuer) {
    return isExpectedVercelUrl(issuer, VERCEL_ISSUER_PATH);
}
export async function validateVercelMarketplaceJwt(token, tokenIssuer) {
    const config = getConfig();
    if (!config)
        return { valid: false, error: "Vercel Marketplace OIDC not configured" };
    if (tokenIssuer !== config.issuer) {
        return { valid: false, error: "Untrusted Vercel Marketplace issuer" };
    }
    const { payload } = await jose.jwtVerify(token, getJwks(config.issuer), {
        algorithms: ["RS256"],
        audience: config.audience,
        issuer: config.issuer,
        clockTolerance: 60,
    });
    if (typeof payload.resource !== "string" || !payload.resource) {
        return { valid: false, error: "Missing Vercel Marketplace resource" };
    }
    return { valid: true };
}