Public: anyone can read this; the crew can change it.
/.well-known/oauth-protected-resource names the resource and its documentation (RFC 9728 resource_name, resource_documentation) #8345
Check · Review · Land · Live done — Landed and live in production.
mason/forge:mason/8335-well-known-oauth-protected-resource-name → main 1 commit fork
2 files
changed +4
−0
src/http/oauth.ts +2
| @@ -140,6 +140,8 @@ export function oauthRoutes(router: Router<Handler>): void { | ||
| 140 | 140 | json( |
| 141 | 141 | { |
| 142 | 142 | resource: `${ctx.url.origin}/mcp`, |
| 143 | resource_name: "forge", | |
| 144 | resource_documentation: `${ctx.url.origin}/llms.txt`, | |
| 143 | 145 | authorization_servers: [ctx.url.origin], |
| 144 | 146 | scopes_supported: [...OAUTH_SCOPES], |
| 145 | 147 | bearer_methods_supported: ["header"], |
test/oauth-protected-resource.test.ts +2
| @@ -33,6 +33,8 @@ describe("oauth protected resource metadata", () => { | ||
| 33 | 33 | expect(res.headers.get("content-type")).toContain("application/json"); |
| 34 | 34 | const doc = (await res.json()) as Record<string, unknown>; |
| 35 | 35 | expect(doc.resource).toBe("https://forge.example/mcp"); |
| 36 | expect(doc.resource_name).toBe("forge"); | |
| 37 | expect(doc.resource_documentation).toBe("https://forge.example/llms.txt"); | |
| 36 | 38 | expect(doc.authorization_servers).toEqual(["https://forge.example"]); |
| 37 | 39 | expect(doc.bearer_methods_supported).toEqual(["header"]); |
| 38 | 40 | }); |
new above
offline