shadowdaoandClaude Opus 4.7
077d0a0825
End-to-end Phase 1 of shared-memory: a logged-in Authentik user can sign into the Web UI (/me debug page), and an MCP client with an Authentik- issued bearer token can call memory.write / memory.list / memory.get / memory.delete plus project.identify against /api/mcp. Stack: - Next.js 15 (App Router) + React 19 + TypeScript, pnpm workspaces - Drizzle ORM + Postgres 16 + pgvector + pg_trgm - Auth.js v5 with Authentik provider (Web UI) - jose + Authentik JWKS for MCP bearer-token validation - JSON-RPC 2.0 dispatcher implementing the MCP wire protocol over plain HTTP POST (hand-rolled to fit Next.js App Router; switches to SSE in a later phase if server-initiated events are needed) - bge-small embeddings sidecar deferred to Phase 2; the schema already reserves the vector(384) column + IVFFlat index, FTS via a STORED tsvector column, and the visibility enum (private/shared/team) so cross-user memory sharing can be added without a future migration Deployment supports two modes (set in .env, never committed): - Behind an external reverse proxy (HAProxy / nginx / Cloudflare Tunnel / Traefik) — DEFAULT; the app exposes APP_PORT on the host with X-Forwarded-* trusted, no in-container TLS - Built-in TLS via Caddy — opt-in with `docker compose --profile tls up` Discovery endpoint at /.well-known/oauth-protected-resource (RFC 9728) points MCP clients at the Authentik authorization server after a 401. README walks through both Authentik providers (Web UI + MCP resource server), the audience scope mapping, redirect URIs, and includes a worked HAProxy config snippet. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
81 lines
2.4 KiB
TypeScript
81 lines
2.4 KiB
TypeScript
import { NextResponse } from "next/server";
|
|
import { authenticateBearer, UnauthorizedError } from "@/lib/auth/jwt";
|
|
import { userContextFromClaims } from "@/lib/mcp/context";
|
|
import { dispatchMcpMessage } from "@/lib/mcp/server";
|
|
|
|
export const runtime = "nodejs";
|
|
export const dynamic = "force-dynamic";
|
|
|
|
/**
|
|
* MCP streamable-HTTP endpoint.
|
|
*
|
|
* Auth: Bearer token (Authentik-issued JWT). Unauthed requests get 401 with
|
|
* a WWW-Authenticate header pointing at our RFC 9728 resource metadata
|
|
* so MCP clients can discover the authorization server.
|
|
*
|
|
* Body: JSON-RPC 2.0 message (request or notification).
|
|
*
|
|
* Reply: For requests, the JSON-RPC response in the body with
|
|
* `Content-Type: application/json`.
|
|
* For notifications, HTTP 202 with empty body.
|
|
*/
|
|
|
|
export async function POST(req: Request) {
|
|
// ---- auth ----
|
|
let claims;
|
|
try {
|
|
claims = await authenticateBearer(req.headers.get("authorization"));
|
|
} catch (e) {
|
|
if (e instanceof UnauthorizedError) {
|
|
return new NextResponse(JSON.stringify({ error: e.reason }), {
|
|
status: 401,
|
|
headers: {
|
|
"WWW-Authenticate": e.wwwAuthenticate,
|
|
"Content-Type": "application/json",
|
|
},
|
|
});
|
|
}
|
|
throw e;
|
|
}
|
|
|
|
// ---- parse body ----
|
|
let body: unknown;
|
|
try {
|
|
body = await req.json();
|
|
} catch {
|
|
return NextResponse.json(
|
|
{ jsonrpc: "2.0", id: null, error: { code: -32700, message: "parse error" } },
|
|
{ status: 400 },
|
|
);
|
|
}
|
|
|
|
// ---- resolve user, dispatch ----
|
|
const ctx = await userContextFromClaims(claims);
|
|
|
|
// MCP supports batched requests (array) and single. Handle both.
|
|
if (Array.isArray(body)) {
|
|
const responses = await Promise.all(body.map((m) => dispatchMcpMessage(m, ctx)));
|
|
const filtered = responses.filter((r) => r !== null);
|
|
if (filtered.length === 0) {
|
|
return new NextResponse(null, { status: 202 });
|
|
}
|
|
return NextResponse.json(filtered, { status: 200 });
|
|
}
|
|
|
|
const response = await dispatchMcpMessage(body, ctx);
|
|
if (response === null) {
|
|
// Notification — no body expected.
|
|
return new NextResponse(null, { status: 202 });
|
|
}
|
|
return NextResponse.json(response, { status: 200 });
|
|
}
|
|
|
|
// MCP clients sometimes probe with GET (for SSE). We don't support
|
|
// server-initiated events in Phase 1 — return 405 with a discoverable header.
|
|
export function GET() {
|
|
return new NextResponse(null, {
|
|
status: 405,
|
|
headers: { Allow: "POST" },
|
|
});
|
|
}
|