Justin Spahr-Summers
fadcee3f14
Remove tests that are just testing a mock
2025-02-21 11:48:46 +00:00
Justin Spahr-Summers
529d017d94
Merge branch 'main' into justin/server-auth
2025-02-21 11:44:57 +00:00
Justin Spahr-Summers
506ae06b03
Merge pull request #150 from disintegrator/zod-to-json-schema-strict-unions
...
fix: drop unresolved union members in zod schemas
2025-02-19 14:26:13 +00:00
Justin Spahr-Summers
b8b816ca9f
Bearer auth middleware
2025-02-18 16:09:51 +00:00
Justin Spahr-Summers
c8f4d621a9
Render /authorize errors as JSON
2025-02-18 15:06:54 +00:00
Justin Spahr-Summers
7fb8e4a099
Catch and format standard error types in responses
2025-02-18 15:01:29 +00:00
Justin Spahr-Summers
57fe3b3fb0
Use standard error types in middleware
2025-02-18 14:18:13 +00:00
Justin Spahr-Summers
1dfb9aa709
Classes for standard OAuth error types
2025-02-18 14:15:47 +00:00
Justin Spahr-Summers
f6e47c4751
Add missing name to McpError
2025-02-18 14:15:22 +00:00
Justin Spahr-Summers
63db32236e
Set Cache-Control: no-store
2025-02-18 14:08:07 +00:00
Justin Spahr-Summers
7b81b4f672
Handle POST bodies in /authorize
2025-02-18 13:55:20 +00:00
Justin Spahr-Summers
85e3cadc6f
Fix Request type extension to not use namespacing
2025-02-18 13:18:50 +00:00
Justin Spahr-Summers
5d7bc7a035
Fix unused variable lint
2025-02-18 13:18:03 +00:00
Justin Spahr-Summers
8d62612479
Extract middleware for 405 Method Not Allowed
2025-02-18 13:13:05 +00:00
Justin Spahr-Summers
07e8ce9cd1
Fix router test after metadata key removed
2025-02-18 13:12:50 +00:00
Justin Spahr-Summers
48cddd9488
Pass through rate limits and other options cleanly from router
2025-02-18 11:25:42 +00:00
Justin Spahr-Summers
1415c2db92
Rate limiting on individual handlers
2025-02-18 11:21:07 +00:00
Justin Spahr-Summers
36f9c6b260
Get tests passing
2025-02-18 11:00:46 +00:00
Justin Spahr-Summers
76938c77e8
Claude-authored tests
2025-02-18 10:57:24 +00:00
Justin Spahr-Summers
76b9781c85
Use URL.canParse instead of custom isValidUrl
2025-02-18 10:33:21 +00:00
Justin Spahr-Summers
f292b12eec
Remove generateToken until needed
2025-02-18 10:20:33 +00:00
Justin Spahr-Summers
bb49189bdf
Router for all MCP auth endpoints + behaviors
2025-02-18 10:16:32 +00:00
Justin Spahr-Summers
a6e78b7426
Add handler for auth server metadata
2025-02-18 09:52:45 +00:00
Justin Spahr-Summers
43f433c934
Match style for registration request handler
2025-02-18 09:47:11 +00:00
Justin Spahr-Summers
6830c92f76
Remove redundant comment
2025-02-18 09:45:19 +00:00
Justin Spahr-Summers
bff65e6746
Add client information to all OAuth provider methods
2025-02-18 09:44:25 +00:00
Justin Spahr-Summers
9abcccf2ed
Token revocation endpoint
2025-02-18 09:41:35 +00:00
Justin Spahr-Summers
19f2ac7018
Extract client authentication into reusable middleware
2025-02-18 09:39:52 +00:00
Justin Spahr-Summers
f4002e559e
Add type definition for token revocation requests
2025-02-18 09:24:51 +00:00
Justin Spahr-Summers
26ffe00dc3
Auth code and refresh token flows
2025-02-17 16:40:51 +00:00
Justin Spahr-Summers
5738f0cef1
WIP /token endpoint
2025-02-17 16:19:26 +00:00
Justin Spahr-Summers
62cd9520da
Authorization flow handoff
2025-02-17 15:04:02 +00:00
Justin Spahr-Summers
54f643cee8
Validate redirect URIs _as_ URIs
2025-02-17 14:46:08 +00:00
Justin Spahr-Summers
9dc4a4f6a9
WIP /authorize endpoint
2025-02-17 14:37:10 +00:00
Justin Spahr-Summers
6d33a7c527
Rename handler file to register.ts to make path more obvious
2025-02-17 13:56:16 +00:00
Justin Spahr-Summers
a776f5f94a
Build a router to chain middleware better
2025-02-17 13:51:37 +00:00
Justin Spahr-Summers
6bfbd2092b
Client registration using a "store" interface
2025-02-17 13:29:51 +00:00
Justin Spahr-Summers
76f367b957
WIP client registration handler for Express
2025-02-17 12:17:00 +00:00
Justin Spahr-Summers
a0069e2341
Split full/partial client information
2025-02-17 11:41:42 +00:00
Justin Spahr-Summers
afae4212e6
Move OAuth definitions into shared, add more
2025-02-17 11:07:59 +00:00
Justin Spahr-Summers
41e0d26f23
Merge pull request #144 from modelcontextprotocol/justin/client-auth
...
Client implementation of MCP auth
2025-02-17 10:46:39 +00:00
Justin Spahr-Summers
b1f4b65709
Improve auth docs and add finishAuth convenience method
2025-02-17 10:45:34 +00:00
Justin Spahr-Summers
44a440854f
Code review comments
2025-02-17 10:34:57 +00:00
Georges Haidar
7c7e4ad0ae
fix: drop unresolved union members in zod schemas
...
This change enables the strictUnions option in zod-to-json-schema so
that any union members that cannot be resolved are excluded from the
resulting JSON Schema anyOf array.
Previously, a schema like this:
**Before**
```ts
import { zodToJsonSchema } from "zod-to-json-schema";
import { z } from "zod";
console.dir(
zodToJsonSchema(
z.union([
z
.string()
.base64()
.transform((v) => Uint8Array.from(atob(v), (v) => v.charCodeAt(0))),
z.instanceof(ReadableStream<Uint8Array>),
z.instanceof(Blob),
z.instanceof(ArrayBuffer),
z.instanceof(Uint8Array),
])
),
{ depth: null }
);
```
Prints:
```js
{
anyOf: [
{ type: "string", contentEncoding: "base64" }, {}, {}, {}, {}
],
$schema: "http://json-schema.org/draft-07/schema# ",
}
```
**After**
```ts
import { zodToJsonSchema } from "zod-to-json-schema";
import { z } from "zod";
console.dir(
zodToJsonSchema(
z.union([
z
.string()
.base64()
.transform((v) => Uint8Array.from(atob(v), (v) => v.charCodeAt(0))),
z.instanceof(ReadableStream<Uint8Array>),
z.instanceof(Blob),
z.instanceof(ArrayBuffer),
z.instanceof(Uint8Array),
]),
{ strictUnions: true }, // 👈
),
{ depth: null }
);
```
Prints:
```js
{
anyOf: [
{ type: "string", contentEncoding: "base64" }
],
$schema: "http://json-schema.org/draft-07/schema# ",
}
```
---
I picked this example in particular because I have modelled file uploads
using a permissive schema that accepts streams, byte arrays / blobs and
base64-encoded strings. In the context of MCP, base64 would be most
applicable so I wanted to drop the other union members that couldn't be
represented in JSON Schema.
2025-02-16 19:23:29 +00:00
Justin Spahr-Summers
c0ebe90154
Test transparent token refresh in SSEClientTransport
2025-02-12 14:17:03 +00:00
Justin Spahr-Summers
79d2db3e71
Missed one await server.close()
2025-02-12 14:01:22 +00:00
Justin Spahr-Summers
36999dcef7
Fix fetch test polluting auth tests
2025-02-12 14:00:21 +00:00
Justin Spahr-Summers
d47d88be9e
Auth tests for SSEClientTransport
2025-02-12 13:47:59 +00:00
Justin Spahr-Summers
3e2dd35dca
Fix tests
2025-02-11 22:02:20 +00:00
Justin Spahr-Summers
92621516f8
Re-auth upon 401 when POSTing
2025-02-11 21:37:49 +00:00
