1// SPDX-FileCopyrightText: Amolith <amolith@secluded.site>
 2//
 3// SPDX-License-Identifier: LicenseRef-MutuaL-1.2
 4
 5package mcp
 6
 7import (
 8	"crypto/subtle"
 9	"net/http"
10	"strings"
11)
12
13func requireBearerToken(token string, next http.Handler) http.Handler {
14	if token == "" {
15		return next
16	}
17
18	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
19		scheme, value, ok := strings.Cut(r.Header.Get("Authorization"), " ")
20		if !ok || !strings.EqualFold(scheme, "Bearer") ||
21			subtle.ConstantTimeCompare([]byte(value), []byte(token)) != 1 {
22			w.Header().Set("WWW-Authenticate", "Bearer")
23			http.Error(w, "unauthorized", http.StatusUnauthorized)
24			return
25		}
26
27		next.ServeHTTP(w, r)
28	})
29}