Merge pull request #638 from modelcontextprotocol/ochafik/auth-resource

RFC 8707 Resource Indicators Implementation

src/shared/auth-utils.test.ts

@@ -0,0 +1,30 @@
+import { resourceUrlFromServerUrl } from './auth-utils.js';
+
+describe('auth-utils', () => {
+  describe('resourceUrlFromServerUrl', () => {
+    it('should remove fragments', () => {
+      expect(resourceUrlFromServerUrl(new URL('https://example.com/path#fragment')).href).toBe('https://example.com/path');
+      expect(resourceUrlFromServerUrl(new URL('https://example.com#fragment')).href).toBe('https://example.com/');
+      expect(resourceUrlFromServerUrl(new URL('https://example.com/path?query=1#fragment')).href).toBe('https://example.com/path?query=1');
+    });
+
+    it('should return URL unchanged if no fragment', () => {
+      expect(resourceUrlFromServerUrl(new URL('https://example.com')).href).toBe('https://example.com/');
+      expect(resourceUrlFromServerUrl(new URL('https://example.com/path')).href).toBe('https://example.com/path');
+      expect(resourceUrlFromServerUrl(new URL('https://example.com/path?query=1')).href).toBe('https://example.com/path?query=1');
+    });
+
+    it('should keep everything else unchanged', () => {
+      // Case sensitivity preserved
+      expect(resourceUrlFromServerUrl(new URL('https://EXAMPLE.COM/PATH')).href).toBe('https://example.com/PATH');
+      // Ports preserved
+      expect(resourceUrlFromServerUrl(new URL('https://example.com:443/path')).href).toBe('https://example.com/path');
+      expect(resourceUrlFromServerUrl(new URL('https://example.com:8080/path')).href).toBe('https://example.com:8080/path');
+      // Query parameters preserved
+      expect(resourceUrlFromServerUrl(new URL('https://example.com?foo=bar&baz=qux')).href).toBe('https://example.com/?foo=bar&baz=qux');
+      // Trailing slashes preserved
+      expect(resourceUrlFromServerUrl(new URL('https://example.com/')).href).toBe('https://example.com/');
+      expect(resourceUrlFromServerUrl(new URL('https://example.com/path/')).href).toBe('https://example.com/path/');
+    });
+  });
+});

src/shared/auth-utils.ts

@@ -0,0 +1,14 @@
+/**
+ * Utilities for handling OAuth resource URIs.
+ */
+
+/**
+ * Converts a server URL to a resource URL by removing the fragment.
+ * RFC 8707 section 2 states that resource URIs "MUST NOT include a fragment component".
+ * Keeps everything else unchanged (scheme, domain, port, path, query).
+ */
+export function resourceUrlFromServerUrl(url: URL): URL {
+  const resourceURL = new URL(url.href);
+  resourceURL.hash = ''; // Remove fragment
+  return resourceURL;
+}