[auth] Scenarios for scope selection

examples/clients/typescript/auth-test-bad-prm.ts

@@ -0,0 +1,79 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+  auth,
+  UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that always uses root-based PRM discovery.
+ * BUG: Ignores the resource_metadata URL from WWW-Authenticate header.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  const handle401Broken = async (
+    response: Response,
+    provider: ConformanceOAuthProvider,
+    next: FetchLike,
+    serverUrl: string | URL
+  ): Promise<void> => {
+    // BUG: Use root-based PRM discovery exclusively
+    const resourceMetadataUrl = new URL(
+      '/.well-known/oauth-protected-resource',
+      typeof serverUrl === 'string' ? serverUrl : serverUrl.origin
+    );
+
+    let result = await auth(provider, {
+      serverUrl,
+      resourceMetadataUrl,
+      fetchFn: next
+    });
+
+    if (result === 'REDIRECT') {
+      const authorizationCode = await provider.getAuthCode();
+      result = await auth(provider, {
+        serverUrl,
+        resourceMetadataUrl,
+        authorizationCode,
+        fetchFn: next
+      });
+      if (result !== 'AUTHORIZED') {
+        throw new UnauthorizedError(
+          `Authentication failed with result: ${result}`
+        );
+      }
+    }
+  };
+
+  const client = new Client(
+    { name: 'test-auth-client-broken', version: '1.0.0' },
+    { capabilities: {} }
+  );
+
+  const oauthFetch = withOAuthRetry(
+    'test-auth-client-broken',
+    new URL(serverUrl),
+    handle401Broken
+  )(fetch);
+
+  const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+    fetch: oauthFetch
+  });
+
+  await client.connect(transport);
+  logger.debug('✅ Successfully connected to MCP server');
+
+  await client.listTools();
+  logger.debug('✅ Successfully listed tools');
+
+  await transport.close();
+  logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-bad-prm <server-url>');

examples/clients/typescript/auth-test-ignore-403.ts

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+  auth,
+  extractWWWAuthenticateParams,
+  UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that only responds to 401, not 403.
+ * BUG: Ignores 403 responses which are used for step-up auth.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  const handle401Broken = async (
+    response: Response,
+    provider: ConformanceOAuthProvider,
+    next: FetchLike,
+    serverUrl: string | URL
+  ): Promise<void> => {
+    // BUG: Only respond to 401, not 403
+    if (response.status !== 401) {
+      return;
+    }
+
+    const { resourceMetadataUrl, scope } =
+      extractWWWAuthenticateParams(response);
+    let result = await auth(provider, {
+      serverUrl,
+      resourceMetadataUrl,
+      scope,
+      fetchFn: next
+    });
+
+    if (result === 'REDIRECT') {
+      const authorizationCode = await provider.getAuthCode();
+      result = await auth(provider, {
+        serverUrl,
+        resourceMetadataUrl,
+        scope,
+        authorizationCode,
+        fetchFn: next
+      });
+      if (result !== 'AUTHORIZED') {
+        throw new UnauthorizedError(
+          `Authentication failed with result: ${result}`
+        );
+      }
+    }
+  };
+
+  const client = new Client(
+    { name: 'test-auth-client-broken', version: '1.0.0' },
+    { capabilities: {} }
+  );
+
+  const oauthFetch = withOAuthRetry(
+    'test-auth-client-broken',
+    new URL(serverUrl),
+    handle401Broken
+  )(fetch);
+
+  const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+    fetch: oauthFetch
+  });
+
+  await client.connect(transport);
+  logger.debug('✅ Successfully connected to MCP server');
+
+  await client.listTools();
+  logger.debug('✅ Successfully listed tools');
+
+  // Call tool to trigger step-up auth
+  await client.callTool({ name: 'test-tool', arguments: {} });
+  logger.debug('✅ Successfully called tool');
+
+  await transport.close();
+  logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-403 <server-url>');

examples/clients/typescript/auth-test-ignore-scope.ts

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import {
+  auth,
+  extractWWWAuthenticateParams,
+  UnauthorizedError
+} from '@modelcontextprotocol/sdk/client/auth.js';
+import type { FetchLike } from '@modelcontextprotocol/sdk/shared/transport.js';
+import { withOAuthRetry } from './helpers/withOAuthRetry.js';
+import { ConformanceOAuthProvider } from './helpers/ConformanceOAuthProvider.js';
+import { runAsCli } from './helpers/cliRunner.js';
+import { logger } from './helpers/logger.js';
+
+/**
+ * Broken client that ignores the scope from WWW-Authenticate header.
+ * BUG: Doesn't pass the scope parameter from the 401 response.
+ */
+export async function runClient(serverUrl: string): Promise<void> {
+  const handle401Broken = async (
+    response: Response,
+    provider: ConformanceOAuthProvider,
+    next: FetchLike,
+    serverUrl: string | URL
+  ): Promise<void> => {
+    // BUG: Don't read the scope from the header
+    const { resourceMetadataUrl } = extractWWWAuthenticateParams(response);
+    let result = await auth(provider, {
+      serverUrl,
+      resourceMetadataUrl,
+      // scope deliberately omitted
+      fetchFn: next
+    });
+
+    if (result === 'REDIRECT') {
+      const authorizationCode = await provider.getAuthCode();
+      result = await auth(provider, {
+        serverUrl,
+        resourceMetadataUrl,
+        authorizationCode,
+        fetchFn: next
+      });
+      if (result !== 'AUTHORIZED') {
+        throw new UnauthorizedError(
+          `Authentication failed with result: ${result}`
+        );
+      }
+    }
+  };
+
+  const client = new Client(
+    { name: 'test-auth-client-broken', version: '1.0.0' },
+    { capabilities: {} }
+  );
+
+  const oauthFetch = withOAuthRetry(
+    'test-auth-client-broken',
+    new URL(serverUrl),
+    handle401Broken
+  )(fetch);
+
+  const transport = new StreamableHTTPClientTransport(new URL(serverUrl), {
+    fetch: oauthFetch
+  });
+
+  await client.connect(transport);
+  logger.debug('✅ Successfully connected to MCP server');
+
+  await client.listTools();
+  logger.debug('✅ Successfully listed tools');
+
+  await transport.close();
+  logger.debug('✅ Connection closed successfully');
+}
+
+runAsCli(runClient, import.meta.url, 'auth-test-ignore-scope <server-url>');