modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

Auth hardening CI gaps + SDK consolidation: EMA leg 2 / scopes (#1527) (#1725)
Some checks failed
Run install, format, lint, build, and test on every push / build (push) Has been cancelled
Details
Run install, format, lint, build, and test on every push / publish (push) Has been cancelled
Details
Run install, format, lint, build, and test on every push / publish-github-container-registry (push) Has been cancelled
Details

Browse source 
Close #1527 acceptance gaps with automated tests (SEP-2468 iss, SEP-2207 offline_access, SEP-2351 discovery shapes, SEP-2352 AS-migration, EraNegotiationFailed→401 unwrap); lean EMA leg 2 and scope helpers on the v2 SDK; drop deprecated TS baseUrl. Reviewed LGTM.
This commit is contained in:
Bob Dickinson 2026-07-19 19:36:21 -07:00 • committed by GitHub
commit a71e6d2012
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 1513 additions and 852 deletions
Download patch file Download diff file Expand all files Collapse all files

13
test-servers/src/test-server-oauth.ts
View file

@ -167,6 +167,9 @@ function setupMetadataEndpoints(
"client_secret_basic",
"none",
],
// RFC 9207 / SEP-2468: advertise iss on authorization responses so
// clients must validate (and our e2e can exercise reject paths).
authorization_response_iss_parameter_supported: true,
...(config.supportDCR && {
registration_endpoint: new URL("/oauth/register", actualIssuerUrl)
.href,
@ -235,7 +238,12 @@ function setupAuthorizationEndpoint(
return;
}
completeAuthorizationRedirect(res, parsed.value);
const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
const issuer = (config.issuerUrl ?? new URL(requestBaseUrl)).href.replace(
/\/$/,
"",
);
completeAuthorizationRedirect(res, parsed.value, issuer);
},
);
}
@ -340,6 +348,7 @@ async function parseAuthorizationRequest(
function completeAuthorizationRedirect(
res: Response,
params: AuthorizationRequestParams,
issuer: string,
): void {
const authCode = generateAuthorizationCode();
storeAuthorizationCode(authCode, {
@ -354,6 +363,8 @@ function completeAuthorizationRedirect(
if (params.state) {
redirectUrl.searchParams.set("state", params.state);
}
// RFC 9207: iss must match metadata `issuer` (no trailing slash).
redirectUrl.searchParams.set("iss", issuer);
res.redirect(redirectUrl.href);
}