modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Feat: Separate authorization server and resource server on client auth flow (#416)

Browse source 
* add type and schema for protected resource metadata

* add private variable to keep track of
authorization server url to avoid fetching Protected Resource Metadata every time

* change auth flow to use authroization server and
add function to discover protected resource metadata

* add/modify tests for new added auth functions

* modify test to use the authorization server

* remove unused variable

* add resource parameter when building auth url

* Change resource to use the protected resource metadata

* resolve typo.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* Update src/client/sse.ts import.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove log.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* Update section title.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove log.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* make backwards compatibile

* s/resourceServerUrl/serverUrl/g for backwards compat

* fix test comment

---------

Co-authored-by: itsuki <itsuki.enjyoy@gmail.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
Co-authored-by: Paul Carleton <paulc@anthropic.com>
This commit is contained in:
Itsuki 2025-05-21 22:55:38 +09:00 • committed by GitHub
commit 69dbfac0e4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 674 additions and 171 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/client/sse.ts
View file

@ -1,7 +1,7 @@
import { EventSource, type ErrorEvent, type EventSourceInit } from "eventsource";
import { Transport } from "../shared/transport.js";
import { JSONRPCMessage, JSONRPCMessageSchema } from "../types.js";
import { auth, AuthResult, OAuthClientProvider, UnauthorizedError } from "./auth.js";
import { auth, AuthResult, extractResourceMetadataUrl, OAuthClientProvider, UnauthorizedError } from "./auth.js";
export class SseError extends Error {
constructor(
@ -19,23 +19,23 @@ export class SseError extends Error {
export type SSEClientTransportOptions = {
/**
* An OAuth client provider to use for authentication.
*
*
* When an `authProvider` is specified and the SSE connection is started:
* 1. The connection is attempted with any existing access token from the `authProvider`.
* 2. If the access token has expired, the `authProvider` is used to refresh the token.
* 3. If token refresh fails or no access token exists, and auth is required, `OAuthClientProvider.redirectToAuthorization` is called, and an `UnauthorizedError` will be thrown from `connect`/`start`.
*
*
* After the user has finished authorizing via their user agent, and is redirected back to the MCP client application, call `SSEClientTransport.finishAuth` with the authorization code before retrying the connection.
*
*
* If an `authProvider` is not provided, and auth is required, an `UnauthorizedError` will be thrown.
*
*
* `UnauthorizedError` might also be thrown when sending any message over the SSE transport, indicating that the session has expired, and needs to be re-authed and reconnected.
*/
authProvider?: OAuthClientProvider;
/**
* Customizes the initial SSE request to the server (the request that begins the stream).
*
*
* NOTE: Setting this property will prevent an `Authorization` header from
* being automatically attached to the SSE request, if an `authProvider` is
* also given. This can be worked around by setting the `Authorization` header
@ -58,6 +58,7 @@ export class SSEClientTransport implements Transport {
private _endpoint?: URL;
private _abortController?: AbortController;
private _url: URL;
private _resourceMetadataUrl?: URL;
private _eventSourceInit?: EventSourceInit;
private _requestInit?: RequestInit;
private _authProvider?: OAuthClientProvider;
@ -71,6 +72,7 @@ export class SSEClientTransport implements Transport {
opts?: SSEClientTransportOptions,
) {
this._url = url;
this._resourceMetadataUrl = undefined;
this._eventSourceInit = opts?.eventSourceInit;
this._requestInit = opts?.requestInit;
this._authProvider = opts?.authProvider;
@ -83,7 +85,7 @@ export class SSEClientTransport implements Transport {
let result: AuthResult;
try {
result = await auth(this._authProvider, { serverUrl: this._url });
result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
} catch (error) {
this.onerror?.(error as Error);
throw error;
@ -193,7 +195,7 @@ export class SSEClientTransport implements Transport {
throw new UnauthorizedError("No auth provider");
}
const result = await auth(this._authProvider, { serverUrl: this._url, authorizationCode });
const result = await auth(this._authProvider, { serverUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl });
if (result !== "AUTHORIZED") {
throw new UnauthorizedError("Failed to authorize");
}
@ -225,7 +227,10 @@ export class SSEClientTransport implements Transport {
const response = await fetch(this._endpoint, init);
if (!response.ok) {
if (response.status === 401 && this._authProvider) {
const result = await auth(this._authProvider, { serverUrl: this._url });
this._resourceMetadataUrl = extractResourceMetadataUrl(response);
const result = await auth(this._authProvider, { serverUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
if (result !== "AUTHORIZED") {
throw new UnauthorizedError();
}