modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Only use path-based discovery URLs from the authorization server to discover metadata (#1070)

Browse source
This commit is contained in:
Vinay Dandekar 2025-11-03 09:52:33 -05:00 • committed by GitHub
commit 664e66e575
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 11 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/client/auth.test.ts
View file

@ -712,16 +712,12 @@ describe('OAuth Authorization', () => {
it('generates correct URLs for server with path', () => {
const urls = buildDiscoveryUrls('https://auth.example.com/tenant1');
expect(urls).toHaveLength(4);
expect(urls).toHaveLength(3);
expect(urls.map(u => ({ url: u.url.toString(), type: u.type }))).toEqual([
{
url: 'https://auth.example.com/.well-known/oauth-authorization-server/tenant1',
type: 'oauth'
},
{
url: 'https://auth.example.com/.well-known/oauth-authorization-server',
type: 'oauth'
},
{
url: 'https://auth.example.com/.well-known/openid-configuration/tenant1',
type: 'oidc'
@ -736,7 +732,7 @@ describe('OAuth Authorization', () => {
it('handles URL object input', () => {
const urls = buildDiscoveryUrls(new URL('https://auth.example.com/tenant1'));
expect(urls).toHaveLength(4);
expect(urls).toHaveLength(3);
expect(urls[0].url.toString()).toBe('https://auth.example.com/.well-known/oauth-authorization-server/tenant1');
});
});
@ -763,28 +759,28 @@ describe('OAuth Authorization', () => {
};
it('tries URLs in order and returns first successful metadata', async () => {
// First OAuth URL fails with 404
// First OAuth URL (path before well-known) fails with 404
mockFetch.mockResolvedValueOnce({
ok: false,
status: 404
});
// Second OAuth URL (root) succeeds
// Second OIDC URL (path before well-known) succeeds
mockFetch.mockResolvedValueOnce({
ok: true,
status: 200,
json: async () => validOAuthMetadata
json: async () => validOpenIdMetadata
});
const metadata = await discoverAuthorizationServerMetadata('https://auth.example.com/tenant1');
expect(metadata).toEqual(validOAuthMetadata);
expect(metadata).toEqual(validOpenIdMetadata);
// Verify it tried the URLs in the correct order
const calls = mockFetch.mock.calls;
expect(calls.length).toBe(2);
expect(calls[0][0].toString()).toBe('https://auth.example.com/.well-known/oauth-authorization-server/tenant1');
expect(calls[1][0].toString()).toBe('https://auth.example.com/.well-known/oauth-authorization-server');
expect(calls[1][0].toString()).toBe('https://auth.example.com/.well-known/openid-configuration/tenant1');
});
it('continues on 4xx errors', async () => {
@ -878,7 +874,7 @@ describe('OAuth Authorization', () => {
expect(metadata).toBeUndefined();
// Verify that all discovery URLs were attempted
expect(mockFetch).toHaveBeenCalledTimes(8); // 4 URLs × 2 attempts each (with and without headers)
expect(mockFetch).toHaveBeenCalledTimes(6); // 3 URLs × 2 attempts each (with and without headers)
});
});