[{"_1":2,"_631":-5,"_632":-5},"loaderData",{"_3":4,"_387":388,"_501":502},"root",{"_5":6,"_11":-5,"_12":13,"_14":-5,"_15":16,"_17":18,"_126":127,"_129":130,"_131":16,"_132":133,"_197":135,"_198":137,"_138":139,"_199":200,"_221":222,"_246":-5,"_247":-7,"_248":249},"userId",{"_7":8,"_9":10},"id","k9j3e58gbpmr9b3jm0r1dxf3","type","cookie.clientId","preferences","progress",[],"user","userHasAccess",false,"apps",[19,26,30,34,38,42,46,50,54,58,62,66,70,74,78,82,86,90,94,98,102,106,110,114,118,122],{"_20":21,"_22":23,"_24":25},"name","01.01.problem","fullPath","/myapp/workshop-content/exercises/01.discovery/01.problem.cors","relativePath","exercises/01.discovery/01.problem.cors",{"_20":27,"_22":28,"_24":29},"01.01.solution","/myapp/workshop-content/exercises/01.discovery/01.solution.cors","exercises/01.discovery/01.solution.cors",{"_20":31,"_22":32,"_24":33},"01.02.problem","/myapp/workshop-content/exercises/01.discovery/02.problem.as","exercises/01.discovery/02.problem.as",{"_20":35,"_22":36,"_24":37},"01.02.solution","/myapp/workshop-content/exercises/01.discovery/02.solution.as","exercises/01.discovery/02.solution.as",{"_20":39,"_22":40,"_24":41},"01.03.problem","/myapp/workshop-content/exercises/01.discovery/03.problem.pr","exercises/01.discovery/03.problem.pr",{"_20":43,"_22":44,"_24":45},"01.03.solution","/myapp/workshop-content/exercises/01.discovery/03.solution.pr","exercises/01.discovery/03.solution.pr",{"_20":47,"_22":48,"_24":49},"02.01.problem","/myapp/workshop-content/exercises/02.init/01.problem.authenticate","exercises/02.init/01.problem.authenticate",{"_20":51,"_22":52,"_24":53},"02.01.solution","/myapp/workshop-content/exercises/02.init/01.solution.authenticate","exercises/02.init/01.solution.authenticate",{"_20":55,"_22":56,"_24":57},"02.02.problem","/myapp/workshop-content/exercises/02.init/02.problem.params","exercises/02.init/02.problem.params",{"_20":59,"_22":60,"_24":61},"02.02.solution","/myapp/workshop-content/exercises/02.init/02.solution.params","exercises/02.init/02.solution.params",{"_20":63,"_22":64,"_24":65},"03.01.problem","/myapp/workshop-content/exercises/03.auth-info/01.problem.introspect","exercises/03.auth-info/01.problem.introspect",{"_20":67,"_22":68,"_24":69},"03.01.solution","/myapp/workshop-content/exercises/03.auth-info/01.solution.introspect","exercises/03.auth-info/01.solution.introspect",{"_20":71,"_22":72,"_24":73},"03.02.problem","/myapp/workshop-content/exercises/03.auth-info/02.problem.error","exercises/03.auth-info/02.problem.error",{"_20":75,"_22":76,"_24":77},"03.02.solution","/myapp/workshop-content/exercises/03.auth-info/02.solution.error","exercises/03.auth-info/02.solution.error",{"_20":79,"_22":80,"_24":81},"03.03.problem","/myapp/workshop-content/exercises/03.auth-info/03.problem.active","exercises/03.auth-info/03.problem.active",{"_20":83,"_22":84,"_24":85},"03.03.solution","/myapp/workshop-content/exercises/03.auth-info/03.solution.active","exercises/03.auth-info/03.solution.active",{"_20":87,"_22":88,"_24":89},"04.01.problem","/myapp/workshop-content/exercises/04.user/01.problem.token","exercises/04.user/01.problem.token",{"_20":91,"_22":92,"_24":93},"04.01.solution","/myapp/workshop-content/exercises/04.user/01.solution.token","exercises/04.user/01.solution.token",{"_20":95,"_22":96,"_24":97},"04.02.problem","/myapp/workshop-content/exercises/04.user/02.problem.user","exercises/04.user/02.problem.user",{"_20":99,"_22":100,"_24":101},"04.02.solution","/myapp/workshop-content/exercises/04.user/02.solution.user","exercises/04.user/02.solution.user",{"_20":103,"_22":104,"_24":105},"05.01.problem","/myapp/workshop-content/exercises/05.scopes/01.problem.check-scopes","exercises/05.scopes/01.problem.check-scopes",{"_20":107,"_22":108,"_24":109},"05.01.solution","/myapp/workshop-content/exercises/05.scopes/01.solution.check-scopes","exercises/05.scopes/01.solution.check-scopes",{"_20":111,"_22":112,"_24":113},"05.02.problem","/myapp/workshop-content/exercises/05.scopes/02.problem.validate-sufficient-scope","exercises/05.scopes/02.problem.validate-sufficient-scope",{"_20":115,"_22":116,"_24":117},"05.02.solution","/myapp/workshop-content/exercises/05.scopes/02.solution.validate-sufficient-scope","exercises/05.scopes/02.solution.validate-sufficient-scope",{"_20":119,"_22":120,"_24":121},"05.03.problem","/myapp/workshop-content/exercises/05.scopes/03.problem.scope-hints","exercises/05.scopes/03.problem.scope-hints",{"_20":123,"_22":124,"_24":125},"05.03.solution","/myapp/workshop-content/exercises/05.scopes/03.solution.scope-hints","exercises/05.scopes/03.solution.scope-hints","repoUpdates",{"_128":16},"updatesAvailable","unmutedNotifications",[],"exerciseChanges","workshopConfig",{"_134":135,"_136":137,"_138":139,"_145":146,"_163":164,"_166":167,"_168":169,"_170":171,"_179":180,"_185":186,"_189":190,"_191":192,"_193":194},"title","MCP Auth 🔐","subtitle","Build remote MCP servers with users","instructor",{"_20":140,"_141":142,"_143":144},"Kent C. Dodds","avatar","/images/instructor.png","𝕏","kentcdodds","product",{"_147":148,"_149":150,"_151":152,"_153":154,"_155":156,"_157":158,"_159":160},"host","www.epicai.pro","displayName","EpicAI.pro","displayNameShort","Epic AI","logo","/logo.svg","slug","day-7-8-mcp-auth","discordChannelId","1409600723716411494","discordTags",[161,162],"1409601169801871410","1409601460185989231","onboardingVideo",[165],"https://www.epicai.pro/get-started-with-epic-ai-workshops","githubRepo","https://github.com/epicweb-dev/mcp-auth","githubRoot","https://github.com/epicweb-dev/mcp-auth/tree/main","stackBlitzConfig",{"_172":173,"_174":175,"_176":177,"_178":175},"view","editor","hidedevtools","1","terminalHeight","0","hideNavigation","forms",{"_181":182,"_183":184},"workshop","https://docs.google.com/forms/d/e/1FAIpQLSdRmj9p8-5zyoqRzxp3UpqSbC3aFkweXvvJIKes0a5s894gzg/viewform?hl=en&embedded=true&entry.2123647600={workshopTitle}","exercise","https://docs.google.com/forms/d/e/1FAIpQLSf3o9xyjQepTlOTH5Z7ZwkeSTdXh6YWI_RGc9KiyD3oUN0p6w/viewform?hl=en&embedded=true&entry.1836176234={workshopTitle}&entry.428900931={exerciseTitle}","testTab",{"_187":188},"enabled",true,"initialRoute","/","notifications",[],"sidecarProcesses",{"_195":196},"EpicMeApp","npm run dev --silent --prefix ./epicshop/epic-me -- --clearScreen=false --logLevel=error --strictPort","workshopTitle","workshopSubtitle","ENV",{"_201":202,"_203":204,"_205":206,"_207":167,"_208":169,"_209":188,"_210":211,"_212":213,"_214":215,"_216":188,"_217":218,"_219":220},"MODE","production","EPICSHOP_CONTEXT_CWD","/myapp/workshop-content","EPICSHOP_WORKSHOP_INSTANCE_ID","4e1570b81d1baf3d16bd3a08ece570cb","EPICSHOP_GITHUB_REPO","EPICSHOP_GITHUB_ROOT","EPICSHOP_DEPLOYED","EPICSHOP_APP_VERSION","6.38.0","EPICSHOP_PARENT_PORT","3742","EPICSHOP_PARENT_TOKEN","788ad70ef086eb433023ae02a23880af46459eba30b9d2d1cb0eb8fa64fd6f82","EPICSHOP_IS_PUBLISHED","SENTRY_DSN","https://cd51fbf4ca0834f7b3529a478a8ece4c@o913766.ingest.us.sentry.io/4509630082252800","SENTRY_PROJECT_ID","4509630082252800","requestInfo",{"_223":224,"_225":226,"_227":228,"_229":230,"_231":230,"_232":233,"_240":241,"_242":243,"_244":190,"_245":188},"protocol","http:","hostname","mcp-auth.epicai.pro","port","","origin","http://mcp-auth.epicai.pro","domain","hints",{"_234":235,"_236":237,"_238":239},"theme","light","timeZone","UTC","reducedMotion","no-preference","path","/exercise/05/finished","session",{"_234":-5},"separator","online","toast","confettiId","presence",{"_250":251},"users",[252,270,278,286,294,304,311,317,324,332,339,346,353,358,363,368,372,378,384],{"_7":253,"_254":188,"_255":256,"_257":258,"_20":259,"_260":261},"3ee89ee5-8953-45d1-b5ab-ad021cd9d0c2","hasAccess","imageUrlSmall","https://avatars.githubusercontent.com/u/26024074?v=4&size=64","imageUrlLarge","https://avatars.githubusercontent.com/u/26024074?v=4&size=512","Rob Mellett","location",{"_197":262,"_229":263,"_183":264},"MCP Fundamentals 🧱","http://localhost:5639",{"_9":265,"_266":267,"_268":269},"solution","exerciseNumber",3,"stepNumber",2,{"_7":271,"_254":188,"_255":272,"_257":273,"_20":274,"_260":275},"dc4556a7-3ce2-4302-b607-de6f7993c71e","https://avatars.githubusercontent.com/u/23313?v=4&size=64","https://avatars.githubusercontent.com/u/23313?v=4&size=512","Leonhard Melzer",{"_197":262,"_229":263,"_183":276},{"_266":277},4,{"_7":279,"_254":188,"_255":280,"_257":281,"_20":282,"_260":283},"1569790b-c1b2-4871-949f-fcb53ef12b5a","https://www.gravatar.com/avatar/ac5f77198a2eb7fb5839189e12c35a45?size=64&default=identicon","https://www.gravatar.com/avatar/ac5f77198a2eb7fb5839189e12c35a45?size=512&default=identicon","Gábor",{"_197":262,"_229":263,"_183":284},{"_9":285,"_266":267,"_268":269},"problem",{"_7":287,"_254":188,"_255":288,"_257":289,"_20":290,"_260":291},"26e2e3af-33f4-46c0-bcb6-8f162ad2381a","https://www.gravatar.com/avatar/f66b9d47e75f9386670d1324b551737c?size=64&default=identicon","https://www.gravatar.com/avatar/f66b9d47e75f9386670d1324b551737c?size=512&default=identicon","Priya",{"_197":292,"_229":263,"_183":293},"MCP UI 🪟",{"_266":267},{"_7":295,"_254":188,"_255":296,"_257":297,"_20":298,"_260":299},"f892a131-a33f-49ab-b374-9b6ad5baf63f","https://www.gravatar.com/avatar/834167044d8b2abf9505da4e4b120525?size=64&default=identicon","https://www.gravatar.com/avatar/834167044d8b2abf9505da4e4b120525?size=512&default=identicon","Bautista",{"_197":300,"_229":301,"_183":302},"Advanced MCP Features 🐡","http://localhost:5640",{"_9":265,"_266":277,"_268":303},1,{"_7":305,"_254":188,"_255":306,"_257":307,"_20":308,"_260":309},"a583c43c-da8e-4d41-9687-5ba5c422cdc3","https://avatars.githubusercontent.com/u/571764?v=4&size=64","https://avatars.githubusercontent.com/u/571764?v=4&size=512","Shaun Church",{"_197":300,"_229":301,"_183":310},{"_266":269},{"_7":312,"_254":188,"_255":313,"_257":314,"_20":315,"_260":316},"505b581e-dddc-483b-857b-2f87dcc0f77e","https://avatars.githubusercontent.com/u/996667?v=4&size=64","https://avatars.githubusercontent.com/u/996667?v=4&size=512","James G",{"_197":292,"_229":263},{"_7":318,"_254":188,"_255":319,"_257":320,"_20":321,"_260":322},"70078aa1-7b41-40f4-9930-79013303627b","https://avatars.githubusercontent.com/u/4356894?v=4&size=64","https://avatars.githubusercontent.com/u/4356894?v=4&size=512","Thor Anderson",{"_197":262,"_229":263,"_183":323},{"_9":285,"_266":269,"_268":269},{"_7":325,"_254":188,"_255":326,"_257":327,"_20":328,"_260":329},"1c7280fe-b2ca-4416-9d2e-11e4fa91e655","https://cdn.discordapp.com/avatars/603759289391382556/8c5277b23a4e81afd524afce2dc19dc2.png?size=64","https://cdn.discordapp.com/avatars/603759289391382556/8c5277b23a4e81afd524afce2dc19dc2.png?size=512","Lenin",{"_197":330,"_229":263,"_183":331},"React Suspense 🔀",{"_9":265,"_266":303,"_268":277},{"_7":333,"_254":188,"_255":334,"_257":335,"_20":336,"_260":337},"c0598a97-02da-42a8-9138-c316ed10dd38","https://cdn.discordapp.com/avatars/520259965022109697/2d82acce05f0a2c5cbebaccf52da5a2f.png?size=64","https://cdn.discordapp.com/avatars/520259965022109697/2d82acce05f0a2c5cbebaccf52da5a2f.png?size=512","Andrea",{"_197":262,"_229":263,"_183":338},{"_9":285,"_266":303,"_268":303},{"_7":340,"_254":188,"_255":341,"_257":342,"_20":343,"_260":344},"15837a67-5bc7-4128-b17b-d81678ee897e","https://www.gravatar.com/avatar/9cc69f7970a625abf97b56c9fa39e368?size=64&default=identicon","https://www.gravatar.com/avatar/9cc69f7970a625abf97b56c9fa39e368?size=512&default=identicon","Cris Curelaru",{"_197":330,"_229":263,"_183":345},{"_9":285,"_266":277,"_268":267},{"_7":347,"_254":188,"_255":348,"_257":349,"_20":350,"_260":351},"afcb5fbb-9f5e-4dcc-a201-f6b2b7c22aaf","https://www.gravatar.com/avatar/3906494abe29e7418425dbce15264502?size=64&default=identicon","https://www.gravatar.com/avatar/3906494abe29e7418425dbce15264502?size=512&default=identicon","Yuri",{"_197":262,"_229":263,"_183":352},{"_9":285,"_266":277,"_268":269},{"_7":354,"_260":355},"aq38zg084qz7ktvv5o2xwpx4",{"_197":300,"_229":356,"_183":357},"http://advanced-mcp-features.epicai.pro",{"_266":303},{"_7":359,"_260":360},"om77wrmavjuumamohwfgd162",{"_197":262,"_229":361,"_183":362},"http://mcp-fundamentals.epicai.pro",{"_9":285,"_266":267,"_268":303},{"_7":364,"_260":365},"nof53tqvccavh7s7x9n7ya4z",{"_197":366,"_229":263,"_183":367},"Advanced React APIs 🔥",{"_9":285,"_266":269,"_268":303},{"_7":369,"_260":370},"u63hsmybif4htjcjnade7y0v",{"_197":371,"_229":263},"React Fundamentals ⚛",{"_7":373,"_260":374},"e1jo3lz8fa2j36qsepoqk1th",{"_197":375,"_229":301,"_183":376},"React Hooks 🎣",{"_9":285,"_266":303,"_268":377},5,{"_7":379,"_254":188,"_255":380,"_257":381,"_20":-5,"_260":382},"8259309a-6638-420d-b1b3-a8b01d434ca8","https://www.gravatar.com/avatar/49fd96335e12420f0e6446279fb9b6bf?size=64&default=identicon","https://www.gravatar.com/avatar/49fd96335e12420f0e6446279fb9b6bf?size=512&default=identicon",{"_197":292,"_229":263,"_183":383},{"_9":285,"_266":303,"_268":303},{"_7":8,"_260":385},{"_197":135,"_229":230,"_183":386},{"_266":377,"_268":-5,"_9":-5},"routes/_app+/_layout",{"_197":135,"_389":390,"_497":498,"_500":16},"exercises",[391,417,434,457,474],{"_266":303,"_134":392,"_393":394,"_401":402,"_406":407},"Metadata Discovery","solutions",[395,397,399],{"_268":303,"_134":396,"_20":27},"CORS",{"_268":269,"_134":398,"_20":35},"Auth Server Metadata",{"_268":267,"_134":400,"_20":43},"Protected Resource","problems",[403,404,405],{"_268":303,"_134":396,"_20":21},{"_268":269,"_134":398,"_20":31},{"_268":267,"_134":400,"_20":39},"steps",[408,411,414],{"_268":303,"_134":396,"_20":21,"_285":409,"_265":410},{"_20":21,"_134":396},{"_20":27,"_134":396},{"_268":269,"_134":398,"_20":31,"_285":412,"_265":413},{"_20":31,"_134":398},{"_20":35,"_134":398},{"_268":267,"_134":400,"_20":39,"_285":415,"_265":416},{"_20":39,"_134":400},{"_20":43,"_134":400},{"_266":269,"_134":418,"_393":419,"_401":424,"_406":427},"Initialize OAuth Flow",[420,422],{"_268":303,"_134":421,"_20":51},"Authenticate Header",{"_268":269,"_134":423,"_20":59},"Auth Params",[425,426],{"_268":303,"_134":421,"_20":47},{"_268":269,"_134":423,"_20":55},[428,431],{"_268":303,"_134":421,"_20":47,"_285":429,"_265":430},{"_20":47,"_134":421},{"_20":51,"_134":421},{"_268":269,"_134":423,"_20":55,"_285":432,"_265":433},{"_20":55,"_134":423},{"_20":59,"_134":423},{"_266":267,"_134":435,"_393":436,"_401":443,"_406":447},"Auth Info",[437,439,441],{"_268":303,"_134":438,"_20":67},"Introspect",{"_268":269,"_134":440,"_20":75},"Invalid Token Error",{"_268":267,"_134":442,"_20":83},"Token Active",[444,445,446],{"_268":303,"_134":438,"_20":63},{"_268":269,"_134":440,"_20":71},{"_268":267,"_134":442,"_20":79},[448,451,454],{"_268":303,"_134":438,"_20":63,"_285":449,"_265":450},{"_20":63,"_134":438},{"_20":67,"_134":438},{"_268":269,"_134":440,"_20":71,"_285":452,"_265":453},{"_20":71,"_134":440},{"_20":75,"_134":440},{"_268":267,"_134":442,"_20":79,"_285":455,"_265":456},{"_20":79,"_134":442},{"_20":83,"_134":442},{"_266":277,"_134":458,"_393":459,"_401":464,"_406":467},"Using the User",[460,462],{"_268":303,"_134":461,"_20":91},"Client Token",{"_268":269,"_134":463,"_20":99},"Require User",[465,466],{"_268":303,"_134":461,"_20":87},{"_268":269,"_134":463,"_20":95},[468,471],{"_268":303,"_134":461,"_20":87,"_285":469,"_265":470},{"_20":87,"_134":461},{"_20":91,"_134":461},{"_268":269,"_134":463,"_20":95,"_285":472,"_265":473},{"_20":95,"_134":463},{"_20":99,"_134":463},{"_266":377,"_134":475,"_393":476,"_401":483,"_406":487},"Scopes",[477,479,481],{"_268":303,"_134":478,"_20":107},"Check Scopes",{"_268":269,"_134":480,"_20":115},"Validate Sufficient Scope",{"_268":267,"_134":482,"_20":123},"Scope Hints",[484,485,486],{"_268":303,"_134":478,"_20":103},{"_268":269,"_134":480,"_20":111},{"_268":267,"_134":482,"_20":119},[488,491,494],{"_268":303,"_134":478,"_20":103,"_285":489,"_265":490},{"_20":103,"_134":478},{"_20":107,"_134":478},{"_268":269,"_134":480,"_20":111,"_285":492,"_265":493},{"_20":111,"_134":480},{"_20":115,"_134":480},{"_268":267,"_134":482,"_20":119,"_285":495,"_265":496},{"_20":119,"_134":482},{"_20":123,"_134":482},"playground",{"_499":-5,"_266":-2,"_268":-2,"_9":-7},"appName","isMenuOpened","routes/_app+/exercise+/$exerciseNumber_.finished",{"_503":504,"_197":135,"_183":505,"_612":613,"_614":615,"_616":617,"_621":622,"_627":628},"articleId","workshop-mcp-auth-5-finished",{"_22":506,"_266":377,"_507":508,"_134":475,"_509":510,"_511":512,"_513":514,"_516":517,"_406":519,"_401":586,"_393":599},"/myapp/workshop-content/exercises/05.scopes","dirName","05.scopes","instructionsCode","var Component=(()=>{var m=Object.create;var r=Object.defineProperty;var p=Object.getOwnPropertyDescriptor;var f=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var y=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports),u=(s,e)=>{for(var t in e)r(s,t,{get:e[t],enumerable:!0})},o=(s,e,t,l)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let n of f(e))!x.call(s,n)&&n!==t&&r(s,n,{get:()=>e[n],enumerable:!(l=p(e,n))||l.enumerable});return s};var k=(s,e,t)=>(t=s!=null?m(b(s)):{},o(e||!s||!s.__esModule?r(t,\"default\",{value:s,enumerable:!0}):t,s)),g=s=>o(r({},\"__esModule\",{value:!0}),s);var c=y((M,i)=>{i.exports=_jsx_runtime});var C={};u(C,{default:()=>h,frontmatter:()=>v});var a=k(c()),v=void 0;function d(s){let e={a:\"a\",code:\"code\",div:\"div\",h1:\"h1\",h2:\"h2\",li:\"li\",ol:\"ol\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",ul:\"ul\",...s.components},{EpicVideo:t}=e;return t||w(\"EpicVideo\",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{children:\"Scopes\"}),`\n`,(0,a.jsx)(t,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/intro-to-scopes-kpt4u\"}),`\n`,(0,a.jsx)(e.p,{children:\"When building secure MCP servers, you need fine-grained control over what authenticated users can access. OAuth scopes provide this control by allowing you to define specific permissions that clients must request and users must grant. Without proper scope validation, your MCP server might expose sensitive data or allow unauthorized operations.\"}),`\n`,(0,a.jsx)(e.p,{children:\"Think of scopes like keys to different rooms in a building. A user might have a key to the lobby (basic access) but not to the executive offices (admin functions). In our EpicMe journaling app, we want to ensure that clients can only access the data and perform the actions they're explicitly authorized for.\"}),`\n`,(0,a.jsx)(e.p,{children:\"Here's a practical example of how scopes work in an MCP server:\"}),`\n`,(0,a.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// A photo sharing app might define scopes like this\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"photoScopes\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" [\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"photos:read\"}),\"'\",\", \",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// View photos\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"photos:write\"}),\"'\",\", \",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Upload photos\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"albums:read\"}),\"'\",\", \",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// View albums\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"albums:write\"}),\"'\",\", \",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Create albums\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"\t\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"profile:read\"}),\"'\",\", \",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// View user profile\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[\"] \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"as\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),`\n`]}),(0,a.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:`\n`}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Scopes help you control what users can access\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"async\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"function\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"getPrivatePhotos\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userToken\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0C)\"},children:\"string\"}),\") {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"12\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Check if user has permission to read photos\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"13\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"hasPermission\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"checkUserScopes\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userToken\"}),\", [\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"photos:read\"}),\"'\",\"])\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"14\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"hasPermission\"}),\") {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"15\",children:[\"\t\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" { error: \",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Access denied\"}),\"'\",\" }\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"16\",children:[\"\t}\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"17\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"await\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"fetchPhotosFromDatabase\"}),\"()\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"18\",children:[\"}\",`\n`]})]})}),`\n`,(0,a.jsx)(\"callout-info\",{children:(0,a.jsx)(e.p,{children:`OAuth scopes in MCP follow the same patterns as traditional OAuth 2.0. The MCP\nspecification extends OAuth to work seamlessly with the Model Context\nProtocol, ensuring that your server can leverage existing OAuth infrastructure\nwhile providing the security guarantees your application needs.`})}),`\n`,(0,a.jsx)(e.p,{children:\"This exercise covers three essential aspects of scope management in MCP servers:\"}),`\n`,(0,a.jsxs)(e.ol,{children:[`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Scope Validation\"}),\": Creating utilities to check if users have the required permissions\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Scope Enforcement\"}),\": Implementing proper error handling when scopes are insufficient\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Scope Discovery\"}),\": Helping clients understand what scopes are available\"]}),`\n`]}),`\n`,(0,a.jsx)(e.p,{children:\"Here's a sequence diagram showing how scope validation works in an MCP server:\"}),`\n`,(0,a.jsx)(e.div,{className:\"mermaid not-prose\",dangerouslySetInnerHTML:{__html:''}}),`\n`,(0,a.jsx)(e.h2,{children:\"Common Scope Patterns\"}),`\n`,(0,a.jsx)(e.p,{children:\"Most applications follow similar patterns when defining scopes:\"}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Resource-based scopes\"}),\": \",(0,a.jsx)(e.code,{children:\"photos:read\"}),\", \",(0,a.jsx)(e.code,{children:\"documents:write\"}),\" - control access to specific resources\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Action-based scopes\"}),\": \",(0,a.jsx)(e.code,{children:\"read\"}),\", \",(0,a.jsx)(e.code,{children:\"write\"}),\", \",(0,a.jsx)(e.code,{children:\"admin\"}),\" - control what actions users can perform\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Feature-based scopes\"}),\": \",(0,a.jsx)(e.code,{children:\"analytics:view\"}),\", \",(0,a.jsx)(e.code,{children:\"reports:generate\"}),\" - control access to specific features\"]}),`\n`,(0,a.jsxs)(e.li,{children:[(0,a.jsx)(e.strong,{children:\"Hierarchical scopes\"}),\": \",(0,a.jsx)(e.code,{children:\"user:profile:read\"}),\", \",(0,a.jsx)(e.code,{children:\"user:profile:write\"}),\" - create nested permission structures\"]}),`\n`]}),`\n`,(0,a.jsx)(\"callout-success\",{children:(0,a.jsx)(e.p,{children:`The MCP specification allows servers to define their own scope names and\nmeanings. This flexibility lets you design permission systems that match your\napplication's specific security requirements.`})}),`\n`,(0,a.jsx)(e.h2,{children:\"Error Handling with Scopes\"}),`\n`,(0,a.jsx)(e.p,{children:\"When a client lacks sufficient scopes, your server should return a clear error response that helps the client understand what permissions are needed:\"}),`\n`,(0,a.jsx)(e.pre,{\"data-filename\":'\"403-response-header.txt\"',\"data-line-numbers\":\"true\",\"data-lang\":\"txt\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsx)(e.code,{children:(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:['WWW-Authenticate: Bearer realm=\"EpicMe\", error=\"insufficient_scope\", error_description=\"At least one of: photos:read photos:write albums:read is required.\"',`\n`]})})}),`\n`,(0,a.jsxs)(e.p,{children:[\"This error response includes auth params for the \",(0,a.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header:\"]}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[\"The realm or domain of interest (\",(0,a.jsx)(e.code,{children:\"EpicMe\"}),\")\"]}),`\n`,(0,a.jsxs)(e.li,{children:[\"The specific error type (\",(0,a.jsx)(e.code,{children:\"insufficient_scope\"}),\")\"]}),`\n`,(0,a.jsx)(e.li,{children:\"A human-readable description of what scopes are needed\"}),`\n`]}),`\n`,(0,a.jsx)(e.p,{children:\"There are more properties you can include, some of which we'll discuss later in this exercise.\"}),`\n`,(0,a.jsx)(e.h2,{children:\"Scope Discovery\"}),`\n`,(0,a.jsx)(e.p,{children:\"Clients need to know what scopes are available before requesting authorization. Your MCP server should expose this information through the OAuth protected resource metadata:\"}),`\n`,(0,a.jsx)(e.pre,{\"data-filename\":'\"/.well-known/oauth-protected-resource/mcp\"',\"data-line-numbers\":\"true\",\"data-lang\":\"json\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[\"{\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[\"\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"resource\"}),'\"',\": \",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"https://your-server.example.com/mcp\"}),'\"',\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"authorization_servers\"}),'\"',\": [\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"https://auth-server.example.com\"}),'\"',\"],\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"scopes_supported\"}),'\"',\": [\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"photos:read\"}),'\"',\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"photos:write\"}),'\"',\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"\t\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"albums:read\"}),'\"',\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:[\"\t\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"albums:write\"}),'\"',\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[\"\t\t\",'\"',(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"profile:read\"}),'\"',`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[\"\t]\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[\"}\",`\n`]})]})}),`\n`,(0,a.jsx)(e.p,{children:\"In this exercise, you'll learn how to:\"}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsx)(e.li,{children:\"Create scope validation utilities that check user permissions\"}),`\n`,(0,a.jsx)(e.li,{children:\"Implement proper error handling for insufficient scopes\"}),`\n`,(0,a.jsx)(e.li,{children:\"Add scope hints to help clients understand what permissions are available\"}),`\n`,(0,a.jsx)(e.li,{children:\"Expose scope information through OAuth metadata endpoints\"}),`\n`]}),`\n`,(0,a.jsx)(e.p,{children:\"You'll also explore how to structure your scope validation logic for maintainability and how to provide clear error messages that help both developers and end users understand permission requirements.\"}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[\"\\u{1F4DC} \",(0,a.jsx)(e.a,{href:\"https://tools.ietf.org/html/rfc6749#section-3.3\",children:\"OAuth 2.0 Scopes RFC\"})]}),`\n`,(0,a.jsxs)(e.li,{children:[\"\\u{1F4DC} \",(0,a.jsx)(e.a,{href:\"https://modelcontextprotocol.io/specification/2025-06-18/server/auth\",children:\"MCP Authentication Specification\"})]}),`\n`]})]})}function h(s={}){let{wrapper:e}=s.components||{};return e?(0,a.jsx)(e,{...s,children:(0,a.jsx)(d,{...s})}):d(s)}function w(s,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+s+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return g(C);})();\n;return Component;","finishedCode","var Component=(()=>{var f=Object.create;var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var l=Object.getOwnPropertyNames;var h=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var w=(e,o)=>()=>(o||e((o={exports:{}}).exports,o),o.exports),g=(e,o)=>{for(var n in o)s(e,n,{get:o[n],enumerable:!0})},i=(e,o,n,c)=>{if(o&&typeof o==\"object\"||typeof o==\"function\")for(let r of l(o))!x.call(e,r)&&r!==n&&s(e,r,{get:()=>o[r],enumerable:!(c=m(o,r))||c.enumerable});return e};var _=(e,o,n)=>(n=e!=null?f(h(e)):{},i(o||!e||!e.__esModule?s(n,\"default\",{value:e,enumerable:!0}):n,e)),j=e=>i(s({},\"__esModule\",{value:!0}),e);var u=w((v,p)=>{p.exports=_jsx_runtime});var E={};g(E,{default:()=>d,frontmatter:()=>y});var t=_(u()),y=void 0;function a(e){let o={h1:\"h1\",p:\"p\",...e.components},{EpicVideo:n}=o;return n||M(\"EpicVideo\",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(o.h1,{children:\"Scopes\"}),`\n`,(0,t.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/outro-to-scopes-xywcb\"}),`\n`,(0,t.jsx)(o.p,{children:\"Congratulations! You've successfully implemented fine-grained access control for your MCP server using OAuth scopes. Your EpicMe journaling app now provides secure, permission-based access to different features and resources.\"})]})}function d(e={}){let{wrapper:o}=e.components||{};return o?(0,t.jsx)(o,{...e,children:(0,t.jsx)(a,{...e})}):a(e)}function M(e,o){throw new Error(\"Expected \"+(o?\"component\":\"object\")+\" `\"+e+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return j(E);})();\n;return Component;","instructionsEpicVideoEmbeds",[515],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/intro-to-scopes-kpt4u","finishedEpicVideoEmbeds",[518],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/outro-to-scopes-xywcb",[520,548,567],{"_268":303,"_285":521,"_265":538},{"_20":103,"_134":478,"_507":522,"_22":104,"_24":105,"_509":523,"_524":525,"_527":528,"_531":532,"_535":536,"_266":377,"_268":303,"_9":285,"_537":107},"01.problem.check-scopes","var Component=(()=>{var p=Object.create;var l=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,y=Object.prototype.hasOwnProperty;var v=(a,e)=>()=>(e||a((e={exports:{}}).exports,e),e.exports),f=(a,e)=>{for(var s in e)l(a,s,{get:e[s],enumerable:!0})},c=(a,e,s,o)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let r of m(e))!y.call(a,r)&&r!==s&&l(a,r,{get:()=>e[r],enumerable:!(o=u(e,r))||o.enumerable});return a};var k=(a,e,s)=>(s=a!=null?p(b(a)):{},c(e||!a||!a.__esModule?l(s,\"default\",{value:a,enumerable:!0}):s,a)),w=a=>c(l({},\"__esModule\",{value:!0}),a);var t=v((E,i)=>{i.exports=_jsx_runtime});var x={};f(x,{default:()=>h,frontmatter:()=>g});var n=k(t()),g=void 0;function d(a){let e={a:\"a\",code:\"code\",h1:\"h1\",p:\"p\",pre:\"pre\",span:\"span\",...a.components},{EpicVideo:s}=e;return s||N(\"EpicVideo\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Check Scopes\"}),`\n`,(0,n.jsx)(s,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/check-scopes-xkjqu\"}),`\n`,(0,n.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} We're going to start adding more fine-grained control to what our MCP server can do by adding scopes. Our authorization server already supports scopes, and it makes no sense for the MCP server to show tools, resources, or prompts that the user doesn't have permission to use anyway.\"}),`\n`,(0,n.jsx)(e.p,{children:\"This is where OAuth scopes come in. They give us fine-grained control over what authenticated users can access.\"}),`\n`,(0,n.jsx)(e.p,{children:\"Let's look at an example of how this works in a music streaming app:\"}),`\n`,(0,n.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Define what scopes are available in our app\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"musicScopes\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" [\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"playlist:read\"}),\"'\",\", \",(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// View playlists\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"playlist:write\"}),\"'\",\", \",(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Create/edit playlists\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"songs:read\"}),\"'\",\", \",(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Search and play songs\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"profile:read\"}),\"'\",\", \",(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// View user profile\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\"] \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"as\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),`\n`]}),(0,n.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:`\n`}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// Check if user has permission to create playlists\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"function\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"hasScope\"}),\"(\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userScopes\"}),(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base0A)\"},children:\"Array\"}),\"<\",(0,n.jsx)(e.span,{style:{color:\"var(--base0C)\"},children:\"string\"}),\">) {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[\"\t\",(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userScopes\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"includes\"}),\"(\",\"'\",(0,n.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"playlist:write\"}),\"'\",\")\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"12\",children:[\"}\",`\n`]}),(0,n.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"13\",children:`\n`}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"14\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:'// Only show \"Create Playlist\" if user has permission'}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"15\",children:[(0,n.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,n.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"hasScope\"}),\"(\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"authInfo\"}),\".\",(0,n.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"scopes\"}),\")) {\",`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"16\",children:[\"\t\",(0,n.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// show create playlist functionality\"}),`\n`]}),(0,n.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"17\",children:[\"}\",`\n`]})]})}),`\n`,(0,n.jsx)(e.p,{children:\"To make this work in our EpicMe journaling app, we need to create scope validation utilities. These will help us check what permissions users have and ensure they can only access the features they're authorized for.\"}),`\n`,(0,n.jsx)(\"callout-info\",{children:(0,n.jsxs)(e.p,{children:[\"\\u{1F9DD}\\u200D\\u2640\\uFE0F I added \",(0,n.jsx)(e.code,{children:\"scopes\"}),\" to the \",(0,n.jsx)(e.code,{children:\"whoami\"}),` tool so you can easily see what\npermissions are available when testing your implementation.`]})}),`\n`,(0,n.jsxs)(e.p,{children:[\"Once you have the scope validation utilities in place, you'll also need to add a convenient \",(0,n.jsx)(e.code,{children:\"hasScope\"}),\" method to the \",(0,n.jsx)(e.code,{children:\"EpicMeMCP\"}),\" class that makes it easy to check permissions throughout your app:\"]}),`\n`,(0,n.jsx)(e.p,{children:\"This approach means users will only see the tools and features they're actually authorized to use, creating a smooth and intuitive experience that matches their permission level.\"}),`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F4DC} For more details on OAuth scopes and how they work in MCP servers, see the \",(0,n.jsx)(e.a,{href:\"https://tools.ietf.org/html/rfc6749#section-3.3\",children:\"OAuth 2.0 Scopes RFC\"}),\" and the \",(0,n.jsx)(e.a,{href:\"https://modelcontextprotocol.io/specification/2025-06-18/server/auth\",children:\"MCP Authentication Specification\"}),\".\"]}),`\n`,(0,n.jsx)(\"callout-danger\",{children:(0,n.jsxs)(e.p,{children:[\"At the time of this writing, there is a bug in the Cloudflare \",(0,n.jsx)(e.code,{children:\"McpAgent\"}),` that\nprevents client capabilities from being provided properly, as a result,\nsampling requests will not be made. Add `,(0,n.jsx)(e.code,{children:\"console.log\"}),`s to check if your logic\nis working.`]})})]})}function h(a={}){let{wrapper:e}=a.components||{};return e?(0,n.jsx)(e,{...a,children:(0,n.jsx)(d,{...a})}):d(a)}function N(a,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+a+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return w(x);})();\n;return Component;","epicVideoEmbeds",[526],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/check-scopes-xkjqu","test",{"_9":529,"_529":530},"script","vitest run","dev",{"_9":529,"_533":534,"_189":190},"portNumber",6041,"stackBlitzUrl","https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/05.scopes/01.problem.check-scopes?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Check+Scopes+%28problem%29","solutionName",{"_20":107,"_134":478,"_507":539,"_22":108,"_24":109,"_509":540,"_524":541,"_527":543,"_531":544,"_535":546,"_266":377,"_268":303,"_9":265,"_547":-5},"01.solution.check-scopes","var Component=(()=>{var h=Object.create;var s=Object.defineProperty;var m=Object.getOwnPropertyDescriptor;var f=Object.getOwnPropertyNames;var g=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var w=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),k=(t,e)=>{for(var o in e)s(t,o,{get:e[o],enumerable:!0})},a=(t,e,o,i)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let r of f(e))!x.call(t,r)&&r!==o&&s(t,r,{get:()=>e[r],enumerable:!(i=m(e,r))||i.enumerable});return t};var v=(t,e,o)=>(o=t!=null?h(g(t)):{},a(e||!t||!t.__esModule?s(o,\"default\",{value:t,enumerable:!0}):o,t)),y=t=>a(s({},\"__esModule\",{value:!0}),t);var p=w((E,c)=>{c.exports=_jsx_runtime});var _={};k(_,{default:()=>u,frontmatter:()=>j});var n=v(p()),j=void 0;function d(t){let e={h1:\"h1\",p:\"p\",...t.components},{EpicVideo:o,NextDiffLink:i}=e;return o||l(\"EpicVideo\",!0),i||l(\"NextDiffLink\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Check Scopes\"}),`\n`,(0,n.jsx)(o,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/check-scopes-xkjqu/solution\"}),`\n`,(0,n.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Excellent work! We've successfully implemented scope validation utilities that give our EpicMe journaling app fine-grained control over what authenticated users can access. Now our MCP server can check if users have the required permissions before allowing them to perform sensitive operations like reading private entries or managing tags.\"}),`\n`,(0,n.jsx)(e.p,{children:\"This improvement means users get proper access control based on their granted scopes, ensuring that personal journal data stays secure and only authorized actions are permitted. The scope validation utilities we built will be the foundation for all our permission checks going forward.\"}),`\n`,(0,n.jsxs)(e.p,{children:[\"\\u{1F9DD}\\u200D\\u2640\\uFE0F I'm expanding this scope validation system to cover more scenarios and adding better error handling for insufficient permissions. Feel free to try implementing that yourself, or just \",(0,n.jsx)(i,{children:\"check out my changes\"}),\" if you'd like to see how it's done.\"]})]})}function u(t={}){let{wrapper:e}=t.components||{};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(d,{...t})}):d(t)}function l(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return y(_);})();\n;return Component;",[542],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/check-scopes-xkjqu/solution",{"_9":529,"_529":530},{"_9":529,"_533":545,"_189":190},7041,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/05.scopes/01.solution.check-scopes?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Check+Scopes+%28solution%29","problemName",{"_268":269,"_285":549,"_265":558},{"_20":111,"_134":480,"_507":550,"_22":112,"_24":113,"_509":551,"_524":552,"_527":554,"_531":555,"_535":557,"_266":377,"_268":269,"_9":285,"_537":115},"02.problem.validate-sufficient-scope","var Component=(()=>{var p=Object.create;var l=Object.defineProperty;var f=Object.getOwnPropertyDescriptor;var b=Object.getOwnPropertyNames;var y=Object.getPrototypeOf,x=Object.prototype.hasOwnProperty;var u=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),k=(t,e)=>{for(var s in e)l(t,s,{get:e[s],enumerable:!0})},o=(t,e,s,n)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let r of b(e))!x.call(t,r)&&r!==s&&l(t,r,{get:()=>e[r],enumerable:!(n=f(e,r))||n.enumerable});return t};var g=(t,e,s)=>(s=t!=null?p(y(t)):{},o(e||!t||!t.__esModule?l(s,\"default\",{value:t,enumerable:!0}):s,t)),v=t=>o(l({},\"__esModule\",{value:!0}),t);var c=u((S,i)=>{i.exports=_jsx_runtime});var z={};k(z,{default:()=>m,frontmatter:()=>w});var a=g(c()),w=void 0;function d(t){let e={a:\"a\",code:\"code\",div:\"div\",h1:\"h1\",li:\"li\",p:\"p\",pre:\"pre\",span:\"span\",ul:\"ul\",...t.components},{EpicVideo:s,PrevDiffLink:n}=e;return s||h(\"EpicVideo\",!0),n||h(\"PrevDiffLink\",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(e.h1,{children:\"Validate Sufficient Scope\"}),`\n`,(0,a.jsx)(s,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/validate-sufficient-scope-wwivw\"}),`\n`,(0,a.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Some users are authenticating with no scopes which results in having a valid token, but not enough permissions to actually do anything useful with the MCP server. It would be better if we could let them know up front that they don't have enough permissions and need a new token with the appropriate scopes.\"}),`\n`,(0,a.jsxs)(e.p,{children:[\"To do this, you return a \",(0,a.jsx)(e.code,{children:\"403 Forbidden\"}),\" response with the appropriate \",(0,a.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header:\"]}),`\n`,(0,a.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,a.jsxs)(e.code,{children:[(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// A music streaming app might check scopes like this\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"requiredScopes\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" [\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"music:read\"}),\"'\",\", \",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"playlists:write\"}),\"'\",\"]\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userScopes\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" [\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"music:read\"}),\"'\",\"] \",(0,a.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// User only has read access\"}),`\n`]}),(0,a.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:`\n`}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"const\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"hasRequiredScopes\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"=\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"requiredScopes\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"every\"}),\"((\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"scope\"}),\") \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"=>\"}),`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"6\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"userScopes\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"includes\"}),\"(\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"scope\"}),\"),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"7\",children:[\")\",`\n`]}),(0,a.jsx)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"8\",children:`\n`}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"9\",children:[(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"if\"}),\" (\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"!\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"hasRequiredScopes\"}),\") {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"10\",children:[\"\t\",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"new\"}),\" \",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"Response\"}),\"(\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"Forbidden\"}),\"'\",\", {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"11\",children:[\"\t\tstatus: \",(0,a.jsx)(e.span,{style:{color:\"var(--base09)\"},children:\"403\"}),\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"12\",children:[\"\t\theaders: {\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"13\",children:[\"\t\t\t\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"WWW-Authenticate\"}),\"'\",\": [\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"14\",children:[\"\t\t\t\t\",\"`\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:'Bearer realm=\"MusicApp\"'}),\"`\",\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"15\",children:[\"\t\t\t\t\",\"`\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:'error=\"insufficient_scope\"'}),\"`\",\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"16\",children:[\"\t\t\t\t\",\"`\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:'scopes=\"'}),\"${\",(0,a.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"requiredScopes\"}),\".\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"join\"}),(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"(\"}),\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\" \"}),\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\")\"}),\"}\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:'\"'}),\"`\",\",\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"17\",children:[\"\t\t\t].\",(0,a.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"join\"}),\"(\",\"'\",(0,a.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\", \"}),\"'\",\"),\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"18\",children:[\"\t\t},\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"19\",children:[\"\t})\",`\n`]}),(0,a.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"20\",children:[\"}\",`\n`]})]})}),`\n`,(0,a.jsxs)(e.p,{children:[\"The \",(0,a.jsx)(e.code,{children:\"WWW-Authenticate\"}),\" header includes:\"]}),`\n`,(0,a.jsxs)(e.ul,{children:[`\n`,(0,a.jsxs)(e.li,{children:[\"The realm (\",(0,a.jsx)(e.code,{children:\"MusicApp\"}),\")\"]}),`\n`,(0,a.jsxs)(e.li,{children:[\"The error type (\",(0,a.jsx)(e.code,{children:\"insufficient_scope\"}),\")\"]}),`\n`,(0,a.jsxs)(e.li,{children:[\"The required scopes (\",(0,a.jsx)(e.code,{children:\"music:read playlists:write\"}),\")\"]}),`\n`]}),`\n`,(0,a.jsxs)(e.p,{children:[\"However, the \",(0,a.jsx)(e.code,{children:\"scopes\"}),\" auth param is tricky for us because there's actually a list of valid scope combinations that are allowed. The user could have one of several scopes that would be enough to use the MCP server. There's not an established pattern for handling this case, so we'll skip the \",(0,a.jsx)(e.code,{children:\"scopes\"}),\" auth param and instead include a \",(0,a.jsx)(e.code,{children:\"error_description\"}),\" that explains what scope combinations are valid.\"]}),`\n`,(0,a.jsx)(e.div,{className:\"mermaid not-prose\",dangerouslySetInnerHTML:{__html:''}}),`\n`,(0,a.jsx)(\"callout-muted\",{children:(0,a.jsxs)(e.p,{children:[`\\u{1F4DC} For more details on OAuth scope validation and error handling, see the\n`,(0,a.jsx)(e.a,{href:\"https://tools.ietf.org/html/rfc6749#section-3.3\",children:`OAuth 2.0 Authorization Framework\nRFC`}),\" and \",(0,a.jsx)(e.a,{href:\"https://tools.ietf.org/html/rfc6750#section-3.1\",children:`OAuth 2.0 Bearer\nToken Usage RFC`}),\".\"]})}),`\n`,(0,a.jsxs)(e.p,{children:[\"\\u{1F9DD}\\u200D\\u2640\\uFE0F I created a \",(0,a.jsx)(e.code,{children:\"minimalValidScopeCombinations\"}),\" array and a \",(0,a.jsx)(e.code,{children:\"hasSufficientScope\"}),\" function for you to use. It's just hard to describe what you should do, but simple once you see it. Feel free to \",(0,a.jsx)(n,{children:\"check out my changes\"}),\" if you want.\"]}),`\n`,(0,a.jsx)(e.p,{children:\"Now, let's implement the scope validation logic to ensure only properly authorized clients can access the EpicMe MCP server!\"})]})}function m(t={}){let{wrapper:e}=t.components||{};return e?(0,a.jsx)(e,{...t,children:(0,a.jsx)(d,{...t})}):d(t)}function h(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return v(z);})();\n;return Component;",[553],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/validate-sufficient-scope-wwivw",{"_9":529,"_529":530},{"_9":529,"_533":556,"_189":190},6042,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/05.scopes/02.problem.validate-sufficient-scope?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Validate+Sufficient+Scope+%28problem%29",{"_20":115,"_134":480,"_507":559,"_22":116,"_24":117,"_509":560,"_524":561,"_527":563,"_531":564,"_535":566,"_266":377,"_268":269,"_9":265,"_547":-5},"02.solution.validate-sufficient-scope","var Component=(()=>{var f=Object.create;var i=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var h=Object.getOwnPropertyNames;var m=Object.getPrototypeOf,w=Object.prototype.hasOwnProperty;var x=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),_=(e,t)=>{for(var n in t)i(e,n,{get:t[n],enumerable:!0})},c=(e,t,n,s)=>{if(t&&typeof t==\"object\"||typeof t==\"function\")for(let r of h(t))!w.call(e,r)&&r!==n&&i(e,r,{get:()=>t[r],enumerable:!(s=l(t,r))||s.enumerable});return e};var j=(e,t,n)=>(n=e!=null?f(m(e)):{},c(t||!e||!e.__esModule?i(n,\"default\",{value:e,enumerable:!0}):n,e)),v=e=>c(i({},\"__esModule\",{value:!0}),e);var p=x((g,a)=>{a.exports=_jsx_runtime});var M={};_(M,{default:()=>u,frontmatter:()=>y});var o=j(p()),y=void 0;function d(e){let t={h1:\"h1\",p:\"p\",...e.components},{EpicVideo:n}=t;return n||E(\"EpicVideo\",!0),(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.h1,{children:\"Validate Sufficient Scope\"}),`\n`,(0,o.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/validate-sufficient-scope-wwivw/solution\"}),`\n`,(0,o.jsx)(t.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Excellent work! Now users won't be able to access the MCP server if they don't have useful permissions.\"})]})}function u(e={}){let{wrapper:t}=e.components||{};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}function E(e,t){throw new Error(\"Expected \"+(t?\"component\":\"object\")+\" `\"+e+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return v(M);})();\n;return Component;",[562],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/validate-sufficient-scope-wwivw/solution",{"_9":529,"_529":530},{"_9":529,"_533":565,"_189":190},7042,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/05.scopes/02.solution.validate-sufficient-scope?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Validate+Sufficient+Scope+%28solution%29",{"_268":267,"_285":568,"_265":577},{"_20":119,"_134":482,"_507":569,"_22":120,"_24":121,"_509":570,"_524":571,"_527":573,"_531":574,"_535":576,"_266":377,"_268":267,"_9":285,"_537":123},"03.problem.scope-hints","var Component=(()=>{var p=Object.create;var s=Object.defineProperty;var u=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,g=Object.prototype.hasOwnProperty;var y=(a,e)=>()=>(e||a((e={exports:{}}).exports,e),e.exports),v=(a,e)=>{for(var n in e)s(a,n,{get:e[n],enumerable:!0})},l=(a,e,n,o)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let r of m(e))!g.call(a,r)&&r!==n&&s(a,r,{get:()=>e[r],enumerable:!(o=u(e,r))||o.enumerable});return a};var f=(a,e,n)=>(n=a!=null?p(b(a)):{},l(e||!a||!a.__esModule?s(n,\"default\",{value:a,enumerable:!0}):n,a)),w=a=>l(s({},\"__esModule\",{value:!0}),a);var i=y((j,c)=>{c.exports=_jsx_runtime});var N={};v(N,{default:()=>h,frontmatter:()=>k});var t=f(i()),k=void 0;function d(a){let e={a:\"a\",code:\"code\",h1:\"h1\",p:\"p\",pre:\"pre\",span:\"span\",strong:\"strong\",...a.components},{EpicVideo:n}=e;return n||x(\"EpicVideo\",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(e.h1,{children:\"Scope Hints\"}),`\n`,(0,t.jsx)(n,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/scope-hints-p0c97\"}),`\n`,(0,t.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} When users try to access our EpicMe journaling app without proper permissions, they need clear guidance on what scopes are available and required. Without this information, clients can't know what to request during the OAuth authorization flow, leading to failed authentication attempts and frustrated users.\"}),`\n`,(0,t.jsxs)(e.p,{children:[\"The solution is to provide a \",(0,t.jsx)(e.strong,{children:\"scope hint\"}),\" (called \",(0,t.jsx)(e.code,{children:\"scopes_supported\"}),\") in our OAuth protected resource metadata. This metadata tells clients exactly what scopes are supported and help them understand what permissions they could request from the authorization server.\"]}),`\n`,(0,t.jsx)(e.p,{children:\"Here's how this works in practice. Imagine a smart home app that controls different devices:\"}),`\n`,(0,t.jsx)(e.pre,{\"data-line-numbers\":\"true\",\"data-lang\":\"ts\",style:{color:\"var(--base05)\",backgroundColor:\"var(--base00)\"},children:(0,t.jsxs)(e.code,{children:[(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"1\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base03)\"},children:\"// The protected resource metadata also lists supported scopes\"}),`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"2\",children:[(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"function\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"handleOAuthProtectedResourceRequest\"}),\"(\",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"request\"}),(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\":\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base0A)\"},children:\"Request\"}),\") {\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"3\",children:[\"\t\",(0,t.jsx)(e.span,{style:{color:\"var(--base0E)\"},children:\"return\"}),\" \",(0,t.jsx)(e.span,{style:{color:\"var(--base08)\"},children:\"Response\"}),\".\",(0,t.jsx)(e.span,{style:{color:\"var(--base0D)\"},children:\"json\"}),\"({\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"4\",children:[\"\t\tresource: \",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"https://smarthome.example.com/api\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"5\",children:[\"\t\tauthorization_servers: [\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"https://auth.smarthome.example.com\"}),\"'\",\"],\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-highlight\":\"true\",\"data-line-number\":\"6\",children:[\"\t\tscopes_supported: [\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-highlight\":\"true\",\"data-line-number\":\"7\",children:[\"\t\t\t\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"lights:read\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-highlight\":\"true\",\"data-line-number\":\"8\",children:[\"\t\t\t\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"lights:write\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-highlight\":\"true\",\"data-line-number\":\"9\",children:[\"\t\t\t\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"thermostat:read\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-highlight\":\"true\",\"data-line-number\":\"10\",children:[\"\t\t\t\",\"'\",(0,t.jsx)(e.span,{style:{color:\"var(--base0B)\"},children:\"security:admin\"}),\"'\",\",\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-highlight\":\"true\",\"data-line-number\":\"11\",children:[\"\t\t],\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"12\",children:[\"\t})\",`\n`]}),(0,t.jsxs)(e.span,{className:\"codeblock-line\",\"data-line-number\":\"13\",children:[\"}\",`\n`]})]})}),`\n`,(0,t.jsxs)(e.p,{children:[\"The \",(0,t.jsx)(e.code,{children:\"scopes_supported\"}),\" in the protected resource metadata provides a complete list of all supported scopes across the entire system.\"]}),`\n`,(0,t.jsxs)(e.p,{children:[\"\\u{1F4DC} For more details on OAuth scope parameters, see the \",(0,t.jsx)(e.a,{href:\"https://tools.ietf.org/html/rfc6749#section-3.3\",children:\"OAuth 2.0 Authorization Framework RFC\"}),\".\"]}),`\n`,(0,t.jsxs)(e.p,{children:[\"Now, add the missing \",(0,t.jsx)(e.code,{children:\"scopes_supported\"}),\" to help clients understand what permissions are available for our EpicMe journaling app.\"]})]})}function h(a={}){let{wrapper:e}=a.components||{};return e?(0,t.jsx)(e,{...a,children:(0,t.jsx)(d,{...a})}):d(a)}function x(a,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+a+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return w(N);})();\n;return Component;",[572],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/scope-hints-p0c97",{"_9":529,"_529":530},{"_9":529,"_533":575,"_189":190},6043,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/05.scopes/03.problem.scope-hints?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Scope+Hints+%28problem%29",{"_20":123,"_134":482,"_507":578,"_22":124,"_24":125,"_509":579,"_524":580,"_527":582,"_531":583,"_535":585,"_266":377,"_268":267,"_9":265,"_547":-5},"03.solution.scope-hints","var Component=(()=>{var d=Object.create;var i=Object.defineProperty;var l=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var w=Object.getPrototypeOf,f=Object.prototype.hasOwnProperty;var x=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),g=(t,e)=>{for(var o in e)i(t,o,{get:e[o],enumerable:!0})},a=(t,e,o,r)=>{if(e&&typeof e==\"object\"||typeof e==\"function\")for(let s of m(e))!f.call(t,s)&&s!==o&&i(t,s,{get:()=>e[s],enumerable:!(r=l(e,s))||r.enumerable});return t};var y=(t,e,o)=>(o=t!=null?d(w(t)):{},a(e||!t||!t.__esModule?i(o,\"default\",{value:t,enumerable:!0}):o,t)),_=t=>a(i({},\"__esModule\",{value:!0}),t);var h=x((b,c)=>{c.exports=_jsx_runtime});var k={};g(k,{default:()=>u,frontmatter:()=>j});var n=y(h()),j=void 0;function p(t){let e={h1:\"h1\",p:\"p\",...t.components},{EpicVideo:o}=e;return o||v(\"EpicVideo\",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:\"Scope Hints\"}),`\n`,(0,n.jsx)(o,{url:\"https://www.epicai.pro/workshops/day-7-8-mcp-auth/scope-hints-p0c97/solution\"}),`\n`,(0,n.jsx)(e.p,{children:\"\\u{1F468}\\u200D\\u{1F4BC} Excellent work! We've successfully implemented scope hints that guide clients through the OAuth authorization process. Now when users encounter permission issues, their client apps can automatically discover what scopes are available and request the right permissions.\"}),`\n`,(0,n.jsx)(e.p,{children:\"This improvement means users get clear guidance on what permissions they need, eliminating confusion and failed authentication attempts. The scope hints in both the 401 Unauthorized response and the OAuth protected resource metadata ensure clients always know exactly what to request from the authorization server.\"}),`\n`,(0,n.jsx)(e.p,{children:\"Great work on this one.\"})]})}function u(t={}){let{wrapper:e}=t.components||{};return e?(0,n.jsx)(e,{...t,children:(0,n.jsx)(p,{...t})}):p(t)}function v(t,e){throw new Error(\"Expected \"+(e?\"component\":\"object\")+\" `\"+t+\"` to be defined: you likely forgot to import, pass, or provide it.\")}return _(k);})();\n;return Component;",[581],"https://www.epicai.pro/workshops/day-7-8-mcp-auth/scope-hints-p0c97/solution",{"_9":529,"_529":530},{"_9":529,"_533":584,"_189":190},7043,"https://stackblitz.com/github/epicweb-dev/mcp-auth/tree/main/exercises/05.scopes/03.solution.scope-hints?view=editor&hidedevtools=1&terminalHeight=0&hideNavigation=1&title=Scope+Hints+%28solution%29",[587,591,595],{"_20":103,"_134":478,"_507":522,"_22":104,"_24":105,"_509":523,"_524":588,"_527":589,"_531":590,"_535":536,"_266":377,"_268":303,"_9":285,"_537":107},[526],{"_9":529,"_529":530},{"_9":529,"_533":534,"_189":190},{"_20":111,"_134":480,"_507":550,"_22":112,"_24":113,"_509":551,"_524":592,"_527":593,"_531":594,"_535":557,"_266":377,"_268":269,"_9":285,"_537":115},[553],{"_9":529,"_529":530},{"_9":529,"_533":556,"_189":190},{"_20":119,"_134":482,"_507":569,"_22":120,"_24":121,"_509":570,"_524":596,"_527":597,"_531":598,"_535":576,"_266":377,"_268":267,"_9":285,"_537":123},[572],{"_9":529,"_529":530},{"_9":529,"_533":575,"_189":190},[600,604,608],{"_20":107,"_134":478,"_507":539,"_22":108,"_24":109,"_509":540,"_524":601,"_527":602,"_531":603,"_535":546,"_266":377,"_268":303,"_9":265,"_547":-5},[542],{"_9":529,"_529":530},{"_9":529,"_533":545,"_189":190},{"_20":115,"_134":480,"_507":559,"_22":116,"_24":117,"_509":560,"_524":605,"_527":606,"_531":607,"_535":566,"_266":377,"_268":269,"_9":265,"_547":-5},[562],{"_9":529,"_529":530},{"_9":529,"_533":565,"_189":190},{"_20":123,"_134":482,"_507":578,"_22":124,"_24":125,"_509":579,"_524":609,"_527":610,"_531":611,"_535":585,"_266":377,"_268":267,"_9":265,"_547":-5},[581],{"_9":529,"_529":530},{"_9":529,"_533":584,"_189":190},"exerciseFormEmbedUrl","https://docs.google.com/forms/d/e/1FAIpQLSf3o9xyjQepTlOTH5Z7ZwkeSTdXh6YWI_RGc9KiyD3oUN0p6w/viewform?hl=en&embedded=true&entry.1836176234=MCP%20Auth%20%F0%9F%94%90&entry.428900931=Scopes","epicVideoInfosPromise",["P",615],"exerciseFinished",{"_618":619,"_24":620},"file","/myapp/workshop-content/exercises/05.scopes/FINISHED.mdx","exercises/05.scopes/FINISHED.mdx","prevStepLink",{"_623":624,"_625":626},"to","/exercise/05/03/solution","aria-label","Scope Hints (solution)","nextStepLink",{"_623":629,"_625":630},"/finished","Finished! 🎉","actionData","errors"]

05. Scopes/Elaboration