afa0ba6eeb
When RFC 9728 protected-resource metadata names no authorization server, the
MCP server URL stands in as one. `getAuthorizationServerUrl` built that with
`new URL("/", serverUrl)`, which discards the path — exactly the part discovery
needs when the server is not hosted at the domain root. The SDK's
`buildDiscoveryUrls` derives the path-scoped well-known locations from that
pathname, so an origin-only value could only ever probe the domain root, which
404s for a server like `https://example.com/mod/minilesson/mcp.php`.
Keep the path (and strip query/fragment, which an RFC 8414 issuer never
carries). A straight swap would regress the case the origin-only value did
serve — a server that merely lives under a path while publishing its metadata
at the root — so the URL becomes the first of two candidates:
`getAuthorizationServerUrlCandidates` yields the path-scoped form then the bare
origin, and `discoverAuthorizationServerMetadataForServer` walks them, treating
a candidate's failure as non-fatal while another remains and rethrowing the
first error only when all of them fail.
`discoverScopes` and the CIMD pre-registration probe both go through the walk.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
65 lines
2.6 KiB
TypeScript
65 lines
2.6 KiB
TypeScript
import { discoverOAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
|
|
import type { OAuthClientInformation } from "@modelcontextprotocol/client";
|
|
import { discoverAuthorizationServerMetadataForServer } from "./discovery.js";
|
|
import type { BaseOAuthClientProvider } from "./providers.js";
|
|
|
|
/**
|
|
* When the authorization server supports URL-based client IDs (SEP-991 / CIMD),
|
|
* pre-register `{ client_id: clientMetadataUrl }` before SDK `auth()`.
|
|
*
|
|
* SDK `auth()` rejects non-HTTPS `clientMetadataUrl` during registration, but
|
|
* accepts an already-stored `client_id` (including `http://` URLs used by local
|
|
* dev/test metadata servers). Production CIMD metadata documents should still
|
|
* use HTTPS per SEP-991.
|
|
*
|
|
* `resourceMetadataUrl` is the RFC 9728 document advertised by the
|
|
* `WWW-Authenticate` challenge, when the caller has one. It matters here and
|
|
* not only in `auth()`: this runs *before* SDK `auth()`, so without it the
|
|
* pre-registration probe would do its own default-location discovery and miss
|
|
* a document served from a non-default path (#2071).
|
|
*/
|
|
export async function ensureCimdClientRegistration(params: {
|
|
serverUrl: string;
|
|
provider: BaseOAuthClientProvider;
|
|
fetchFn?: typeof fetch;
|
|
resourceMetadataUrl?: URL;
|
|
}): Promise<void> {
|
|
const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
|
|
if (!clientMetadataUrl) return;
|
|
|
|
const existing = await params.provider.clientInformation();
|
|
if (existing?.client_id) return;
|
|
|
|
let resourceMetadata;
|
|
try {
|
|
resourceMetadata = await discoverOAuthProtectedResourceMetadata(
|
|
params.serverUrl,
|
|
{ resourceMetadataUrl: params.resourceMetadataUrl },
|
|
// The same fetch the AS-metadata leg below uses. On web that is
|
|
// `createRemoteFetch`, which proxies through the backend to sidestep
|
|
// CORS — on the global `fetch` this leg would fail in the browser, be
|
|
// swallowed by the catch, and leave CIMD probing the wrong
|
|
// authorization server (Copilot).
|
|
params.fetchFn,
|
|
);
|
|
} catch {
|
|
resourceMetadata = undefined;
|
|
}
|
|
|
|
// Walks the path-scoped authorization-server URL before the bare origin, so a
|
|
// server hosted under a path is probed where it actually publishes its
|
|
// metadata rather than only at the domain root (#2110).
|
|
const metadata = await discoverAuthorizationServerMetadataForServer(
|
|
params.serverUrl,
|
|
resourceMetadata,
|
|
params.fetchFn,
|
|
);
|
|
if (!metadata?.client_id_metadata_document_supported) return;
|
|
|
|
const clientInformation: OAuthClientInformation = {
|
|
client_id: clientMetadataUrl,
|
|
};
|
|
await params.provider.saveClientInformation(clientInformation, {
|
|
registrationKind: "cimd",
|
|
});
|
|
}
|