Jerome
|
8a222e8b38
|
Don't set client secret expiry if public client
|
2025-02-23 10:59:05 +00:00 |
|
Jerome
|
2dc7fa5df8
|
Check token expiry in bearer auth
|
2025-02-23 10:57:26 +00:00 |
|
Jerome
|
1b8e94ca40
|
During metadata fetching, try with the MCP header, then without, then return undefined if both fail
|
2025-02-22 16:20:41 +00:00 |
|
Justin Spahr-Summers
|
80e148491c
|
Merge pull request #151 from modelcontextprotocol/justin/server-auth
Server implementation of MCP auth
|
2025-02-21 15:47:43 +00:00 |
|
Justin Spahr-Summers
|
f0777d2d1f
|
Client secrets should not be removed, but expiry checked in middleware
|
2025-02-21 12:11:51 +00:00 |
|
Justin Spahr-Summers
|
094b81f70d
|
Throw error if scopes are requested and client has none
|
2025-02-21 11:55:46 +00:00 |
|
Justin Spahr-Summers
|
fadcee3f14
|
Remove tests that are just testing a mock
|
2025-02-21 11:48:46 +00:00 |
|
Justin Spahr-Summers
|
529d017d94
|
Merge branch 'main' into justin/server-auth
|
2025-02-21 11:44:57 +00:00 |
|
Justin Spahr-Summers
|
506ae06b03
|
Merge pull request #150 from disintegrator/zod-to-json-schema-strict-unions
fix: drop unresolved union members in zod schemas
|
2025-02-19 14:26:13 +00:00 |
|
Justin Spahr-Summers
|
89bb5e8a8e
|
Merge pull request #154 from modelcontextprotocol/justin/esbuild-update
Update `esbuild` to resolve security advisory
|
2025-02-19 14:23:21 +00:00 |
|
Justin Spahr-Summers
|
bb5045bf90
|
Update esbuild to resolve security advisory
|
2025-02-19 14:21:09 +00:00 |
|
Justin Spahr-Summers
|
b8b816ca9f
|
Bearer auth middleware
|
2025-02-18 16:09:51 +00:00 |
|
Justin Spahr-Summers
|
c8f4d621a9
|
Render /authorize errors as JSON
|
2025-02-18 15:06:54 +00:00 |
|
Justin Spahr-Summers
|
7fb8e4a099
|
Catch and format standard error types in responses
|
2025-02-18 15:01:29 +00:00 |
|
Justin Spahr-Summers
|
57fe3b3fb0
|
Use standard error types in middleware
|
2025-02-18 14:18:13 +00:00 |
|
Justin Spahr-Summers
|
1dfb9aa709
|
Classes for standard OAuth error types
|
2025-02-18 14:15:47 +00:00 |
|
Justin Spahr-Summers
|
f6e47c4751
|
Add missing name to McpError
|
2025-02-18 14:15:22 +00:00 |
|
Justin Spahr-Summers
|
63db32236e
|
Set Cache-Control: no-store
|
2025-02-18 14:08:07 +00:00 |
|
Justin Spahr-Summers
|
7b81b4f672
|
Handle POST bodies in /authorize
|
2025-02-18 13:55:20 +00:00 |
|
Justin Spahr-Summers
|
85e3cadc6f
|
Fix Request type extension to not use namespacing
|
2025-02-18 13:18:50 +00:00 |
|
Justin Spahr-Summers
|
5d7bc7a035
|
Fix unused variable lint
|
2025-02-18 13:18:03 +00:00 |
|
Justin Spahr-Summers
|
8d62612479
|
Extract middleware for 405 Method Not Allowed
|
2025-02-18 13:13:05 +00:00 |
|
Justin Spahr-Summers
|
07e8ce9cd1
|
Fix router test after metadata key removed
|
2025-02-18 13:12:50 +00:00 |
|
Justin Spahr-Summers
|
48cddd9488
|
Pass through rate limits and other options cleanly from router
|
2025-02-18 11:25:42 +00:00 |
|
Justin Spahr-Summers
|
1415c2db92
|
Rate limiting on individual handlers
|
2025-02-18 11:21:07 +00:00 |
|
Justin Spahr-Summers
|
4d02ed9c97
|
Install express-rate-limit
|
2025-02-18 11:16:20 +00:00 |
|
Justin Spahr-Summers
|
36f9c6b260
|
Get tests passing
|
2025-02-18 11:00:46 +00:00 |
|
Justin Spahr-Summers
|
76938c77e8
|
Claude-authored tests
|
2025-02-18 10:57:24 +00:00 |
|
Justin Spahr-Summers
|
6a6dcbaf3c
|
Install supertest and @jest-mock/express
|
2025-02-18 10:34:29 +00:00 |
|
Justin Spahr-Summers
|
76b9781c85
|
Use URL.canParse instead of custom isValidUrl
|
2025-02-18 10:33:21 +00:00 |
|
Justin Spahr-Summers
|
f292b12eec
|
Remove generateToken until needed
|
2025-02-18 10:20:33 +00:00 |
|
Justin Spahr-Summers
|
bb49189bdf
|
Router for all MCP auth endpoints + behaviors
|
2025-02-18 10:16:32 +00:00 |
|
Justin Spahr-Summers
|
a6e78b7426
|
Add handler for auth server metadata
|
2025-02-18 09:52:45 +00:00 |
|
Justin Spahr-Summers
|
43f433c934
|
Match style for registration request handler
|
2025-02-18 09:47:11 +00:00 |
|
Justin Spahr-Summers
|
6830c92f76
|
Remove redundant comment
|
2025-02-18 09:45:19 +00:00 |
|
Justin Spahr-Summers
|
bff65e6746
|
Add client information to all OAuth provider methods
|
2025-02-18 09:44:25 +00:00 |
|
Justin Spahr-Summers
|
9abcccf2ed
|
Token revocation endpoint
|
2025-02-18 09:41:35 +00:00 |
|
Justin Spahr-Summers
|
19f2ac7018
|
Extract client authentication into reusable middleware
|
2025-02-18 09:39:52 +00:00 |
|
Justin Spahr-Summers
|
f4002e559e
|
Add type definition for token revocation requests
|
2025-02-18 09:24:51 +00:00 |
|
Justin Spahr-Summers
|
26ffe00dc3
|
Auth code and refresh token flows
|
2025-02-17 16:40:51 +00:00 |
|
Justin Spahr-Summers
|
5738f0cef1
|
WIP /token endpoint
|
2025-02-17 16:19:26 +00:00 |
|
Justin Spahr-Summers
|
62cd9520da
|
Authorization flow handoff
|
2025-02-17 15:04:02 +00:00 |
|
Justin Spahr-Summers
|
54f643cee8
|
Validate redirect URIs _as_ URIs
|
2025-02-17 14:46:08 +00:00 |
|
Justin Spahr-Summers
|
9dc4a4f6a9
|
WIP /authorize endpoint
|
2025-02-17 14:37:10 +00:00 |
|
Justin Spahr-Summers
|
6d33a7c527
|
Rename handler file to register.ts to make path more obvious
|
2025-02-17 13:56:16 +00:00 |
|
Justin Spahr-Summers
|
a776f5f94a
|
Build a router to chain middleware better
|
2025-02-17 13:51:37 +00:00 |
|
Justin Spahr-Summers
|
e27907d9fc
|
Add cors package
|
2025-02-17 13:51:17 +00:00 |
|
Justin Spahr-Summers
|
6bfbd2092b
|
Client registration using a "store" interface
|
2025-02-17 13:29:51 +00:00 |
|
Justin Spahr-Summers
|
76f367b957
|
WIP client registration handler for Express
|
2025-02-17 12:17:00 +00:00 |
|
Justin Spahr-Summers
|
9ba6ce02a7
|
Add express as a production dependency
|
2025-02-17 12:07:18 +00:00 |
|