Setup auth-server to handle callbacks for sandbox-container and workers-bindings

Author: Maximo-Guk

apps/sandbox-container/package.json

@@ -19,6 +19,7 @@
 		"@hono/node-server": "^1.13.8",
 		"@hono/zod-validator": "^0.4.3",
 		"@modelcontextprotocol/sdk": "^1.7.0",
+		"@repo/mcp-common": "workspace:*",
 		"@types/node": "^22.13.10",
 		"agents": "^0.0.42",
 		"cron-schedule": "^5.0.4",
@@ -29,10 +30,10 @@
 		"partyserver": "^0.0.65",
 		"tsx": "^4.19.3",
 		"workers-mcp": "0.1.0-3",
-		"zod": "^3.24.2",
-		"@repo/mcp-common": "workspace:*"
+		"zod": "^3.24.2"
 	},
 	"devDependencies": {
+		"@cloudflare/vitest-pool-workers": "0.8.14",
 		"concurrently": "^9.1.2",
 		"wrangler": "^4.9.1"
 	}

apps/sandbox-container/server/index.ts

@@ -2,9 +2,10 @@ import OAuthProvider from '@cloudflare/workers-oauth-provider'
 import { env } from 'cloudflare:workers'
 
 import {
-	CloudflareAuthHandler,
+	createAuthHandlers,
 	handleTokenExchangeCallback,
 } from '@repo/mcp-common/src/cloudflare-oauth-handler'
+import { getEnvironment } from '@repo/mcp-common/src/config'
 
 import { ContainerManager } from './containerManager'
 import { ContainerMcpAgent } from './containerMcp'
@@ -32,7 +33,10 @@ export default new OAuthProvider({
 	// @ts-ignore
 	apiHandler: ContainerMcpAgent.mount('/workers/sandbox/sse', { binding: 'CONTAINER_MCP_AGENT' }),
 	// @ts-ignore
-	defaultHandler: CloudflareAuthHandler,
+	defaultHandler: createAuthHandlers({
+		serverPath: 'workers/containers',
+		environment: getEnvironment(env.ENVIRONMENT),
+	}),
 	authorizeEndpoint: '/oauth/authorize',
 	tokenEndpoint: '/token',
 	tokenExchangeCallback: (options) =>

apps/sandbox-container/tsconfig.json

@@ -1,16 +1,3 @@
 {
-	"compilerOptions": {
-		"target": "ESNext",
-		"lib": ["ESNext", "DOM"],
-		"jsx": "react-jsx",
-		"module": "ESNext",
-		"moduleResolution": "bundler",
-		"types": ["./worker-configuration.d.ts", "@cloudflare/workers-types/2023-07-01"],
-		"noEmit": true,
-		"esModuleInterop": true,
-		"forceConsistentCasingInFileNames": true,
-		"strict": true,
-		"skipLibCheck": true
-	},
-	"include": ["server/**.ts", "shared/**.ts"]
+	"extends": "@repo/typescript-config/workers.json"
 }

apps/sandbox-container/worker-configuration.d.ts

@@ -3,10 +3,13 @@
 declare namespace Cloudflare {
 	interface Env {
 		OAUTH_KV: KVNamespace;
+		// eslint-disable-next-line @typescript-eslint/consistent-type-imports
 		CONTAINER_MCP_AGENT: DurableObjectNamespace<import("./server/index").ContainerMcpAgent>;
+		// eslint-disable-next-line @typescript-eslint/consistent-type-imports
 		CONTAINER_MANAGER: DurableObjectNamespace<import("./server/index").ContainerManager>;
 		CLOUDFLARE_CLIENT_ID: string;
 		CLOUDFLARE_CLIENT_SECRET: string;
+        ENVIRONMENT: MCPEnvironment
 	}
 }
 interface Env extends Cloudflare.Env {}

apps/sandbox-container/wrangler.jsonc

@@ -1,6 +1,6 @@
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
-	"name": "sandbox-container",
+	"name": "sandbox-container-dev",
 	"main": "server/index.ts",
 	"compatibility_date": "2025-04-03",
 	"containers": [
@@ -41,5 +41,8 @@
 	],
 	"dev": {
 		"port": 8976
-	}
+	},
+	"vars": {
+		"ENVIRONMENT": "development"
+	},
 }

apps/workers-bindings/src/index.ts

@@ -4,14 +4,16 @@ import { McpAgent } from 'agents/mcp'
 import { env } from 'cloudflare:workers'
 
 import {
-	CloudflareAuthHandler,
+	createAuthHandlers,
 	handleTokenExchangeCallback,
 } from '@repo/mcp-common/src/cloudflare-oauth-handler'
+import { getEnvironment } from '@repo/mcp-common/src/config'
 import { registerAccountTools } from '@repo/mcp-common/src/tools/account'
 import { registerKVTools } from '@repo/mcp-common/src/tools/kv_namespace'
 import { registerWorkersTools } from '@repo/mcp-common/src/tools/worker'
 
 import type { AccountSchema, UserSchema } from '@repo/mcp-common/src/cloudflare-oauth-handler'
+import type { Env } from '../worker-configuration'
 
 export type WorkersBindingsMCPState = { activeAccountId: string | null }
 
@@ -66,11 +68,19 @@ export default new OAuthProvider({
 	// @ts-ignore
 	apiHandler: WorkersBindingsMCP.mount('/workers/bindings/sse'),
 	// @ts-ignore
-	defaultHandler: CloudflareAuthHandler,
+	defaultHandler: createAuthHandlers({
+		serverPath: 'workers/containers',
+		// TOOD: Why do we need to cast as Env for typescript to pick up types?
+		environment: getEnvironment((env as Env).ENVIRONMENT),
+	}),
 	authorizeEndpoint: '/oauth/authorize',
 	tokenEndpoint: '/token',
 	tokenExchangeCallback: (options) =>
-		handleTokenExchangeCallback(options, env.CLOUDFLARE_CLIENT_ID, env.CLOUDFLARE_CLIENT_SECRET),
+		handleTokenExchangeCallback(
+			options,
+			(env as Env).CLOUDFLARE_CLIENT_ID,
+			(env as Env).CLOUDFLARE_CLIENT_SECRET
+		),
 	// Cloudflare access token TTL
 	accessTokenTTL: 3600,
 	clientRegistrationEndpoint: '/register',

apps/workers-bindings/vitest.config.ts

@@ -1,5 +1,7 @@
 import { defineWorkersConfig } from '@cloudflare/vitest-pool-workers/config'
 
+import type { Env } from './worker-configuration'
+
 export interface TestEnv extends Env {
 	CLOUDFLARE_MOCK_ACCOUNT_ID: string
 	CLOUDFLARE_MOCK_API_TOKEN: string

apps/workers-bindings/worker-configuration.d.ts

@@ -1,11 +1,16 @@
 // Generated by Wrangler by running `wrangler types` (hash: 83b65e4226fcf5092146edc626681982)
+
+import type { MCPEnvironment } from "@repo/mcp-common/src/config";
+
 // Runtime types generated with [email protected] 2025-03-10 nodejs_compat
 declare namespace Cloudflare {
 	interface Env {
 		OAUTH_KV: KVNamespace;
 		CLOUDFLARE_CLIENT_ID: string;
 		CLOUDFLARE_CLIENT_SECRET: string;
+		// eslint-disable-next-line @typescript-eslint/consistent-type-imports
 		MCP_OBJECT: DurableObjectNamespace<import("./src/index").WorkersBindingsMCP>;
+        ENVIRONMENT: MCPEnvironment
 	}
 }
 interface Env extends Cloudflare.Env {}

apps/workers-bindings/wrangler.jsonc

@@ -4,7 +4,7 @@
  */
 {
 	"$schema": "node_modules/wrangler/config-schema.json",
-	"name": "workers-bindings",
+	"name": "workers-bindings-dev",
 	"main": "src/index.ts",
 	"compatibility_date": "2025-03-10",
 	"compatibility_flags": ["nodejs_compat"],
@@ -33,6 +33,9 @@
 	},
 	"dev": {
 		"port": 8976
+	},
+	"vars": {
+		"ENVIRONMENT": "development"
 	}
 	/**
 	 * Smart Placement