Protect an MCP or UCP service

// aigw.mjs// SKETCH. Built only on the contract AIGW documents for this release.// Not an official SDK. Review error handling, timeouts and logging before production.import express from "express";import { createRemoteJWKSet, jwtVerify } from "jose";const MCP_ORIGIN = "https://mcp.example.com";const PRM_URL = MCP_ORIGIN + "/.well-known/oauth-protected-resource";const AIGW_AS = process.env.AIGW_AUTHORIZATION_SERVER;   // https://api.aigw.eval.loginid.ai/<RESOURCE_ID>const RESOURCE = process.env.AIGW_RESOURCE_INDICATOR;    // e.g. https://api.example.com/searchconst TOKEN_URL = "https://core.api.aigw.eval.loginid.ai/oauth2/token";const REDEEM_URL = "https://api.aigw.eval.loginid.ai/api/credentials/token";// Discovery gives the core issuer and JWKS that sign agent-facing AIGW tokens.const discovery = await fetch(AIGW_AS + "/.well-known/openid-configuration").then((r) => r.json());const jwks = createRemoteJWKSet(new URL(discovery.jwks_uri));function challenge(res) {  res.set("WWW-Authenticate", 'Bearer resource_metadata="' + PRM_URL + '"');  return res.status(401).end();}// 1. Validate the agent's AIGW token, or send the agent into discovery.export async function requireAigw(req, res, next) {  const [scheme, token] = (req.get("authorization") || "").split(" ");  if (scheme !== "Bearer" || !token) return challenge(res);  try {    // jwtVerify checks the signature and exp, plus the issuer and audience given here.    const { payload } = await jwtVerify(token, jwks, {      issuer: discovery.issuer,      audience: RESOURCE,    });    req.aigw = { token, claims: payload };    return next();  } catch {    return challenge(res);  }}// 2. Proxy token: client_credentials with HTTP Basic, cached until near expiry.let proxy = { token: "", expiresAt: 0 };async function getProxyToken() {  if (proxy.token && Date.now() < proxy.expiresAt - 60_000) return proxy.token;  const basic = Buffer.from(    process.env.AIGW_PROXY_CLIENT_ID + ":" + process.env.AIGW_PROXY_CLIENT_SECRET,  ).toString("base64");  const r = await fetch(TOKEN_URL, {    method: "POST",    headers: {      Authorization: "Basic " + basic,      "Content-Type": "application/x-www-form-urlencoded",    },    body: "grant_type=client_credentials",  });  if (!r.ok) throw new Error("Proxy auth failed: " + r.status);  const body = await r.json(); // standard OAuth 2.0 token response  proxy = { token: body.access_token, expiresAt: Date.now() + body.expires_in * 1000 };  return proxy.token;}// 3. Redeem the merchant token for this user and Resource.async function redeemMerchantToken(aigwToken) {  const r = await fetch(REDEEM_URL, {    method: "POST",    headers: {      Authorization: "Bearer " + aigwToken,      "X-Proxy-Token": await getProxyToken(),      "Content-Type": "application/json",    },    body: JSON.stringify({ resource: RESOURCE }),  });  // 410 reauthentication_required: the user must authorize again.  if (r.status === 410) throw new Error("reauthentication_required");  if (!r.ok) throw new Error("Redemption failed: " + r.status);  const body = await r.json(); // access_token; expires_at and scopes can be absent  return body.access_token;}const app = express();app.use(express.json());app.get("/.well-known/oauth-protected-resource", (req, res) => {  res.json({ resource: MCP_ORIGIN, authorization_servers: [AIGW_AS] });});app.post("/mcp", requireAigw, async (req, res) => {  const merchantToken = await redeemMerchantToken(req.aigw.token);  const r = await fetch("https://api.merchant.example/products?q=shoe", {    headers: { Authorization: "Bearer " + merchantToken },  });  // 4. Return business data only. Never the merchant token or the Proxy token.  res.json(await r.json());});app.listen(8787);