mcp-wayback-machine
Version:
MCP server and CLI tool for interacting with the Wayback Machine without API keys
63 lines • 2.08 kB
JavaScript
/**
* Pluggable authentication for the MCP server transport.
*
* AuthProvider is called before each request reaches the MCP transport.
* Return undefined to allow the request through, or a Response to reject it.
*
* Implementations:
* - StaticTokenAuthProvider — shared bearer token from an environment variable
* (simple, suitable for personal/team deployments)
*
* Worker deployments wire an AuthProvider in worker.ts.
* Stdio mode doesn't need one (local process, no network boundary).
*/
/**
* Static bearer token authentication.
*
* Compares the Authorization header against a single shared token.
* Uses constant-time comparison to prevent timing attacks.
*/
export class StaticTokenAuthProvider {
expectedToken;
constructor(token) {
this.expectedToken = token;
}
validate(request) {
const header = request.headers.get("Authorization");
if (header === null) {
return Promise.resolve(unauthorized("Missing Authorization header"));
}
const match = /^Bearer\s+(.+)$/i.exec(header);
if (match === null) {
return Promise.resolve(unauthorized("Invalid Authorization header format"));
}
const token = match[1] ?? "";
if (token === "" || !constantTimeEqual(token, this.expectedToken)) {
return Promise.resolve(unauthorized("Invalid token"));
}
return Promise.resolve(undefined);
}
}
function unauthorized(message) {
return new Response(JSON.stringify({ error: message }), {
status: 401,
headers: {
"content-type": "application/json",
"WWW-Authenticate": 'Bearer realm="mcp-wayback-machine"',
},
});
}
/**
* Constant-time string comparison to prevent timing side-channels.
*/
function constantTimeEqual(a, b) {
if (a.length !== b.length) {
return false;
}
let result = 0;
for (let i = 0; i < a.length; i++) {
result |= a.charCodeAt(i) ^ b.charCodeAt(i);
}
return result === 0;
}
//# sourceMappingURL=provider.js.map