From 94b85990e3654713ce0839e908c3bbd1f043a388 Mon Sep 17 00:00:00 2001
From: Marc Nuri <marc@marcnuri.com>
Date: Wed, 6 Aug 2025 14:31:33 +0300
Subject: [PATCH] fix(npm): child process exits gracefully on SIGxxx (#243)

Signed-off-by: Marc Nuri <marc@marcnuri.com>
---
 pkg/http/http.go      | 44 +++++---------------------------------
 pkg/http/wellknown.go | 49 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 39 deletions(-)
 create mode 100644 pkg/http/wellknown.go

diff --git a/pkg/http/http.go b/pkg/http/http.go
index e5dfb2b..ceee09b 100644
--- a/pkg/http/http.go
+++ b/pkg/http/http.go
@@ -2,7 +2,6 @@ package http
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"net/http"
 	"os"
@@ -19,11 +18,10 @@ import (
 )
 
 const (
-	oauthProtectedResourceEndpoint = "/.well-known/oauth-protected-resource"
-	healthEndpoint                 = "/healthz"
-	mcpEndpoint                    = "/mcp"
-	sseEndpoint                    = "/sse"
-	sseMessageEndpoint             = "/message"
+	healthEndpoint     = "/healthz"
+	mcpEndpoint        = "/mcp"
+	sseEndpoint        = "/sse"
+	sseMessageEndpoint = "/message"
 )
 
 func Serve(ctx context.Context, mcpServer *mcp.Server, staticConfig *config.StaticConfig, oidcProvider *oidc.Provider) error {
@@ -46,39 +44,7 @@ func Serve(ctx context.Context, mcpServer *mcp.Server, staticConfig *config.Stat
 	mux.HandleFunc(healthEndpoint, func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	})
-	mux.HandleFunc(oauthProtectedResourceEndpoint, func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("Content-Type", "application/json")
-
-		var authServers []string
-		if staticConfig.AuthorizationURL != "" {
-			authServers = []string{staticConfig.AuthorizationURL}
-		} else {
-			// Fallback to Kubernetes API server host if authorization_server is not configured
-			if apiServerHost := mcpServer.GetKubernetesAPIServerHost(); apiServerHost != "" {
-				authServers = []string{apiServerHost}
-			}
-		}
-
-		response := map[string]interface{}{
-			"authorization_servers":    authServers,
-			"authorization_server":     authServers[0],
-			"scopes_supported":         mcpServer.GetEnabledTools(),
-			"bearer_methods_supported": []string{"header"},
-		}
-
-		if staticConfig.ServerURL != "" {
-			response["resource"] = staticConfig.ServerURL
-		}
-
-		if staticConfig.JwksURL != "" {
-			response["jwks_uri"] = staticConfig.JwksURL
-		}
-
-		w.WriteHeader(http.StatusOK)
-		if err := json.NewEncoder(w).Encode(response); err != nil {
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-		}
-	})
+	mux.HandleFunc(oauthProtectedResourceEndpoint, OAuthProtectedResourceHandler(mcpServer, staticConfig))
 
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
diff --git a/pkg/http/wellknown.go b/pkg/http/wellknown.go
new file mode 100644
index 0000000..371901a
--- /dev/null
+++ b/pkg/http/wellknown.go
@@ -0,0 +1,49 @@
+package http
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/containers/kubernetes-mcp-server/pkg/config"
+	"github.com/containers/kubernetes-mcp-server/pkg/mcp"
+)
+
+const (
+	oauthProtectedResourceEndpoint = "/.well-known/oauth-protected-resource"
+)
+
+func OAuthProtectedResourceHandler(mcpServer *mcp.Server, staticConfig *config.StaticConfig) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+
+		var authServers []string
+		if staticConfig.AuthorizationURL != "" {
+			authServers = []string{staticConfig.AuthorizationURL}
+		} else {
+			// Fallback to Kubernetes API server host if authorization_server is not configured
+			if apiServerHost := mcpServer.GetKubernetesAPIServerHost(); apiServerHost != "" {
+				authServers = []string{apiServerHost}
+			}
+		}
+
+		response := map[string]interface{}{
+			"authorization_servers":    authServers,
+			"authorization_server":     authServers[0],
+			"scopes_supported":         mcpServer.GetEnabledTools(),
+			"bearer_methods_supported": []string{"header"},
+		}
+
+		if staticConfig.ServerURL != "" {
+			response["resource"] = staticConfig.ServerURL
+		}
+
+		if staticConfig.JwksURL != "" {
+			response["jwks_uri"] = staticConfig.JwksURL
+		}
+
+		w.WriteHeader(http.StatusOK)
+		if err := json.NewEncoder(w).Encode(response); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
+	}
+}