Three patterns. That's the engineering surface.

// loan-ops-mcp/src/middleware/auth.ts
import { jwtVerify, createRemoteJWKSet } from "jose";

const JWKS = createRemoteJWKSet(
  new URL("https://auth.northwind.com/.well-known/jwks.json"),
);

export async function requireUser(req, res, next) {
  const token = req.headers.authorization?.replace(/^Bearer\s+/i, "");
  if (!token) return res.status(401).json({ error: "no_token" });

  try {
    const { payload } = await jwtVerify(token, JWKS, {
      issuer: "https://auth.northwind.com",
      audience: "loan-ops-mcp",
    });

    req.user = {
      sub: payload.sub,
      roles: Array.isArray(payload.roles) ? payload.roles : [],
      scopes:
        typeof payload.scope === "string"
          ? payload.scope.split(" ").filter(Boolean)
          : Array.isArray(payload.scopes)
            ? payload.scopes
            : [],
      clientId: payload.client_id ?? payload.azp ?? "unknown-client",
      tenant: payload.tenantId,
    };
    next();
  } catch {
    return res.status(401).json({ error: "invalid_token" });
  }
}

export function requireScope(required: string) {
  return (req, res, next) => {
    if (!req.user?.scopes.includes(required)) {
      return res.status(403).json({
        error: "insufficient_scopes",
        required,
        had: req.user?.scopes,
      });
    }
    next();
  };
}