Merge pull request #557 from koic/run_the_extension_grants_without_protected_resource_metadata

Let the client_credentials and jwt-bearer grants run without Protected Resource Metadata
This commit is contained in:
Koichi ITO 2026-09-19 00:12:33 +09:00 • committed by GitHub
commit 2c33ad061a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -131,7 +131,7 @@ module MCP
ensure_pkce_supported!(as_metadata)
effective_scope = resolve_scope(scope: scope, prm: prm || {})
effective_scope = resolve_scope(scope: scope, prm: prm)
effective_scope = normalize_offline_access_scope(effective_scope, as_metadata: as_metadata)
# Asked before registering, not after: a refusal must not leave this client registered at an authorization server
@ -960,7 +960,8 @@ module MCP
def resolve_scope(scope:, prm:)
return scope if scope && !scope.empty?
supported = prm["scopes_supported"]
# `prm` is nil on the legacy path, where nothing advertises scopes.
supported = prm && prm["scopes_supported"]
return supported.join(" ") if supported.is_a?(Array) && !supported.empty?
return @provider.scope if @provider.scope && !@provider.scope.empty?