chore: wrap up things in a feature flag

Signed-off-by: benjdlambert <ben@blam.sh>

plugins/mcp-actions-backend/src/plugin.ts

@@ -17,7 +17,8 @@ import {
   coreServices,
   createBackendPlugin,
 } from '@backstage/backend-plugin-api';
-import { json, Router } from 'express';
+import { json } from 'express';
+import Router from 'express-promise-router';
 import { McpService } from './services/McpService';
 import { createStreamableRouter } from './routers/createStreamableRouter';
 import { createSseRouter } from './routers/createSseRouter';
@@ -44,6 +45,7 @@ export const mcpPlugin = createBackendPlugin({
         registry: actionsRegistryServiceRef,
         rootRouter: coreServices.rootHttpRouter,
         discovery: coreServices.discovery,
+        config: coreServices.rootConfig,
       },
       async init({
         actions,
@@ -52,6 +54,7 @@ export const mcpPlugin = createBackendPlugin({
         httpAuth,
         rootRouter,
         discovery,
+        config,
       }) {
         const mcpService = await McpService.create({
           actions,
@@ -76,21 +79,25 @@ export const mcpPlugin = createBackendPlugin({
 
         httpRouter.use(router);
 
-        // todo(blam): there's probably a better way to proxy this, but it's required
-        // for mcp auth spec that it lives on the root of the mcp entrypoint server.
-        const authRouter = Router();
-        authRouter.use('/', async (_, res) => {
-          const authBaseUrl = await discovery.getBaseUrl('auth');
+        if (
+          config.getOptionalBoolean(
+            'auth.experimental.enableDynamicClientRegistration',
+          )
+        ) {
+          // This should be replaced with throwing a WWW-Authenticate header, but that doesn't seem to be supported by
+          // many of the MCP client as of yet. So this seems to be the oldest version of the spec thats implemented.
+          rootRouter.use(
+            '/.well-known/oauth-authorization-server',
+            async (_, res) => {
+              const authBaseUrl = await discovery.getBaseUrl('auth');
+              const oidcResponse = await fetch(
+                `${authBaseUrl}/.well-known/openid-configuration`,
+              );
 
-          const oidcResponse = await fetch(
-            `${authBaseUrl}/.well-known/openid-configuration`,
+              res.json(await oidcResponse.json());
+            },
           );
-
-          const oidcResponseJson = await oidcResponse.json();
-
-          res.json(oidcResponseJson);
-        });
-        rootRouter.use('/.well-known/oauth-authorization-server', authRouter);
+        }
       },
     });
   },