modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 4

fix(oauth): persist the requested scope when the grant omits it

Browse source 
RFC 6749 5.1 defines an omitted `scope` in a token response as a grant
identical to what was requested, and `resolvePersistedScopeAfterGrant`
already encodes that rule -- but the ordinary authorization leg never
gave it a `requestedScope` to fall back to, so nothing was persisted and
the previous stored scope kept being reported as what the current token
carries.

`authenticate()` now records `provider.scope` as the pending
authorization scope once the authorization URL has been captured, so it
survives the redirect and reaches `completeOAuthFlow`. The
enterprise-managed leg had the same defect for the same reason and is
fixed one level up: it now falls back to `scopeForMint`, which is what
the mint actually asked for, rather than to the raw
`pendingAuthorizationScope` that is undefined on this leg.

A response that does carry `scope` still wins over the request, on both
legs.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-25 00:35:10 -04:00
commit db23bc9b97
1 changed files with 108 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/mcp/oauthManager.ts
View file

@ -305,9 +305,10 @@ export class OAuthManager {
resourceMetadataUrl,
});
const requestedScope = provider.scope;
const result = await mcpAuth(provider, {
serverUrl,
scope: provider.scope,
scope: requestedScope,
fetchFn: this.params.effectiveAuthFetch,
resourceMetadataUrl,
});
@ -323,6 +324,14 @@ export class OAuthManager {
throw new Error("Failed to capture authorization URL");
}
// RFC 6749 5.1: an omitted `scope` in the token response means the grant
// is identical to what was requested. Carry the request across the
// redirect so completeOAuthFlow has that fallback to persist (#2117) --
// the step-up paths already do this, and without it an ordinary grant
// whose AS echoes no scope leaves the previous stored scope standing as
// if it were still what the current token carries.
this.pendingAuthorizationScope = requestedScope;
const stateParam = capturedUrl.searchParams.get("state");
if (stateParam && this.params.onBeforeOAuthRedirect) {
const parsedState = parseOAuthState(stateParam);
@ -357,10 +366,13 @@ export class OAuthManager {
authorizationCode,
iss,
);
const requestedScope = this.pendingAuthorizationScope;
// `scopeForMint` -- not `pendingAuthorizationScope` -- is what the
// mint actually asked for, so it is the RFC 6749 5.1 fallback here
// (the two differ on the ordinary leg, where only the config carries
// a scope).
const scopeToPersist = resolvePersistedScopeAfterGrant(
tokens.scope,
requestedScope,
scopeForMint,
);
if (scopeToPersist) {
await this.requireStorage().saveScope(