c9f381a3ee
## Motivation and Context `MCP::Client::OAuth::Flow` takes an `http_client_factory:`, but `MCP::Client::HTTP` builds the flow itself and passes none, so an application using `oauth:` could not add middleware to the requests the flow makes: Protected Resource Metadata and authorization server metadata discovery, dynamic client registration, and every token request. The block that customizes the transport's Faraday connection does not help, because that connection is bound to the MCP server URL and carries the `headers:` meant for that server, and the authorization server is a different origin. The TypeScript SDK hands the transport's `fetch` to `auth()` and the Python SDK sends the provider's requests through the transport's httpx client, so both let an application instrument these requests; this SDK did not. (#558) Providers now take `http_client_customizer:`, a callable invoked with the Faraday connection the flow builds for its own requests, next to the other callables a provider already holds. It runs after the SDK's defaults (`Accept: application/json`, no redirect following) and between two middlewares of the SDK's own: `Flow::RequestedURLStamp`, registered before the customizer is invoked, records the URL the flow asked for on the request environment, and `Flow::RequestedOriginGuard`, registered last, sees what the customizer's middleware did to the request after that record. A request that would leave that origin, by following a redirect or rewriting the URL, or that arrives without the record, is refused with `Flow::DestinationMismatchError` before it reaches the adapter. The record lives on the environment rather than in `env.request.context`, which stays the application's to fill or replace. The error is an `ArgumentError` rather than an `AuthorizationError` so neither discovery nor the transport's refresh fallback can absorb a configuration mistake. The boundary resembles the one the Python SDK keeps for its own requests, which follows a redirect only within the origin; this flow follows none itself. `Flow.build_http_client` assembles that connection and `Flow.new(http_client_factory:)` keeps replacing it whole. Following done inside an adapter cannot be seen by any guard, so the documentation keeps that, `Accept-Encoding`, and `raise_error` off the list of things a customizer may add, and notes that a recording middleware sees client credentials and tokens. Fixes #558. ## How Has This Been Tested? New tests in `test/mcp/client/oauth/flow_test.rb`, `test/mcp/client/oauth/http_oauth_test.rb`, and the three provider test files. Against the library before this change, every one of them fails, on the unknown keyword or on the missing reader. ## Breaking Changes None. The customizer is opt-in, and the guard cannot fire on the SDK's own middleware-free connection.
67 lines
2.8 KiB
Ruby
67 lines
2.8 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module MCP
|
|
class Client
|
|
module OAuth
|
|
# Bounds an OAuth response body while it arrives, rather than after it has been buffered.
|
|
# Discovery documents, registration responses, and token responses are all small by definition,
|
|
# so a body that keeps growing is never something worth holding in memory. Matches the 4 MiB cap of
|
|
# `MCP::Client::HTTP::MAX_MESSAGE_BYTES` and `MCP::Client::Stdio::MAX_LINE_BYTES`.
|
|
class BoundedBody
|
|
MAX_RESPONSE_BYTES = 4 * 1024 * 1024
|
|
|
|
# Raised while the body is read. Each caller translates it into its own error type,
|
|
# so this never reaches an embedder.
|
|
class TooLargeError < StandardError; end
|
|
|
|
# What the OAuth code reads from a response. The Faraday response itself is not passed on,
|
|
# so a later caller cannot reach the unbounded `response.body` by accident.
|
|
Response = Struct.new(:status, :body)
|
|
|
|
def initialize(max_bytes: MAX_RESPONSE_BYTES)
|
|
@max_bytes = max_bytes
|
|
@buffer = +""
|
|
end
|
|
|
|
# Faraday `on_data` streaming callback. The chunks arrive decompressed: the default `Net::HTTP` adapter negotiates
|
|
# `Accept-Encoding` itself and reads the body through `Net::HTTPResponse#inflater`, so a small compressed body
|
|
# that expands past the cap is refused partway through the expansion rather than after it. That holds only while
|
|
# the connection leaves `Accept-Encoding` to the adapter; see `Flow.build_http_client`.
|
|
def on_data
|
|
proc do |chunk, _received_bytes, _env|
|
|
@buffer << chunk
|
|
|
|
raise TooLargeError, too_large_message if @buffer.bytesize > @max_bytes
|
|
end
|
|
end
|
|
|
|
# The status paired with the bounded body. Adapters that ignore `on_data` leave the buffer empty and deliver
|
|
# the whole body in `response.body`, so that path is measured here instead; the bytes are already allocated by then,
|
|
# but refusing them still keeps an over-cap document out of `JSON.parse`.
|
|
def response_for(response)
|
|
Response.new(response.status, bounded_body(response))
|
|
end
|
|
|
|
private
|
|
|
|
def bounded_body(response)
|
|
return @buffer unless @buffer.empty?
|
|
|
|
body = response.body
|
|
body = body.is_a?(String) ? body : body.to_s
|
|
raise TooLargeError, too_large_message if body.bytesize > @max_bytes
|
|
|
|
body
|
|
end
|
|
|
|
def too_large_message
|
|
# Not "the authorization server": protected resource metadata comes from the MCP server's own origin,
|
|
# so this message covers endpoints on both sides of the flow.
|
|
"Response body from the OAuth endpoint exceeds #{@max_bytes} bytes"
|
|
end
|
|
end
|
|
|
|
private_constant :BoundedBody
|
|
end
|
|
end
|
|
end
|