Ashwin Bhat
f4b8a48ded
feat: remove console statements from SDK code
...
- Remove all console.log, console.warn, and console.error from src/client and src/server
- Add ESLint no-console rule for client and server directories (excluding tests)
- Keep console statements in test files, examples, and CLI tools as intended
Addresses feedback in PR #665
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-19 22:36:33 -07:00
Olivier Chafik
3f07bdb223
shrink tests
2025-06-18 13:32:45 +01:00
Olivier Chafik
5c60c77c93
shrink diff
2025-06-18 12:09:00 +01:00
Olivier Chafik
6a01d0d4a5
shrink token.test.ts
2025-06-18 12:07:38 +01:00
Olivier Chafik
9e2a565164
minimize changes
2025-06-18 12:01:51 +01:00
Olivier Chafik
bf72f87788
cleanups
2025-06-18 11:23:09 +01:00
Olivier Chafik
617faccf8e
Add test for default protocol version negotiation in bearerAuth middleware
...
- Tests that when mcp-protocol-version header is missing, the middleware
uses DEFAULT_NEGOTIATED_PROTOCOL_VERSION when calling verifyAccessToken
- Ensures proper fallback behavior for protocol version negotiation
🤖 Generated with [Claude Code](https://claude.ai/code )
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-17 17:08:21 +01:00
Olivier Chafik
40f61d88a0
show how to enable strict resource checking in mcp server
2025-06-17 17:05:34 +01:00
Olivier Chafik
b16a415623
cleanups
2025-06-17 11:15:38 +01:00
Olivier Chafik
551a43942e
use URL for resource throughout
2025-06-17 00:33:27 +01:00
Olivier Chafik
224a2e242d
update resource to be a url
2025-06-17 00:18:33 +01:00
Olivier Chafik
02ce81b90c
simplify diff
2025-06-16 23:10:27 +01:00
Olivier Chafik
6656d23d84
Simplify demo in-memory oauth provider
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 22:56:55 +01:00
Olivier Chafik
ccccb4b7cc
simplify PR / only keep verification in demo inmemory oauth provider
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 21:34:06 +01:00
Olivier Chafik
cba6a6ea58
Update authorize.config.test.ts
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 20:41:56 +01:00
Olivier Chafik
1f4e42c09e
cleanup auth-utils and remove example files
...
Co-Authored-By: Claude <noreply@anthropic.com>
2025-06-16 20:05:02 +01:00
Olivier Chafik
7b5bfcee52
implementation of RFC 8707 Resource Indicators ( Fixes #592 , Fixes #635 )
2025-06-16 19:29:04 +01:00
Shubham Lohar
1d860bb217
fixing ProxyOAuthServerProvider: redirect_uri missing in token request ( #519 )
2025-05-21 17:19:49 +01:00
Paul Carleton
ac1b80a331
feat: Add support for separate Authorization Server / Resource server in server flow (spec: DRAFT-2025-v2) ( #503 )
...
* add support for .oauth-protected-resource metadata endpoint and www-authenticate
* test and types
* thread throughs scopes
* have example separate AS and RS
* make inmemory explicitly demo
* fix type
* fix types
* fix client example
* fixup comments
* refactor metadata endpoints to cleanup
* almost working w/ forwarding
* separate AS/RS working
* add to readme
* de-async the auth server setup for happier top level flow
* add test for new router
* fix test
* remove redundant comment
* clarify comment
* remove more unused endpoints
* simplify router
* slim down
* simplify verifier, and fix router test
* fix doc string
2025-05-21 13:13:34 +01:00
Allen Zhou
b30a77e1b9
Update types.ts
2025-04-14 10:10:57 -07:00
Allen Zhou
ab3bb94290
Adjust arbitrary keys to custom claims field to prevent conflicts
2025-04-14 10:10:08 -07:00
Allen Zhou
23188ec446
Add custom claims to authinfo
2025-04-12 18:06:46 -07:00
Justin Spahr-Summers
9980cbf438
Merge pull request #194 from davolokh/console-error-in-test-removed
...
console.error pollution logs removed in tests
2025-04-07 11:07:02 +01:00
Dmitry Volokh
fee4bbec58
console.error pollution removed in tests
2025-03-14 19:54:03 +01:00
Allen Zhou
b90192a020
Add skipLocalPkceValidation param and create providers folder
2025-02-28 13:59:23 -08:00
Allen Zhou
8d7b387545
Clean up pkce skip check for proxy providers
2025-02-27 13:35:40 -08:00
Allen Zhou
89c4ec3272
Add baseUrl param to override issuerUrl for fallback construction
2025-02-27 10:45:17 -08:00
Allen Zhou
d93814f4df
Merge branch 'main' into server-authorization-proxy
2025-02-26 14:00:48 -08:00
Allen Zhou
57f59c69a1
Make authorizationUrl and tokenUrl mandatory
2025-02-26 14:00:34 -08:00
Allen Zhou
96f3d81aa3
Adjust function types to be accessible to subclasses
2025-02-25 15:29:20 -08:00
Allen Zhou
aa5690b182
Zod parsing for registration response
2025-02-24 20:17:08 -08:00
Allen Zhou
c7ce1a29c5
improve proxy code verifier test naming
2025-02-24 17:43:16 -08:00
Allen Zhou
cb8135840c
Change verifyToken to match parent interface name
2025-02-24 17:39:50 -08:00
Allen Zhou
476c11149b
Add Proxy Provider test
2025-02-24 17:10:37 -08:00
Allen Zhou
996822f18d
Test if code verifier is passed through to upstream proxy
2025-02-24 16:56:13 -08:00
Allen Zhou
9e32fd5464
Only send client secret and code verifier if defined
2025-02-24 16:55:36 -08:00
Allen Zhou
7f03f13072
Add ProxyOAuthServerProvider
2025-02-24 16:07:54 -08:00
Jerome
885590c099
Fixing tests
2025-02-24 13:39:58 +00:00
Jerome
aad2badb2f
Removed nested ternaries
2025-02-24 10:26:59 +00:00
Jerome
3b12961e2e
Added tests
2025-02-23 14:55:30 +00:00
Jerome
8a222e8b38
Don't set client secret expiry if public client
2025-02-23 10:59:05 +00:00
Jerome
2dc7fa5df8
Check token expiry in bearer auth
2025-02-23 10:57:26 +00:00
Justin Spahr-Summers
f0777d2d1f
Client secrets should not be removed, but expiry checked in middleware
2025-02-21 12:11:51 +00:00
Justin Spahr-Summers
094b81f70d
Throw error if scopes are requested and client has none
2025-02-21 11:55:46 +00:00
Justin Spahr-Summers
fadcee3f14
Remove tests that are just testing a mock
2025-02-21 11:48:46 +00:00
Justin Spahr-Summers
b8b816ca9f
Bearer auth middleware
2025-02-18 16:09:51 +00:00
Justin Spahr-Summers
c8f4d621a9
Render /authorize errors as JSON
2025-02-18 15:06:54 +00:00
Justin Spahr-Summers
7fb8e4a099
Catch and format standard error types in responses
2025-02-18 15:01:29 +00:00
Justin Spahr-Summers
57fe3b3fb0
Use standard error types in middleware
2025-02-18 14:18:13 +00:00
Justin Spahr-Summers
1dfb9aa709
Classes for standard OAuth error types
2025-02-18 14:15:47 +00:00
