fix: static token rejected by requireBearerAuth (missing expiresAt)

[aliasunder]

Summary

Real auth bug, surfaced while bridging the HTTP server to stdio for Glama's introspector. A static MCP_AUTH_TOKEN bearer is rejected with 401 at the Express layer, even when the token is correct.

Root cause (confirmed against the SDK source)

@modelcontextprotocol/sdk requireBearerAuth enforces:

if (typeof authInfo.expiresAt !== 'number' || isNaN(authInfo.expiresAt)) {
    throw new InvalidTokenError('Token has no expiration time');   // → 401
}

But verifyAccessToken's static-token fast path returned { token, clientId: "static", scopes: ["vault"] } with no expiresAt → always 401 for the static bearer. The JWT/OAuth path sets expiresAt, so E2E (tested via OAuth) passed and this never showed. The static-bearer path — documented for deploy/local and CLI tools — was never exercised by a real client.

Evidence

A curl straight to /mcp with Authorization: Bearer <token> (bypassing the bridge) returned 401, while the server's MCP_AUTH_TOKEN was confirmed to be exactly the token sent.

Fix

Give the static token a far-future numeric expiresAt (now + 10y, recomputed per request) so it satisfies requireBearerAuth while staying effectively perpetual. Added a test asserting expiresAt is a future number (the old test only checked clientId/scopes/token, which is exactly why the gap slipped through).

Validation

• 497 / 497 tests pass (added 1)
• lint + tsc --noEmit clean

Impact / follow-on

• Fixes static-bearer auth for all direct-Express consumers (deploy/local, CLI), not just Glama.
• Glama's introspection build pulls from source (git clone + checkout latest main), so once merged a re-run will pick it up.
• For the published image (deploy/local users), this needs a v0.15.5 release to ship the fix into GHCR.

---

Generated by Claude Code