testing-proxy/src/routes/.well-known/oauth-protected-resource/+server.js

import { getSqlite3 } from '$lib/sqlite3/database.js';

/**
 * OAuth 2.0 Protected Resource Metadata endpoint (RFC 9728).
 *
 * Exposed at /.well-known/oauth-protected-resource to allow MCP clients and
 * other OAuth-aware clients to discover the authorization server(s) that
 * govern access to this resource server.
 */
export async function GET(event) {
  const baseUrl = event.url.origin;

  const db   = await getSqlite3();
  const rows = db.prepare('SELECT name FROM scopes').all();
  const scopesSupported = rows.map(r => r.name);

  const metadata = {
    // REQUIRED per RFC 9728 Section 2: at least one authorization server
    authorization_servers: [ baseUrl ],

    scopes_supported: scopesSupported
  };

  return new Response(JSON.stringify(metadata), {
    headers: { 'Content-Type': 'application/json' }
  });
}