| 116 | 133 | | documentation: `${SITE}/features/mcp`, |
| 117 | 134 | | }; |
| 118 | 135 | | |
| 136 | + | // OAuth 2.0 Authorization Server Metadata (RFC 8414). `issuer` is the only |
| 137 | + | // required field; we declare zero supported grants and zero supported |
| 138 | + | // response types, which is the spec-conformant way to publish "this site |
| 139 | + | // has no OAuth flows." A scanner looking for an authentication entry point |
| 140 | + | // finds the document; a real OAuth client finds nothing to attempt. |
| 141 | + | const oauthAuthorizationServer = { |
| 142 | + | issuer: SITE, |
| 143 | + | grant_types_supported: [], |
| 144 | + | response_types_supported: [], |
| 145 | + | // Extension field — RFC 8414 §2 permits additional metadata. Used here to |
| 146 | + | // make the public/anonymous nature human-readable for anyone curl'ing |
| 147 | + | // the endpoint. |
| 148 | + | comment: |
| 149 | + | "react-server.dev publishes only public, anonymous documentation. No OAuth flows are supported because no protected resources exist. See /.well-known/oauth-protected-resource for the protected-resource declaration.", |
| 150 | + | }; |
| 151 | + | |
| 152 | + | // OAuth 2.0 Protected Resource Metadata (RFC 9728). An empty |
| 153 | + | // `authorization_servers` array is the spec-correct signal that no issuer |
| 154 | + | // can mint tokens for this resource — i.e. the resource is public and no |
| 155 | + | // authentication is required. |
| 156 | + | const oauthProtectedResource = { |
| 157 | + | resource: SITE, |
| 158 | + | authorization_servers: [], |
| 159 | + | scopes_supported: [], |
| 160 | + | bearer_methods_supported: [], |
| 161 | + | comment: |
| 162 | + | "All resources at https://react-server.dev are public and require no authentication. No authorization servers issue tokens for this resource.", |
| 163 | + | }; |
| 164 | + | |
| 119 | 165 | | // Discovery endpoints MUST be CORS-readable (RFC 8615 / SEP-1649 §CORS). |
| 120 | 166 | | const CORS_HEADERS = { |
| 121 | 167 | | "Access-Control-Allow-Origin": "*", |