Replace the template's bearer token with OAuth

DATABASE_URL=postgres://notes:notes@localhost:5432/notes
PUBLIC_URL=http://localhost:10000

GITHUB_CLIENT_ID=Iv1.xxxxxxxxxxxxxxxx
GITHUB_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

JWT_SIGNING_SECRET=run-once-then-paste-here

import "dotenv/config";

function required(name: string): string {
  const value = process.env[name];
  if (!value) throw new Error(`Missing required env var: ${name}`);
  return value;
}

export const config = {
  port: Number(process.env.PORT ?? 10000),
  publicUrl: required("PUBLIC_URL"),
  databaseUrl: required("DATABASE_URL"),
  github: {
    clientId: required("GITHUB_CLIENT_ID"),
    clientSecret: required("GITHUB_CLIENT_SECRET"),
  },
  jwtSecret: required("JWT_SIGNING_SECRET"),
};

import { randomUUID } from "node:crypto";
import { SignJWT, jwtVerify } from "jose";
import type {
  OAuthServerProvider,
  AuthorizationParams,
} from "@modelcontextprotocol/sdk/server/auth/provider.js";
import type {
  OAuthClientInformationFull,
  OAuthTokens,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
import type { Response } from "express";

import { config } from "../config.js";

type PendingAuthorization = {
  clientId: string;
  redirectUri: string;
  codeChallenge: string;
  scopes: string[];
  state?: string;
  githubState: string;
  user?: { login: string; id: number };
};

const clients = new Map<string, OAuthClientInformationFull>();
const pending = new Map<string, PendingAuthorization>();
const codes = new Map<string, PendingAuthorization>();
const jwtKey = new TextEncoder().encode(config.jwtSecret);
const ISSUER = config.publicUrl;
const TOKEN_TTL_SECONDS = 60 * 60;

async function mintAccessToken(user: { login: string; id: number }, clientId: string, scopes: string[]): Promise<string> {
  return new SignJWT({ scope: scopes.join(" "), client_id: clientId, github_login: user.login })
   .setProtectedHeader({ alg: "HS256" })
   .setIssuer(ISSUER)
   .setAudience(`${ISSUER}/mcp`)
   .setSubject(`github:${user.id}`)
   .setIssuedAt()
   .setExpirationTime(`${TOKEN_TTL_SECONDS}s`)
   .setJti(randomUUID())
   .sign(jwtKey);
}

export const provider: OAuthServerProvider = {
  clientsStore: {
    async getClient(clientId) {
      return clients.get(clientId);
    },
    async registerClient(client) {
      const full: OAuthClientInformationFull = {
       ...client,
        client_id: client.client_id ?? randomUUID(),
        client_id_issued_at: Math.floor(Date.now() / 1000),
      };
      clients.set(full.client_id, full);
      return full;
    },
  },

  async authorize(client, params: AuthorizationParams, res: Response) {
    const githubState = randomUUID();
    pending.set(githubState, {
      clientId: client.client_id,
      redirectUri: params.redirectUri,
      codeChallenge: params.codeChallenge,
      scopes: params.scopes ?? [],
      state: params.state,
      githubState,
    });
    const url = new URL("https://github.com/login/oauth/authorize");
    url.searchParams.set("client_id", config.github.clientId);
    url.searchParams.set("redirect_uri", `${config.publicUrl}/oauth/github/callback`);
    url.searchParams.set("scope", "read:user");
    url.searchParams.set("state", githubState);
    res.redirect(url.toString());
  },

  async challengeForAuthorizationCode(_client, authorizationCode) {
    const entry = codes.get(authorizationCode);
    if (!entry) throw new Error("Unknown authorization code");
    return entry.codeChallenge;
  },

  async exchangeAuthorizationCode(client, authorizationCode, _codeVerifier) {
    const entry = codes.get(authorizationCode);
    if (!entry || entry.clientId !== client.client_id || !entry.user) {
      throw new Error("Invalid authorization code");
    }
    codes.delete(authorizationCode);
    const accessToken = await mintAccessToken(entry.user, client.client_id, entry.scopes);
    return { access_token: accessToken, token_type: "Bearer", expires_in: TOKEN_TTL_SECONDS, scope: entry.scopes.join(" ") };
  },

  async exchangeRefreshToken(): Promise<OAuthTokens> {
    throw new Error("Refresh tokens not implemented for this tutorial");
  },

  async verifyAccessToken(token): Promise<AuthInfo> {
    const { payload } = await jwtVerify(token, jwtKey, { issuer: ISSUER, audience: `${ISSUER}/mcp` });
    return {
      token,
      clientId: payload.client_id as string,
      scopes: ((payload.scope as string) ?? "").split(" ").filter(Boolean),
      expiresAt: payload.exp,
      extra: { github_login: payload.github_login as string, sub: payload.sub as string },
    };
  },
};

export function completeGithubCallback(githubState: string, user: { login: string; id: number }): { redirectUri: string; code: string; state?: string } {
  const entry = pending.get(githubState);
  if (!entry) throw new Error("Unknown GitHub state");
  pending.delete(githubState);
  entry.user = user;
  const code = randomUUID();
  codes.set(code, entry);
  setTimeout(() => codes.delete(code), 5 * 60 * 1000);
  return { redirectUri: entry.redirectUri, code, state: entry.state };
}