364d8c9dbc
Adds two optional per-server fields — `oauth.authorizationUrl` and `oauth.tokenUrl` — that override the endpoints authorization-server metadata discovery resolved, so a server can be pointed at a development or staging authorization server without changing what it advertises. SDK v2 routes both endpoints through the discovered metadata document and neither through OAuthClientProvider, so the override is applied by wrapping the client's base fetch and patching the metadata document in flight (core/auth/endpointOverrides.ts). Wrapping the base fetch — rather than only the auth fetch — also covers the discovery the SDK runs from inside the transport on the 401/refresh path. The fields round-trip through mcp.json, the /api/servers routes, the runner (CLI/TUI), and the Server Settings → Authorization panel, where a value that is not an absolute http(s) URL is flagged inline; at runtime such a value is dropped with a single warning rather than failing the connection. Signed-off-by: cliffhall <cliff@futurescale.com>
138 lines
3.4 KiB
TypeScript
138 lines
3.4 KiB
TypeScript
// Types
|
|
export type {
|
|
OAuthStep,
|
|
AuthProtocol,
|
|
OAuthClientRegistrationKind,
|
|
MessageType,
|
|
StatusMessage,
|
|
OAuthFlowState,
|
|
OAuthConnectionState,
|
|
CallbackParams,
|
|
} from "./types.js";
|
|
export {
|
|
EMPTY_OAUTH_FLOW_STATE,
|
|
authProtocolFromEnterpriseManaged,
|
|
} from "./types.js";
|
|
|
|
export {
|
|
buildOAuthConnectionState,
|
|
hasPersistedOAuthServerState,
|
|
isServerOAuthConfigured,
|
|
protocolFromOAuthConfig,
|
|
} from "./connection-state.js";
|
|
export type { BuildOAuthConnectionStateParams } from "./connection-state.js";
|
|
|
|
export { ensureCimdClientRegistration } from "./cimd.js";
|
|
|
|
export { mcpAuth, type McpAuthOptions, type McpAuthResult } from "./mcpAuth.js";
|
|
export { computeScopeUnion, isStrictScopeSuperset } from "./scopes.js";
|
|
|
|
// Custom authorization-request parameters (#2018)
|
|
export {
|
|
RESERVED_AUTHORIZATION_PARAMS,
|
|
isReservedAuthorizationParam,
|
|
authorizationParamKeyError,
|
|
applyAuthorizationParams,
|
|
} from "./authorizationParams.js";
|
|
export type { ReservedAuthorizationParam } from "./authorizationParams.js";
|
|
|
|
// Authorization/token endpoint overrides (#1906)
|
|
export {
|
|
oauthEndpointUrlError,
|
|
normalizeOAuthEndpointOverrides,
|
|
isAuthorizationServerMetadata,
|
|
applyOAuthEndpointOverrides,
|
|
withOAuthEndpointOverrides,
|
|
} from "./endpointOverrides.js";
|
|
export type { OAuthEndpointOverrides } from "./endpointOverrides.js";
|
|
|
|
// Storage
|
|
export type {
|
|
OAuthStorage,
|
|
IdpSessionState,
|
|
SaveClientInformationOptions,
|
|
} from "./storage.js";
|
|
export { getServerSpecificKey, OAUTH_STORAGE_KEYS } from "./storage.js";
|
|
|
|
// Providers
|
|
export type {
|
|
OAuthProviderConfig,
|
|
RedirectUrlProvider,
|
|
OAuthNavigation,
|
|
OAuthNavigationCallback,
|
|
} from "./providers.js";
|
|
export {
|
|
MutableRedirectUrlProvider,
|
|
ConsoleNavigation,
|
|
CallbackNavigation,
|
|
BaseOAuthClientProvider,
|
|
} from "./providers.js";
|
|
|
|
// Utilities
|
|
export {
|
|
parseHttpUrl,
|
|
parseOAuthCallbackParams,
|
|
generateOAuthState,
|
|
parseOAuthState,
|
|
generateOAuthErrorDescription,
|
|
formatOAuthFailureDetail,
|
|
isUnauthorizedError,
|
|
} from "./utils.js";
|
|
|
|
export type {
|
|
AuthChallenge,
|
|
AuthChallengeReason,
|
|
AuthChallengeOutcome,
|
|
HandleAuthChallengeOptions,
|
|
ParseAuthChallengeContext,
|
|
WwwAuthenticateBearerParams,
|
|
} from "./challenge.js";
|
|
export {
|
|
AuthChallengeError,
|
|
AuthRecoveryRequiredError,
|
|
parseAuthChallengeFromError,
|
|
parseAuthChallengeFromResponse,
|
|
parseScopeString,
|
|
parseWwwAuthenticateBearer,
|
|
unionAuthorizationScopes,
|
|
isAuthChallengeError,
|
|
isConnectAuthRecoveryError,
|
|
findNestedAuthError,
|
|
EMA_STEP_UP_PENDING_URL,
|
|
} from "./challenge.js";
|
|
|
|
export {
|
|
isStandardOAuthStepUp,
|
|
isEmaStepUp,
|
|
isStepUpConfirmation,
|
|
stepUpConfirmMessage,
|
|
stepUpFollowUpMessage,
|
|
stepUpModalTitle,
|
|
stepUpAuthorizeActionLabel,
|
|
emaStepUpInProgressMessage,
|
|
emaStepUpSuccessMessage,
|
|
emaStepUpFailureMessage,
|
|
stepUpAdditionalScopes,
|
|
stepUpInsufficientScopeMessage,
|
|
oauthPreRedirectToastCopy,
|
|
isReAuthBannerReason,
|
|
reAuthBannerMessage,
|
|
lostAuthorizationStateTitle,
|
|
lostAuthorizationStateMessage,
|
|
lostAuthorizationStateActionLabel,
|
|
issuerMismatchTitle,
|
|
issuerMismatchMessage,
|
|
issuerBindingFailureCopy,
|
|
type OAuthInteractiveAuthKind,
|
|
} from "./oauthUx.js";
|
|
|
|
export {
|
|
findIssuerBindingFailure,
|
|
type IssuerBindingFailure,
|
|
} from "./issuerBinding.js";
|
|
|
|
// Discovery
|
|
export { discoverScopes } from "./discovery.js";
|
|
|
|
// Logging (re-exported from core/logging)
|
|
export { silentLogger } from "../logging/index.js";
|