modelcontextprotocol/go-sdk
Watch
1
0
Fork
You've already forked go-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

auth: change OAuthHandler to take http Request and Response (#603)

Browse source 
Change OAuthHandler signature from func(context.Context,
OAuthHandlerArgs) to func(req *http.Request, res *http.Response).

- Remove OAuthHandlerArgs struct
- Update HTTPTransport to pass req and resp to handler
- Update tests to use new signature
- Handler can now call oauthex.GetProtectedResourceMetadataFromHeader
with proper validation against request URL

This change fixes an impedance mismatch between OAuthHandler and the
protected resource metadata functions of the oauthex package. The new
signature allows handlers to properly validate resource metadata against
the request URL, as required by RFC 9728.

Fixes #600
This commit is contained in:
Ruturaj Dattatray Kadam 2025-10-29 19:38:40 +05:30 • committed by GitHub
commit 72afbc91bd
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

17
auth/client_test.go
View file

@ -7,7 +7,6 @@
package auth
import (
"context"
"errors"
"fmt"
"io"
@ -65,10 +64,11 @@ func TestHTTPTransport(t *testing.T) {
t.Run("successful auth flow", func(t *testing.T) {
var handlerCalls int
handler := func(ctx context.Context, args OAuthHandlerArgs) (oauth2.TokenSource, error) {
handler := func(req *http.Request, res *http.Response) (oauth2.TokenSource, error) {
handlerCalls++
if args.ResourceMetadataURL != "http://metadata.example.com" {
t.Errorf("handler got metadata URL %q, want %q", args.ResourceMetadataURL, "http://metadata.example.com")
// Verify that the response has the expected WWW-Authenticate header
if res.Header.Get("WWW-Authenticate") != `Bearer resource_metadata="http://metadata.example.com"` {
t.Errorf("handler got WWW-Authenticate header %q", res.Header.Get("WWW-Authenticate"))
}
return fakeTokenSource, nil
}
@ -108,9 +108,10 @@ func TestHTTPTransport(t *testing.T) {
})
t.Run("request body is cloned", func(t *testing.T) {
handler := func(ctx context.Context, args OAuthHandlerArgs) (oauth2.TokenSource, error) {
if args.ResourceMetadataURL != "http://metadata.example.com" {
t.Errorf("handler got metadata URL %q, want %q", args.ResourceMetadataURL, "http://metadata.example.com")
handler := func(req *http.Request, res *http.Response) (oauth2.TokenSource, error) {
// Verify that the response has the expected WWW-Authenticate header
if res.Header.Get("WWW-Authenticate") != `Bearer resource_metadata="http://metadata.example.com"` {
t.Errorf("handler got WWW-Authenticate header %q", res.Header.Get("WWW-Authenticate"))
}
return fakeTokenSource, nil
}
@ -134,7 +135,7 @@ func TestHTTPTransport(t *testing.T) {
t.Run("handler returns error", func(t *testing.T) {
handlerErr := errors.New("user rejected auth")
handler := func(ctx context.Context, args OAuthHandlerArgs) (oauth2.TokenSource, error) {
handler := func(req *http.Request, res *http.Response) (oauth2.TokenSource, error) {
return nil, handlerErr
}