* add type and schema for protected resource metadata
* add private variable to keep track of
authorization server url to avoid fetching Protected Resource Metadata every time
* change auth flow to use authroization server and
add function to discover protected resource metadata
* add/modify tests for new added auth functions
* modify test to use the authorization server
* remove unused variable
* add resource parameter when building auth url
* Change resource to use the protected resource metadata
* resolve typo.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* Update src/client/sse.ts import.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove log.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* Update section title.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove log.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* remove resource parameter.
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* make backwards compatibile
* s/resourceServerUrl/serverUrl/g for backwards compat
* fix test comment
---------
Co-authored-by: itsuki <itsuki.enjyoy@gmail.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
Co-authored-by: Paul Carleton <paulc@anthropic.com>
- Add optional scope parameter to startAuthorization function signature
- Include scope in authorization URL query parameters when provided
- Update auth function to pass through scope from provider.clientMetadata
- Add tests to verify scope is correctly included/excluded from auth URL
This enhancement allows clients to specify authorization scopes during the OAuth flow.
* This fixes#378
* In types.ts
- set LATEST_PROTOCOL_VERSION to "2025-03-26"
- add "2025-03-26" to SUPPORTED_PROTOCOL_VERSIONS
* In auth.test.ts
- in test "returns metadata when discovery succeeds"
- expect "MCP-Protocol-Version" to be "2025-03-26"
