GE MCP OAuth Proxy — Developer Guide

export interface Env {
  TOKEN_STORE: KVNamespace;
  TARGET_MCP_URL: string;
  TOKEN_TTL_SECONDS: string;
  ALPHAVANTAGE_API_KEY: string;
  OAUTH_CLIENT_ID: string;
  OAUTH_CLIENT_SECRET: string;
  JWT_SECRET: string;
}

export interface TokenPayload {
  sub: string;        // client_id
  iat: number;        // issued at (Unix timestamp)
  exp: number;        // expiry (Unix timestamp)
  jti: string;        // unique token ID (for revocation)
}

import { TokenPayload } from "./types";

function base64url(buffer: ArrayBuffer): string {
  return btoa(String.fromCharCode(...new Uint8Array(buffer)))
    .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}

async function getKey(secret: string): Promise<CryptoKey> {
  return crypto.subtle.importKey(
    "raw",
    new TextEncoder().encode(secret),
    { name: "HMAC", hash: "SHA-256" },
    false,
    ["sign", "verify"]
  );
}

export async function signJWT(payload: TokenPayload, secret: string): Promise<string> {
  const header = base64url(new TextEncoder().encode(JSON.stringify({ alg: "HS256", typ: "JWT" })));
  const body = base64url(new TextEncoder().encode(JSON.stringify(payload)));
  const key = await getKey(secret);
  const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(`${header}.${body}`));
  return `${header}.${body}.${base64url(sig)}`;
}

export async function verifyJWT(token: string, secret: string): Promise<TokenPayload | null> {
  try {
    const [header, body, sig] = token.split(".");
    const key = await getKey(secret);
    const valid = await crypto.subtle.verify(
      "HMAC", key,
      Uint8Array.from(atob(sig.replace(/-/g, "+").replace(/_/g, "/")), c => c.charCodeAt(0)),
      new TextEncoder().encode(`${header}.${body}`)
    );
    if (!valid) return null;
    const payload: TokenPayload = JSON.parse(atob(body.replace(/-/g, "+").replace(/_/g, "/")));
    if (payload.exp < Math.floor(Date.now() / 1000)) return null;  // expired
    return payload;
  } catch {
    return null;
  }
}

import { Env, TokenPayload } from "./types";
import { signJWT } from "./jwt";

export async function handleAuthorize(request: Request, env: Env): Promise<Response> {
  const url = new URL(request.url);
  const redirectUri = url.searchParams.get("redirect_uri") ?? "";
  const state = url.searchParams.get("state") ?? "";
  const redirect = new URL(redirectUri);
  redirect.searchParams.set("code", "client_credentials_flow");
  redirect.searchParams.set("state", state);
  return Response.redirect(redirect.toString(), 302);
}

export async function handleToken(request: Request, env: Env): Promise<Response> {
  let body: Record<string, string> = {};
  const contentType = request.headers.get("content-type") ?? "";
  if (contentType.includes("application/x-www-form-urlencoded")) {
    const text = await request.text();
    body = Object.fromEntries(new URLSearchParams(text));
  } else {
    body = await request.json();
  }

  const { grant_type, client_id, client_secret } = body;

  if (grant_type !== "client_credentials" && grant_type !== "authorization_code") {
    return errorResponse("unsupported_grant_type", 400);
  }
  if (client_id !== env.OAUTH_CLIENT_ID || client_secret !== env.OAUTH_CLIENT_SECRET) {
    return errorResponse("invalid_client", 401);
  }

  const ttl = parseInt(env.TOKEN_TTL_SECONDS, 10);
  const now = Math.floor(Date.now() / 1000);
  const jti = crypto.randomUUID();
  const payload: TokenPayload = { sub: client_id, iat: now, exp: now + ttl, jti };
  const accessToken = await signJWT(payload, env.JWT_SECRET);
  await env.TOKEN_STORE.put(`token:${jti}`, "valid", { expirationTtl: ttl });

  return new Response(JSON.stringify({
    access_token: accessToken,
    token_type: "Bearer",
    expires_in: ttl,
  }), { headers: { "Content-Type": "application/json" } });
}

function errorResponse(error: string, status: number): Response {
  return new Response(JSON.stringify({ error }), {
    status,
    headers: { "Content-Type": "application/json" },
  });
}

import { Env } from "./types";
import { verifyJWT } from "./jwt";

export async function handleMCPProxy(request: Request, env: Env): Promise<Response> {
  const authHeader = request.headers.get("Authorization") ?? "";
  const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : null;
  if (!token) return new Response(JSON.stringify({ error: "missing_token" }), { status: 401 });

  const payload = await verifyJWT(token, env.JWT_SECRET);
  if (!payload) return new Response(JSON.stringify({ error: "invalid_token" }), { status: 401 });

  const kvEntry = await env.TOKEN_STORE.get(`token:${payload.jti}`);
  if (!kvEntry) return new Response(JSON.stringify({ error: "token_revoked" }), { status: 401 });

  const targetUrl = new URL(request.url);
  const upstream = new URL(env.TARGET_MCP_URL);
  targetUrl.hostname = upstream.hostname;
  targetUrl.port = upstream.port;
  targetUrl.protocol = upstream.protocol;

  const needsApiKey = env.TARGET_MCP_URL.includes("alphavantage");
  const upstreamRequest = new Request(targetUrl.toString(), {
    method: request.method,
    headers: {
      ...Object.fromEntries(request.headers),
      "X-API-Key": needsApiKey ? env.ALPHAVANTAGE_API_KEY : "",
      "Authorization": needsApiKey ? `ApiKey ${env.ALPHAVANTAGE_API_KEY}` : "",
    },
    body: request.method !== "GET" ? request.body : undefined,
  });

  const response = await fetch(upstreamRequest);
  return new Response(response.body, { status: response.status, headers: response.headers });
}

import { Env } from "./types";
import { handleAuthorize, handleToken } from "./oauth";
import { handleMCPProxy } from "./proxy";

export default {
  async fetch(request: Request, env: Env): Promise<Response> {
    const url = new URL(request.url);

    if (request.method === "OPTIONS") {
      return new Response(null, {
        headers: {
          "Access-Control-Allow-Origin": "*",
          "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
          "Access-Control-Allow-Headers": "Authorization, Content-Type",
        },
      });
    }

    if (url.pathname === "/oauth/authorize") return handleAuthorize(request, env);
    if (url.pathname === "/oauth/token" && request.method === "POST") return handleToken(request, env);
    if (url.pathname.startsWith("/mcp")) return handleMCPProxy(request, env);
    if (url.pathname === "/health") {
      return new Response(JSON.stringify({ status: "ok" }), {
        headers: { "Content-Type": "application/json" },
      });
    }

    return new Response("Not Found", { status: 404 });
  },
};