wip

Author: brendan-kellam

packages/web/src/app/api/(server)/ee/mcp/route.ts

@@ -112,7 +112,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
             await mcpServer.connect(transport);
 
             return transport.handleRequest(request);
-        }, { requiredOAuthScopes: [SOURCEBOT_MCP_OAUTH_SCOPE] })
+        }, { requiredOAuthScopes: ['mcp'] })
     );
 
     if (isServiceError(response)) {
@@ -156,7 +156,7 @@ export const DELETE = apiHandler(async (request: NextRequest) => {
             }
 
             return session.transport.handleRequest(request);
-        }, { requiredOAuthScopes: [SOURCEBOT_MCP_OAUTH_SCOPE] })
+        }, { requiredOAuthScopes: ['mcp'] })
     );
 
     if (isServiceError(result)) {

packages/web/src/ee/features/oauth/constants.ts

@@ -5,8 +5,8 @@ export const UNPERMITTED_SCHEMES = /^(javascript|data|vbscript):/i;
 
 export const SOURCEBOT_OAUTH_SCOPES = [
     "mcp"
-];
-export type SourcebotOauthScope = (typeof SOURCEBOT_OAUTH_SCOPES)[number];
+] as const;
+export type SourcebotOAuthScope = (typeof SOURCEBOT_OAUTH_SCOPES)[number];
 
 export const SOURCEBOT_MCP_OAUTH_SCOPE = 'mcp';
 export const DEFAULT_SOURCEBOT_OAUTH_SCOPES = [SOURCEBOT_MCP_OAUTH_SCOPE] as const;

packages/web/src/ee/features/oauth/server.ts

@@ -11,10 +11,6 @@ import {
     OAUTH_REFRESH_TOKEN_PREFIX,
 } from '@sourcebot/shared';
 import crypto from 'crypto';
-import { DEFAULT_SOURCEBOT_OAUTH_SCOPES } from './constants';
-import { formatOAuthScopeString } from './utils';
-
-const DEFAULT_SOURCEBOT_OAUTH_SCOPE_STRING = formatOAuthScopeString(DEFAULT_SOURCEBOT_OAUTH_SCOPES);
 
 // Generates a random authorization code, hashes it, and stores it alongside the
 // PKCE code challenge. Returns the raw code to be sent to the client.
@@ -203,7 +199,7 @@ export async function verifyAndRotateRefreshToken({
 
     const { token, hash: newTokenHash } = generateOAuthToken();
     const { token: refreshToken, hash: newRefreshHash } = generateOAuthRefreshToken();
-    const scope = existing.scope || DEFAULT_SOURCEBOT_OAUTH_SCOPE_STRING;
+    const scope = existing.scope;
     const tokenDpopJkt = existing.dpopJkt ?? dpopJkt;
 
     await __unsafePrisma.$transaction([

packages/web/src/middleware/withAuth.ts

@@ -12,7 +12,7 @@ import { hasEntitlement, isAnonymousAccessEnabled } from "@/lib/entitlements";
 import { hasRequiredOAuthScopes, parseOAuthScopeString } from "@/ee/features/oauth/utils";
 import { DPOP_AUTH_SCHEME, DPOP_PROOF_HEADER, verifyDpopProof } from "@/ee/features/oauth/dpop";
 import { getCurrentRequest } from "@/lib/requestContext";
-import { SourcebotOauthScope } from "@/ee/features/oauth/constants";
+import { SourcebotOAuthScope } from "@/ee/features/oauth/constants";
 
 const LAST_ACTIVE_AT_THRESHOLD_MS = 5 * 60 * 1000;
 
@@ -33,7 +33,7 @@ type OptionalAuthContext =
     };
 
 type AuthOptions = {
-    requiredOAuthScopes?: readonly SourcebotOauthScope[];
+    requiredOAuthScopes?: readonly SourcebotOAuthScope[];
 };
 
 export const withAuth = async <T>(fn: (params: RequiredAuthContext) => Promise<T>, options: AuthOptions = {}) => {