type OAuthMetadata = {
  issuer: string
  authorization_endpoint: string
  token_endpoint: string
  registration_endpoint?: string
}

async function discoverOAuthMetadata(mcpServerUrl: string): Promise<OAuthMetadata> {

  const url = new URL(mcpServerUrl)

  const protectedResourceUrl = new URL(
    "/.well-known/oauth-protected-resource",
    url
  )

  const protectedResourceResponse = await fetch(protectedResourceUrl.toString())

  if (!protectedResourceResponse.ok) {
    throw new Error("Failed to fetch protected resource metadata")
  }

  const protectedResource = await protectedResourceResponse.json()

  const authServerUrl = protectedResource.authorization_servers[0]

  const metadataUrl = new URL(
    "/.well-known/oauth-authorization-server",
    authServerUrl
  )

  const metadataResponse = await fetch(metadataUrl.toString())

  if (!metadataResponse.ok) {
    throw new Error("Failed to fetch authorization server metadata")
  }

  return metadataResponse.json()
}

https://api.astravue.com/.well-known/oauth-protected-resource
https://api.astravue.com/.well-known/oauth-authorization-server

import { randomBytes, createHash } from "crypto"

function base64URLEncode(buffer: Buffer): string {
  return buffer
    .toString("base64")
    .replace(/\+/g, "-")
    .replace(/\//g, "_")
    .replace(/=/g, "")
}

function generateCodeVerifier(): string {
  return base64URLEncode(randomBytes(32))
}

function generateCodeChallenge(verifier: string): string {

  const hash = createHash("sha256")
    .update(verifier)
    .digest()

  return base64URLEncode(hash)
}

const codeVerifier = generateCodeVerifier()

const codeChallenge = generateCodeChallenge(codeVerifier)

async function registerClient(metadata: OAuthMetadata, redirectUri: string) {

  const registration = {
    client_name: "Your MCP Client",
    redirect_uris: [redirectUri]
  }

  const response = await fetch(metadata.registration_endpoint!, {
    method: "POST",
    headers: {
      "Content-Type": "application/json"
    },
    body: JSON.stringify(registration)
  })

  if (!response.ok) {
    throw new Error("Client registration failed")
  }

  return response.json()
}

function buildAuthorizationUrl(
  metadata: OAuthMetadata,
  clientId: string,
  redirectUri: string,
  codeChallenge: string,
  state: string
) {

  const params = new URLSearchParams({
    response_type: "code",
    client_id: clientId,
    redirect_uri: redirectUri,
    scope: "openid profile email",
    state: state,
    code_challenge: codeChallenge,
    code_challenge_method: "S256",
    resource: mcpServerUrl
  })

  return `${metadata.authorization_endpoint}?${params}`
}

function parseCallback(url: string) {

  const params = new URLSearchParams(new URL(url).search)

  return {
    code: params.get("code"),
    state: params.get("state"),
    error: params.get("error")
  }
}

async function exchangeCodeForTokens(
  code: string,
  codeVerifier: string,
  metadata: OAuthMetadata,
  clientId: string,
  redirectUri: string
) {

  const params = new URLSearchParams({
    grant_type: "authorization_code",
    code,
    client_id: clientId,
    redirect_uri: redirectUri,
    code_verifier: codeVerifier,
    resource: "https://api.astravue.com/mcp"
  })

  const response = await fetch(metadata.token_endpoint, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: params.toString()
  })

  if (!response.ok) {
    throw new Error("Token exchange failed")
  }

  return response.json()
}

import { Client } from "@modelcontextprotocol/sdk/client/index.js"
import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js"

async function createMcpClient(accessToken: string): Promise<Client> {

  const client = new Client(
    { name: "your-mcp-client", version: "1.0.0" },
    { capabilities: { roots: {}, sampling: {} } }
  )

  const transport = new StreamableHTTPClientTransport(
    new URL("https://api.astravue.com/mcp"),
    {
      headers: {
        Authorization: `Bearer ${accessToken}`,
        "User-Agent": "YourApp-MCP-Client/1.0"
      }
    }
  )

  await client.connect(transport)

  return client
}

async function refreshAccessToken(
  refreshToken: string,
  metadata: OAuthMetadata,
  clientId: string
) {

  const params = new URLSearchParams({
    grant_type: "refresh_token",
    refresh_token: refreshToken,
    client_id: clientId
  })

  const response = await fetch(metadata.token_endpoint, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    body: params.toString()
  })

  if (!response.ok) {
    throw new Error("Token refresh failed")
  }

  return response.json()
}