Merge branch 'v2/main' into v2/feat/2068-refresh-token-toggle

core/auth/challenge.ts

@@ -26,6 +26,17 @@ export interface AuthChallenge {
   /** Resource authorization server audience when known. */
   audience?: string;
 
+  /**
+   * RFC 9728 `resource_metadata` advertised by the `WWW-Authenticate` challenge.
+   *
+   * Kept as a string so the challenge stays serializable — it crosses the web
+   * client's remote-backend boundary as JSON. Converted to a `URL` (and
+   * discarded if malformed) at the OAuth boundary, where it is handed to the
+   * SDK as `resourceMetadataUrl` so protected-resource discovery targets the
+   * advertised document instead of a location derived from the MCP server URL.
+   */
+  resourceMetadataUrl?: string;
+
   /** Optional human-readable detail from server or SDK (for UI, not parsing). */
   message?: string;
 
@@ -193,6 +204,30 @@ export function parseWwwAuthenticateBearer(
   };
 }
 
+/**
+ * Convert a challenge's advertised RFC 9728 `resource_metadata` value into the
+ * `URL` the SDK's `auth()` takes as `resourceMetadataUrl`.
+ *
+ * A malformed value is ignored rather than surfaced, matching the SDK's own
+ * `WWW-Authenticate` parser (`extractWWWAuthenticateParams`), which drops a
+ * value `new URL()` rejects. Discovery then falls back to the default
+ * RFC 9728 locations derived from the MCP server URL — the pre-existing
+ * behavior — instead of failing the whole authorization on a bad header.
+ */
+export function challengeResourceMetadataUrl(
+  challenge: Pick<AuthChallenge, "resourceMetadataUrl">,
+): URL | undefined {
+  const value = challenge.resourceMetadataUrl?.trim();
+  if (!value) {
+    return undefined;
+  }
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}
+
 /** Split an OAuth scope string into individual scopes (space-separated). */
 export function parseScopeString(scope: string | undefined): string[] {
   if (!scope?.trim()) {
@@ -275,6 +310,9 @@ export function parseAuthChallengeFromResponse(
   return {
     reason: reasonFromHttpResponse(status, bearer),
     ...(requiredScopes.length > 0 ? { requiredScopes } : {}),
+    ...(bearer.resourceMetadata
+      ? { resourceMetadataUrl: bearer.resourceMetadata }
+      : {}),
     ...(bearer.errorDescription ? { message: bearer.errorDescription } : {}),
     ...(context ? { context } : {}),
     raw: {
@@ -337,6 +375,9 @@ export function parseAuthChallengeFromError(
   return {
     reason: reasonFromHttpResponse(status, bearer),
     ...(requiredScopes.length > 0 ? { requiredScopes } : {}),
+    ...(bearer.resourceMetadata
+      ? { resourceMetadataUrl: bearer.resourceMetadata }
+      : {}),
     ...(context ? { context } : {}),
     raw: {
       httpStatus: status,

core/auth/cimd.ts

@@ -14,11 +14,18 @@ import type { BaseOAuthClientProvider } from "./providers.js";
  * accepts an already-stored `client_id` (including `http://` URLs used by local
  * dev/test metadata servers). Production CIMD metadata documents should still
  * use HTTPS per SEP-991.
+ *
+ * `resourceMetadataUrl` is the RFC 9728 document advertised by the
+ * `WWW-Authenticate` challenge, when the caller has one. It matters here and
+ * not only in `auth()`: this runs *before* SDK `auth()`, so without it the
+ * pre-registration probe would do its own default-location discovery and miss
+ * a document served from a non-default path (#2071).
  */
 export async function ensureCimdClientRegistration(params: {
   serverUrl: string;
   provider: BaseOAuthClientProvider;
   fetchFn?: typeof fetch;
+  resourceMetadataUrl?: URL;
 }): Promise<void> {
   const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
   if (!clientMetadataUrl) return;
@@ -30,6 +37,13 @@ export async function ensureCimdClientRegistration(params: {
   try {
     resourceMetadata = await discoverOAuthProtectedResourceMetadata(
       params.serverUrl,
+      { resourceMetadataUrl: params.resourceMetadataUrl },
+      // The same fetch the AS-metadata leg below uses. On web that is
+      // `createRemoteFetch`, which proxies through the backend to sidestep
+      // CORS — on the global `fetch` this leg would fail in the browser, be
+      // swallowed by the catch, and leave CIMD probing the wrong
+      // authorization server (Copilot).
+      params.fetchFn,
     );
   } catch {
     resourceMetadata = undefined;