modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2) (#503)

Browse source 
* add support for .oauth-protected-resource metadata endpoint and www-authenticate

* test and types

* thread throughs scopes

* have example separate AS and RS

* make inmemory explicitly demo

* fix type

* fix types

* fix client example

* fixup comments

* refactor metadata endpoints to cleanup

* almost working w/ forwarding

* separate AS/RS working

* add to readme

* de-async the auth server setup for happier top level flow

* add test for new router

* fix test

* remove redundant comment

* clarify comment

* remove more unused endpoints

* simplify router

* slim down

* simplify verifier, and fix router test

* fix doc string
This commit is contained in:
Paul Carleton 2025-05-21 13:13:34 +01:00 • committed by GitHub
commit ac1b80a331
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 787 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

41
src/shared/auth.ts
View file

@ -109,6 +109,44 @@ export const OAuthTokenRevocationRequestSchema = z.object({
token_type_hint: z.string().optional(),
}).strip();
/**
* RFC 9728 OAuth Protected Resource Metadata
*/
export const OAuthProtectedResourceMetadataSchema = z.object({
// REQUIRED fields
resource: z.string().url(),
// OPTIONAL fields
authorization_servers: z.array(z.string().url()).optional(),
jwks_uri: z.string().url().optional(),
scopes_supported: z.array(z.string()).optional(),
bearer_methods_supported: z.array(z.string()).optional(),
resource_signing_alg_values_supported: z.array(z.string()).optional(),
resource_name: z.string().optional(),
resource_documentation: z.string().url().optional(),
resource_policy_uri: z.string().url().optional(),
resource_tos_uri: z.string().url().optional(),
tls_client_certificate_bound_access_tokens: z.boolean().optional(),
authorization_details_types_supported: z.array(z.string()).optional(),
dpop_signing_alg_values_supported: z.array(z.string()).optional(),
dpop_bound_access_tokens_required: z.boolean().optional(),
// Signed metadata JWT
signed_metadata: z.string().optional()
}).strict();
export type OAuthMetadata = z.infer<typeof OAuthMetadataSchema>;
export type OAuthTokens = z.infer<typeof OAuthTokensSchema>;
export type OAuthErrorResponse = z.infer<typeof OAuthErrorResponseSchema>;
@ -116,4 +154,5 @@ export type OAuthClientMetadata = z.infer<typeof OAuthClientMetadataSchema>;
export type OAuthClientInformation = z.infer<typeof OAuthClientInformationSchema>;
export type OAuthClientInformationFull = z.infer<typeof OAuthClientInformationFullSchema>;
export type OAuthClientRegistrationError = z.infer<typeof OAuthClientRegistrationErrorSchema>;
export type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;
export type OAuthTokenRevocationRequest = z.infer<typeof OAuthTokenRevocationRequestSchema>;
export type OAuthProtectedResourceMetadata = z.infer<typeof OAuthProtectedResourceMetadataSchema>;