modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

Auth hardening CI gaps + SDK consolidation: EMA leg 2 / scopes (#1527) (#1725)
Some checks failed
Run install, format, lint, build, and test on every push / build (push) Has been cancelled
Details
Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
Details
Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
Details

Browse source 
Close #1527 acceptance gaps with automated tests (SEP-2468 iss, SEP-2207 offline_access, SEP-2351 discovery shapes, SEP-2352 AS-migration, EraNegotiationFailed→401 unwrap); lean EMA leg 2 and scope helpers on the v2 SDK; drop deprecated TS baseUrl. Reviewed LGTM.
This commit is contained in:
Bob Dickinson 2026-07-19 19:36:21 -07:00 • committed by GitHub
commit a71e6d2012
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1513 additions and 852 deletions
Download patch file Download diff file Expand all files Collapse all files

103
core/auth/ema/wire.ts
View file

@ -1,16 +1,11 @@
import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/client";
import { discoverAndRequestJwtAuthGrant } from "@modelcontextprotocol/client";
import type {
OAuthClientInformation,
OAuthTokens,
} from "@modelcontextprotocol/client";
import { OAuthTokensSchema } from "@modelcontextprotocol/core";
import type { EnterpriseManagedAuthIdpConfig } from "../../client/types.js";
import {
GRANT_TYPE_JWT_BEARER,
GRANT_TYPE_TOKEN_EXCHANGE,
TOKEN_TYPE_ID_JAG,
TOKEN_TYPE_ID_TOKEN,
} from "./constants.js";
import { GRANT_TYPE_JWT_BEARER } from "./constants.js";
import { parseHttpUrl } from "../utils.js";
import { discoverResourceAsMetadata } from "./resourceContext.js";
import { normalizeIdpIssuer } from "./storage.js";
@ -19,70 +14,64 @@ import {
postOAuthTokenRequest,
} from "./tokenEndpoint.js";
/** Leg 2 — exchange ID Token for ID-JAG at the enterprise IdP (RFC 8693). */
/**
* Leg 2 — exchange ID Token for ID-JAG at the enterprise IdP (RFC 8693).
*
* Delegates to SDK `discoverAndRequestJwtAuthGrant`. `resource` is required
* (the SDK always sends it on the wire). Callers should pass
* `resourceUrl ?? resourceMetadata.resource` from EMA resource context discovery.
*/
export async function exchangeIdJag(params: {
idp: EnterpriseManagedAuthIdpConfig;
idToken: string;
audience: string;
resource?: string;
/** RFC 8707 resource indicator — required by the SDK Layer-2 helper. */
resource: string;
scope?: string;
fetchFn?: typeof fetch;
}): Promise<string> {
const issuer = normalizeIdpIssuer(params.idp.issuer);
const issuerUrl = parseHttpUrl(issuer, "EMA IdP issuer (Client Settings)");
const idpMetadata = await discoverAuthorizationServerMetadata(issuerUrl, {
fetchFn: params.fetchFn,
});
if (!idpMetadata?.token_endpoint) {
throw new Error("IdP metadata missing token_endpoint");
const resource = params.resource.trim();
if (!resource) {
throw new Error("EMA leg 2 requires a resource identifier");
}
const clientInformation = {
client_id: params.idp.clientId,
client_secret: params.idp.clientSecret,
token_endpoint_auth_method: "client_secret_post",
} as OAuthClientInformation;
const body = new URLSearchParams({
grant_type: GRANT_TYPE_TOKEN_EXCHANGE,
requested_token_type: TOKEN_TYPE_ID_JAG,
subject_token: params.idToken,
subject_token_type: TOKEN_TYPE_ID_TOKEN,
audience: params.audience,
});
if (params.resource) {
body.set("resource", params.resource);
}
if (params.scope) {
body.set("scope", params.scope);
let result: Awaited<ReturnType<typeof discoverAndRequestJwtAuthGrant>>;
try {
result = await discoverAndRequestJwtAuthGrant({
idpUrl: issuer,
audience: params.audience,
resource,
idToken: params.idToken,
clientId: params.idp.clientId,
clientSecret: params.idp.clientSecret,
scope: params.scope,
fetchFn: params.fetchFn,
});
} catch (err) {
const message = err instanceof Error ? err.message : String(err);
// Drift-sensitive: `@modelcontextprotocol/client` currently throws plain
// `Error`s (not typed SdkError codes) for these failure modes. Remap to
// stable Inspector UX strings by matching SDK wording. Prefer typed errors
// when the SDK grows them. Canaries in `wire.test.ts` call the real helper
// so a wording change fails CI instead of silently falling through.
if (/Failed to discover token endpoint/i.test(message)) {
throw new Error("IdP metadata missing token_endpoint", { cause: err });
}
if (/Invalid token exchange response/i.test(message)) {
throw new Error("IdP token exchange did not return an ID-JAG", {
cause: err,
});
}
throw new Error(`EMA leg 2 (IdP token exchange for ID-JAG): ${message}`, {
cause: err,
});
}
const response = await postOAuthTokenRequest(
parseHttpUrl(
idpMetadata.token_endpoint,
"IdP token_endpoint (from OIDC discovery)",
),
body,
idpMetadata,
clientInformation,
params.fetchFn,
);
if (!response.ok) {
throw await parseOAuthTokenErrorResponse(
response,
"EMA leg 2 (IdP token exchange for ID-JAG)",
);
}
const json = (await response.json()) as {
access_token?: string;
issued_token_type?: string;
};
const idJag = json.access_token;
if (!idJag) {
if (!result.jwtAuthGrant) {
throw new Error("IdP token exchange did not return an ID-JAG");
}
return idJag;
return result.jwtAuthGrant;
}
/** Leg 3 — redeem ID-JAG for MCP resource access token (RFC 7523). */