5de4e911e3Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).
60 lines
1.6 KiB
TypeScript
60 lines
1.6 KiB
TypeScript
import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
|
|
import type {
|
|
OAuthClientMetadata,
|
|
OAuthTokens,
|
|
} from "@modelcontextprotocol/sdk/shared/auth.js";
|
|
import type { RemoteConnectRequest } from "../types.js";
|
|
|
|
const REMOTE_OAUTH_STUB_METADATA: OAuthClientMetadata = {
|
|
redirect_uris: [],
|
|
scope: "",
|
|
};
|
|
|
|
/**
|
|
* Simple OAuth client provider that just returns tokens.
|
|
* Used by the remote server to inject Bearer tokens into transport requests.
|
|
*
|
|
* The SDK may invoke {@link auth} on 401; stubs must satisfy the full provider
|
|
* surface so that path fails with a clear error instead of throwing on
|
|
* undefined `clientMetadata.scope`.
|
|
*/
|
|
export function createTokenAuthProvider(
|
|
tokens: RemoteConnectRequest["oauthTokens"],
|
|
): OAuthClientProvider | undefined {
|
|
if (!tokens) return undefined;
|
|
|
|
return {
|
|
get clientMetadata(): OAuthClientMetadata {
|
|
return REMOTE_OAUTH_STUB_METADATA;
|
|
},
|
|
get redirectUrl(): string {
|
|
return "";
|
|
},
|
|
async tokens(): Promise<OAuthTokens | undefined> {
|
|
return tokens as OAuthTokens;
|
|
},
|
|
async clientInformation() {
|
|
return undefined;
|
|
},
|
|
async saveTokens() {
|
|
// No-op
|
|
},
|
|
codeVerifier() {
|
|
return undefined;
|
|
},
|
|
async saveCodeVerifier() {
|
|
// No-op
|
|
},
|
|
clear() {
|
|
// No-op
|
|
},
|
|
async redirectToAuthorization() {
|
|
throw new Error(
|
|
"OAuth re-authorization must be performed in the Inspector web client (remote server cannot complete OAuth flows)",
|
|
);
|
|
},
|
|
state() {
|
|
return "";
|
|
},
|
|
} as unknown as OAuthClientProvider;
|
|
}
|