modelcontextprotocol/typescript-sdk
Watch
1
0
Fork
You've already forked typescript-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
937 commits 1 branch 161 tags 11 MiB
Commit graph typescript-sdk/src/client/auth.ts
Author SHA1 Message Date
Henry Mao
4f24b8bc6f
 		Fix /.well-known/oauth-authorization-server dropping path 2025-06-24 04:36:54 +08:00
Inna Harper
66b7cd2642
 		Merge pull request #664 from modelcontextprotocol/pcarleton/auth-resource-validation2 
[auth] adjust default validation for resource parameter in client flow, and server example
 2025-06-20 08:54:12 +01:00
Ashwin Bhat
f4b8a48ded
 		feat: remove console statements from SDK code 
- Remove all console.log, console.warn, and console.error from src/client and src/server
- Add ESLint no-console rule for client and server directories (excluding tests)
- Keep console statements in test files, examples, and CLI tools as intended

Addresses feedback in PR #665

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-06-19 22:36:33 -07:00
Paul Carleton
eff548c06f
 		adjust to provided resource 2025-06-19 18:02:00 +01:00
Paul Carleton
87da0e0c3a
 		adjust default validation for resource parameter in client flow, and server example 2025-06-19 17:52:24 +01:00
Paul Carleton
86bed6aaac
 		adjust comment 2025-06-18 16:05:14 +01:00
Paul Carleton
dada5f66f5
 		wip helper func 2025-06-18 15:52:56 +01:00
Olivier Chafik
f854b58443
 		test validateProtectedResourceMetadata override 2025-06-18 15:26:58 +01:00
Olivier Chafik
4b3db9bbeb
 		stricter PRM check overridable w/ OAuthClientProvider.validateProtectedResourceMetadata 2025-06-18 15:06:16 +01:00
Olivier Chafik
354318f147
 		auth: don't fail the prm if the resource doesn't match 2025-06-18 12:14:57 +01:00
Olivier Chafik
6a01d0d4a5
 		shrink token.test.ts 2025-06-18 12:07:38 +01:00
Olivier Chafik
4fcbb6870b
 		verify PRM resource 2025-06-18 11:50:39 +01:00
Olivier Chafik
b16a415623
 		cleanups 2025-06-17 11:15:38 +01:00
Olivier Chafik
224a2e242d
 		update resource to be a url 2025-06-17 00:18:33 +01:00
Olivier Chafik
1f4e42c09e
 		cleanup auth-utils and remove example files 
Co-Authored-By: Claude <noreply@anthropic.com>
 2025-06-16 20:05:02 +01:00
Olivier Chafik
7b5bfcee52
 		implementation of RFC 8707 Resource Indicators (Fixes #592, Fixes #635) 2025-06-16 19:29:04 +01:00
Jeff Escalante
0516f9898b
 		add state param to oauth provider (#529) 2025-05-22 12:55:00 +01:00
Frédéric Barthelet
281cf0bf8d
 		Save existing refresh_token in store if no new refresh_token is returned (#483) 
As described in https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#name-refresh-token-response,
server MAY return a new refresh_token. In case it doesn't, current implementation discard initial refresh
token if it was still valid.
 2025-05-21 17:29:56 +01:00
Itsuki
69dbfac0e4
 		Feat: Separate authorization server and resource server on client auth flow (#416) 
* add type and schema for protected resource metadata

* add private variable to keep track of
authorization server url to avoid fetching Protected Resource Metadata every time

* change auth flow to use authroization server and
add function to discover protected resource metadata

* add/modify tests for new added auth functions

* modify test to use the authorization server

* remove unused variable

* add resource parameter when building auth url

* Change resource to use the protected resource metadata

* resolve typo.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* Update src/client/sse.ts import.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove log.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* Update section title.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove log.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* remove resource parameter.

Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>

* make backwards compatibile

* s/resourceServerUrl/serverUrl/g for backwards compat

* fix test comment

---------

Co-authored-by: itsuki <itsuki.enjyoy@gmail.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
Co-authored-by: Paul Carleton <paulc@anthropic.com>
 2025-05-21 14:55:38 +01:00
Xiao Yijun
66dec56467
 		feat(auth): support custom scope in authorization requests (#491) 
* feat(auth): support custom scope in authorization requests

* fix(auth): default to provider's scope if not provided
 2025-05-14 18:45:18 +01:00
Paul Carleton
30b5544e8b feat: Add scope parameter to startAuthorization function 
- Add optional scope parameter to startAuthorization function signature
- Include scope in authorization URL query parameters when provided
- Update auth function to pass through scope from provider.clientMetadata
- Add tests to verify scope is correctly included/excluded from auth URL

This enhancement allows clients to specify authorization scopes during the OAuth flow.
 2025-05-02 08:40:58 +00:00
Peter Raboud
2a2392be26
 		Correctly pass redirect_uri to tokens call 2025-03-25 14:20:34 -07:00
Jerome
26b47438c6
 		Tidy up CORS error catching 2025-02-24 10:39:38 +00:00
Jerome
1b8e94ca40
 		During metadata fetching, try with the MCP header, then without, then return undefined if both fail 2025-02-22 16:20:41 +00:00
Justin Spahr-Summers
a0069e2341
 		Split full/partial client information 2025-02-17 11:41:42 +00:00
Justin Spahr-Summers
afae4212e6
 		Move OAuth definitions into shared, add more 2025-02-17 11:07:59 +00:00
Justin Spahr-Summers
b1f4b65709
 		Improve auth docs and add finishAuth convenience method 2025-02-17 10:45:34 +00:00
Justin Spahr-Summers
44a440854f
 		Code review comments 2025-02-17 10:34:57 +00:00
Justin Spahr-Summers
fceebdcf5a
 		Add MCP-Protocol-Version header 2025-02-11 17:58:58 +00:00
Justin Spahr-Summers
141f3f5532
 		Don't need full OAuth client metadata in response 2025-02-11 16:54:57 +00:00
Justin Spahr-Summers
9fea0af998
 		Correctly provide client ID (+ secret) to every auth step 2025-02-11 15:59:16 +00:00
Justin Spahr-Summers
47fd6df229
 		Higher-level auth flow 2025-02-11 15:13:17 +00:00
Justin Spahr-Summers
4c87fb50ab
 		Prefix client metadata + info with OAuth 2025-02-11 14:17:02 +00:00
Justin Spahr-Summers
d17a382a65
 		Auth tests and fixes 2025-02-11 13:47:58 +00:00
Justin Spahr-Summers
2b9a58182c
 		Add dynamic client registration 2025-02-11 13:32:10 +00:00
Justin Spahr-Summers
62d67ad874
 		Add refresh token support 2025-02-06 16:37:47 +00:00
Justin Spahr-Summers
fe24aa5c26
 		Remove nested folder for auth 2025-02-06 16:34:33 +00:00
Renamed from src/client/auth/auth.ts (Previous history)