scopesFromClaims (mcp/mcp-auth.ts)

Parses OAuth token scopes into a set of permissions for MCP services.

// Source: https://github.com/mnfst/llm-gateway | License: MIT | Copyright 2026 MNFST, Inc
// Provided via justclaw.it.com; keep this notice with the code.
import { TenantCacheService } from '../common/services/tenant-cache.service';
import { MCP_READ_SCOPE, MCP_WRITE_SCOPE } from '../auth/mcp-scopes';

/** The claims carried by one verified OAuth access token. */
export interface McpAccessTokenClaims {
  sub?: string;
  scope?: unknown;
}

/** The operator and capabilities carried by one verified OAuth access token. */
export interface McpOperator {
  userId: string;
  tenantId: string;
  scopes: ReadonlySet<string>;
}

/** Convert the OAuth JWT's space-separated scope claim to exact capabilities. */
export function scopesFromClaims(claims: McpAccessTokenClaims): ReadonlySet<string> {
  i

... (truncated -- full source via MCP)