Konstantin Konstantinov
5a9de1c638
Relocate tests under /test ( #1220 )
2025-12-05 23:56:12 +00:00
Konstantin Konstantinov
4fb4d4d55e
SEP-1046: Client credentials flow for M2M without user interaction ( #1157 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
2025-11-28 17:01:15 +00:00
Adam Kuhn
b4c6090bf2
coerce 'expires_in' to be a number ( #1111 )
...
Co-authored-by: Konstantin Konstantinov <KKonstantinov@users.noreply.github.com>
Co-authored-by: Konstantin Konstantinov <konstantin@mach5technology.com>
2025-11-28 14:13:49 +00:00
Nayana Parameswarappa
3485a06f85
Support upscoping on insufficient_scope 403 ( #1115 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
2025-11-20 19:37:44 +00:00
Matt
7fca1f2b15
feat: url based client metadata registration (SEP 991) ( #1127 )
2025-11-19 16:44:53 +00:00
Paul Carleton
2e67eb552e
[auth] Adjust scope management to line up with SEP-835 ( #1133 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
2025-11-18 17:30:50 +00:00
David Soria Parra
df56e35322
fix: Pass RequestInit options to auth requests ( #1066 )
...
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
2025-11-17 16:06:21 +00:00
Matt
98df118a4c
Migrate to vitest from jest ( #1074 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com>
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
2025-11-14 14:08:00 +00:00
Paul Carleton
8019972832
[auth] Fix march spec fallback for metadata discovery ( #1108 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com>
2025-11-13 19:31:42 +00:00
Chip
ee9fed28cc
fix: Support WWW-Authenticate scope param for SEP-835 ( #983 )
...
Co-authored-by: OtotheA <oscar@otothea.com>
2025-11-03 15:24:42 +00:00
Vinay Dandekar
664e66e575
Only use path-based discovery URLs from the authorization server to discover metadata ( #1070 )
2025-11-03 14:52:33 +00:00
Chip
874aa27a89
fix: Prefer the token_endpoint_auth_method response from DCR registration ( #1022 )
2025-10-28 11:24:46 +00:00
Simon Vestergaard Laursen
8f4150e5a0
fix: Add Accept header to auth metadata request ( #901 )
2025-10-13 15:29:47 +01:00
Luca Chang
59cb50463a
Default to S256 code challenge if not specified in authorization server metadata ( #992 )
2025-10-07 15:29:44 +01:00
Inna Harper
1150b1d843
run prettier ( #995 )
2025-10-02 18:21:00 +01:00
Paul Carleton
1f5950be01
[auth] OAuth protected-resource-metadata: fallback on 4xx not just 404 ( #879 )
...
Co-authored-by: adam jones <domdomegg+git@gmail.com>
2025-08-19 15:43:09 +01:00
Xiao Yijun
f657ead472
fix: retry next endpoint on CORS error during auth server discovery ( #827 )
2025-08-04 15:43:09 +01:00
Xiao Yijun
bb7cccc3ba
feat: support oidc discovery in client sdk ( #652 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-24 14:11:48 +01:00
Luca Chang
9d2a0aeb7b
fix: consistently use consumer-provided fetch function ( #767 )
2025-07-17 17:57:54 +01:00
Jonathan Wang
f3584f2a41
fix: use authorization_server_url as issuer when fetching metadata ( #763 )
2025-07-14 17:24:10 +01:00
Glen Maddern
4b2ad0385d
Adding invalidateCredentials() to OAuthClientProvider ( #570 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com>
2025-07-14 17:11:52 +01:00
Daniel Kelleher
a9c907dd70
Add prompt=consent for OIDC offline_access scope ( #681 )
2025-07-14 14:47:09 +01:00
Olivier Chafik
1b8d63ed6d
add metadataServerUrl to discoverMetadataWithFallback to allow external AS
2025-07-10 14:36:34 +01:00
Olivier Chafik
ea8caa9657
Merge branch 'main' into ochafik/fix-path-as
2025-07-10 14:28:57 +01:00
Inna Harper
442e13b60e
Merge pull request #756 from modelcontextprotocol/patch-1
...
Fix oauth well-known paths to retain path and query
2025-07-10 14:26:07 +01:00
Olivier Chafik
9ca7fd298f
Merge branch 'main' into ochafik/fix-path-as
2025-07-10 14:20:48 +01:00
ihrpr
5eacdf174c
fallback and refactor
2025-07-10 11:36:57 +01:00
ihrpr
72cb9a700f
add tests
2025-07-10 09:30:12 +01:00
Olivier Chafik
031dfc2835
[auth]: support oauth client_secret_basic / none / custom methods ( #720 )
...
* Allow OAuthClientProvider to control authentication to token endpoint w/ addClientAuthentication (exchange / refresh)
* Include mockProvider in exchangeAuthorization tests.
* feature. Add client_secret_basic and none authentication methods
---------
Co-authored-by: Jared Hanson <jaredhanson@gmail.com>
Co-authored-by: SightStudio <sdm3285@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
2025-07-09 18:31:09 +01:00
Olivier Chafik
87b453d23f
auth: fetch AS metadata in well-known subpath from serverUrl when PRM returns external AS
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-09 17:58:53 +01:00
Glen Maddern
6f5e53b44b
Returning undefined from discoverOAuthMetadata for CORS errors ( #717 )
...
* Returning undefined from `discoverOAuthMetadata` for CORS errors
This behaviour was already happening for the root URL, but the new `fetchWithCorsRetry` logic differed.
The issue was if the server returns a 404 for `/.well-known/oauth-authorization-server/xyz` that didn't have the `access-control-allow-origin`, a TypeError was being thrown. There was logic there already to handle a TypeError for a _preflight_ request (cause by custom headers), but not the fallback. I refactored so all combinations return `undefined`.
* Add test for CORS error handling that should return undefined
This test covers the scenario where both the initial request with headers
and the retry without headers fail with CORS TypeErrors. The desired
behavior is to return undefined instead of throwing.
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
* fix test comment
---------
Co-authored-by: Glen Maddern <glen@glenmaddern.com>
Co-authored-by: Paul Carleton <paulc@anthropic.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
2025-07-01 16:24:27 +01:00
Paul Carleton
15a2277c89
refactor resource selection to not include resource if PRM is not present
2025-06-24 14:47:54 +01:00
ihrpr
03da7cfc66
fallback
2025-06-24 11:38:55 +01:00
Henry Mao
1ff08e41d7
Add path test
2025-06-23 17:32:08 -04:00
Paul Carleton
eff548c06f
adjust to provided resource
2025-06-19 18:02:00 +01:00
Paul Carleton
87da0e0c3a
adjust default validation for resource parameter in client flow, and server example
2025-06-19 17:52:24 +01:00
Inna Harper
90569d885f
Merge pull request #638 from modelcontextprotocol/ochafik/auth-resource
...
RFC 8707 Resource Indicators Implementation
2025-06-18 17:34:37 +01:00
Paul Carleton
4c51230fc2
fix tests
2025-06-18 16:00:12 +01:00
Olivier Chafik
f854b58443
test validateProtectedResourceMetadata override
2025-06-18 15:26:58 +01:00
Olivier Chafik
f0ea31cff9
Update auth.test.ts
2025-06-18 13:20:58 +01:00
Olivier Chafik
bac384f242
simplify tests
2025-06-18 12:23:48 +01:00
Olivier Chafik
68424ef7e6
simplify changes
2025-06-18 11:59:19 +01:00
Olivier Chafik
8475e43f15
drop redundant resource canonicalization tests
2025-06-18 11:48:20 +01:00
ihrpr
4f708a777f
update latest protocol version
2025-06-17 11:38:00 +01:00
Olivier Chafik
badb5dc990
fix tests
2025-06-17 11:23:41 +01:00
Olivier Chafik
b16a415623
cleanups
2025-06-17 11:15:38 +01:00
Olivier Chafik
551a43942e
use URL for resource throughout
2025-06-17 00:33:27 +01:00
Olivier Chafik
7b5bfcee52
implementation of RFC 8707 Resource Indicators ( Fixes #592 , Fixes #635 )
2025-06-16 19:29:04 +01:00
Jeff Escalante
0516f9898b
add state param to oauth provider ( #529 )
2025-05-22 12:55:00 +01:00
Frédéric Barthelet
281cf0bf8d
Save existing refresh_token in store if no new refresh_token is returned ( #483 )
...
As described in https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#name-refresh-token-response ,
server MAY return a new refresh_token. In case it doesn't, current implementation discard initial refresh
token if it was still valid.
2025-05-21 17:29:56 +01:00
