f8a46726b7
An RFC 9728 `WWW-Authenticate: Bearer resource_metadata="…"` challenge was parsed and then dropped by the normalized `AuthChallenge`, so every challenge-driven `mcpAuth()` call ran discovery without it and probed locations derived from the MCP server URL instead. OAuth failed outright against any server whose metadata document lives off the well-known path. The SDK handles this correctly inside its own transports, but the Inspector never reaches that path — it intercepts the 401 and drives `auth()` itself to capture the authorization URL and run the step-up scope union. Carry the advertised URL on `AuthChallenge` as a string (it crosses the web client's remote-backend boundary as JSON), convert it at the OAuth boundary, and pass it to the standard challenge leg, the forced step-up leg, and CIMD pre-registration — which runs before `auth()` and did its own discovery. A malformed value is ignored rather than surfaced, matching the SDK's parser. The callback leg needs nothing: SDK `auth()` persists the URL in its discovery state. Adds an `oauth.resourceMetadataPath` test-server mode that moves the document off the well-known path entirely, so the integration test proves discovery genuinely fails without the fix. Closes #2071 Signed-off-by: cliffhall <cliff@futurescale.com>
62 lines
2.2 KiB
TypeScript
62 lines
2.2 KiB
TypeScript
import {
|
|
discoverAuthorizationServerMetadata,
|
|
discoverOAuthProtectedResourceMetadata,
|
|
} from "@modelcontextprotocol/client";
|
|
import type { OAuthClientInformation } from "@modelcontextprotocol/client";
|
|
import { getAuthorizationServerUrl } from "./discovery.js";
|
|
import type { BaseOAuthClientProvider } from "./providers.js";
|
|
|
|
/**
|
|
* When the authorization server supports URL-based client IDs (SEP-991 / CIMD),
|
|
* pre-register `{ client_id: clientMetadataUrl }` before SDK `auth()`.
|
|
*
|
|
* SDK `auth()` rejects non-HTTPS `clientMetadataUrl` during registration, but
|
|
* accepts an already-stored `client_id` (including `http://` URLs used by local
|
|
* dev/test metadata servers). Production CIMD metadata documents should still
|
|
* use HTTPS per SEP-991.
|
|
*
|
|
* `resourceMetadataUrl` is the RFC 9728 document advertised by the
|
|
* `WWW-Authenticate` challenge, when the caller has one. It matters here and
|
|
* not only in `auth()`: this runs *before* SDK `auth()`, so without it the
|
|
* pre-registration probe would do its own default-location discovery and miss
|
|
* a document served from a non-default path (#2071).
|
|
*/
|
|
export async function ensureCimdClientRegistration(params: {
|
|
serverUrl: string;
|
|
provider: BaseOAuthClientProvider;
|
|
fetchFn?: typeof fetch;
|
|
resourceMetadataUrl?: URL;
|
|
}): Promise<void> {
|
|
const clientMetadataUrl = params.provider.clientMetadataUrl?.trim();
|
|
if (!clientMetadataUrl) return;
|
|
|
|
const existing = await params.provider.clientInformation();
|
|
if (existing?.client_id) return;
|
|
|
|
let resourceMetadata;
|
|
try {
|
|
resourceMetadata = await discoverOAuthProtectedResourceMetadata(
|
|
params.serverUrl,
|
|
{ resourceMetadataUrl: params.resourceMetadataUrl },
|
|
);
|
|
} catch {
|
|
resourceMetadata = undefined;
|
|
}
|
|
|
|
const authServerUrl = getAuthorizationServerUrl(
|
|
params.serverUrl,
|
|
resourceMetadata,
|
|
);
|
|
|
|
const metadata = await discoverAuthorizationServerMetadata(authServerUrl, {
|
|
...(params.fetchFn && { fetchFn: params.fetchFn }),
|
|
});
|
|
if (!metadata?.client_id_metadata_document_supported) return;
|
|
|
|
const clientInformation: OAuthClientInformation = {
|
|
client_id: clientMetadataUrl,
|
|
};
|
|
await params.provider.saveClientInformation(clientInformation, {
|
|
registrationKind: "cimd",
|
|
});
|
|
}
|