modelcontextprotocol/rust-sdk
Watch
1
0
Fork
You've already forked rust-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

chore: refactor OAuth client authorization api (#1009)

Browse source 
* refactor!: refactor OAuth client authorization api

`OAuthState::start_authorization` now accepts a declarative `AuthorizationRequest`
describing the client's available identity material and selects the highest-priority
mechanism the server supports: pre-registered client information → Client ID
Metadata Documents (SEP-991) → Dynamic Client Registration.

This replaces the three mechanism-specific entry points (`start_authorization`,
`start_authorization_with_metadata_url`, `start_authorization_with_preregistered_client`),
where callers previously had to know which mechanism to pick. `AuthorizationSession::new`
is consolidated the same way, and the failure-recovery pattern from #994 (returning the
manager alongside the error so `OAuthState` recovers to `Unauthorized` on transient failures)
is now applied across all registration paths. Includes new `RecordingOAuthHttpClient`-based
tests covering the priority matrix and recovery semantics, plus updated docs, examples, and
conformance client.

* fix: dcr registration uses requested application type

* fix: error for invalid combination
This commit is contained in:
Jack Amadeo 2026-07-23 14:13:11 -04:00 • committed by GitHub
commit e903341136
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 625 additions and 219 deletions
Download patch file Download diff file Expand all files Collapse all files

13
examples/clients/src/auth/oauth_client.rs
View file

@ -12,7 +12,7 @@ use rmcp::{
model::ClientInfo,
transport::{
StreamableHttpClientTransport,
auth::{AuthClient, OAuthState},
auth::{AuthClient, AuthorizationRequest, OAuthState},
streamable_http_client::StreamableHttpClientTransportConfig,
},
};
@ -128,14 +128,13 @@ async fn main() -> Result<()> {
.await
.context("Failed to initialize oauth state machine")?;
// use CIMD (SEP-991) with client metadata URL.
// passing empty scopes lets the SDK auto-select from the server's
// passing no scopes lets the SDK auto-select from the server's
// WWW-Authenticate header, Protected Resource Metadata, or AS metadata.
oauth_state
.start_authorization_with_metadata_url(
&[],
MCP_REDIRECT_URI,
Some("Test MCP Client"),
Some(&client_metadata_url),
.start_authorization(
AuthorizationRequest::new(MCP_REDIRECT_URI)
.with_client_name("Test MCP Client")
.with_client_metadata_url(&client_metadata_url),
)
.await
.context("Failed to start authorization")?;