notion-mcp-server/build/server/auth.js

Notion MCP server with token auth: connect Claude Code, Claude Desktop, Cursor, VS Code, Codex and any MCP client to Notion. Search, create and edit pages, query databases, comment and upload files. Runs headless in CI and agents.

import { timingSafeEqual } from "node:crypto";
function bearerToken(headers) {
    const raw = headers["authorization"] ?? headers["Authorization"];
    const value = Array.isArray(raw) ? raw[0] : raw;
    if (!value)
        return null;
    const parts = value.trim().split(/\s+/);
    if (parts.length !== 2 || parts[0].toLowerCase() !== "bearer")
        return null;
    return parts[1];
}
function constantTimeEqual(a, b) {
    // timingSafeEqual requires equal-length buffers; differing lengths are a
    // mismatch by definition (the length leak is acceptable and standard).
    if (a.length !== b.length)
        return false;
    return timingSafeEqual(Buffer.from(a), Buffer.from(b));
}
/**
 * Gate an HTTP request against the optional bearer token.
 * - No token configured  -> open (ok).
 * - Token configured, header missing/malformed -> 401.
 * - Token configured, value mismatch            -> 403.
 */
export function checkAuth(headers, expectedToken) {
    if (!expectedToken)
        return { ok: true };
    const provided = bearerToken(headers);
    if (provided === null) {
        return { ok: false, status: 401, message: "Unauthorized: missing bearer token" };
    }
    if (!constantTimeEqual(provided, expectedToken)) {
        return { ok: false, status: 403, message: "Forbidden: invalid bearer token" };
    }
    return { ok: true };
}