cliffhall
e5c20608bf
fix(auth): never read a stream, and say what the issuer override does not do ...
Two review findings on the fetch wrapper:
The content-type test was a substring match for "json", which also
matches `application/x-ndjson` — how the streamable-HTTP transport can
serve its long-lived server-push channel (`isLongLivedStreamResponse`).
Awaiting `.json()` on a clone of an unbounded stream never resolves, so
the MCP connection would hang for as long as an override was configured.
It now matches the media type exactly (`application/json` or a `+json`
suffix), with a regression test driven by a stream that never closes.
The overrides also leave `issuer` as discovery returned it, so pointing
one at an authorization server that advertises a different issuer is
rejected on callback by the RFC 9207 / SEP-2352 mix-up defense. That
check is deliberately not weakened; the limit is now stated on the
module, in the field description, and in the configuration guide.
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-08-16 21:52:09 -04:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix: load @napi-rs/keyring lazily so an unsupported platform degrades instead of crashing ( #1905 ) ( #1948 )
2026-08-08 18:15:20 -07:00
Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage.
2026-07-04 21:56:45 -07:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
fix(core): start OAuth on a modern/auto-era connect ( #1805 ) ( #1809 )
2026-07-27 15:06:01 -04:00
Address @claude review: format core/, typed output-validation error, document progress heuristic
2026-07-15 11:08:54 -04:00
Address @claude review: format core/, typed output-validation error, document progress heuristic
2026-07-15 11:08:54 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
fix(auth): never read a stream, and say what the issuer override does not do
2026-08-16 21:52:09 -04:00
feat(auth): per-server authorization and token URL overrides
2026-08-16 20:36:24 -04:00
fix(auth): explicit re-authorize when the OAuth callback state was lost ( #1808 ) ( #1810 )
2026-07-27 18:08:31 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
fix(auth): keep oauth-persist browser-safe (move Node file backend out)
2026-07-08 16:20:31 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
fix(auth): explicit re-authorize when the OAuth callback state was lost ( #1808 ) ( #1810 )
2026-07-27 18:08:31 -04:00
feat: per-server custom OAuth authorization-request parameters ( #2018 )
2026-08-15 19:31:41 -04:00
Auth hardening CI gaps + SDK consolidation: EMA leg 2 / scopes ( #1527 ) ( #1725 )
2026-07-19 22:36:21 -04:00
feat(web,core): enterprise-managed authorization (EMA) ( #1509 ) ( #1512 )
2026-06-24 22:15:12 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX ( #1694 )
2026-07-16 16:52:53 -04:00
chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory ( #1900 )
2026-08-01 20:13:30 -04:00
e5c20608bf