@ai-sdk/mcp 0.0.41 → 0.0.43

package/dist/index.js

@@ -301,15 +301,6 @@ var import_pkce_challenge = __toESM(require("pkce-challenge"));
 
 // src/tool/oauth-types.ts
 var import_v43 = require("zod/v4");
-var OAuthTokensSchema = import_v43.z.object({
-  access_token: import_v43.z.string(),
-  id_token: import_v43.z.string().optional(),
-  // Optional for OAuth 2.1, but necessary in OpenID Connect
-  token_type: import_v43.z.string(),
-  expires_in: import_v43.z.number().optional(),
-  scope: import_v43.z.string().optional(),
-  refresh_token: import_v43.z.string().optional()
-}).strip();
 var SafeUrlSchema = import_v43.z.string().url().superRefine((val, ctx) => {
   if (!URL.canParse(val)) {
     ctx.addIssue({
@@ -326,6 +317,18 @@ var SafeUrlSchema = import_v43.z.string().url().superRefine((val, ctx) => {
   },
   { message: "URL cannot use javascript:, data:, or vbscript: scheme" }
 );
+var OAuthTokensSchema = import_v43.z.object({
+  access_token: import_v43.z.string(),
+  id_token: import_v43.z.string().optional(),
+  // Optional for OAuth 2.1, but necessary in OpenID Connect
+  token_type: import_v43.z.string(),
+  expires_in: import_v43.z.number().optional(),
+  scope: import_v43.z.string().optional(),
+  refresh_token: import_v43.z.string().optional(),
+  issuer: SafeUrlSchema.optional(),
+  authorization_server: SafeUrlSchema.optional(),
+  token_endpoint: SafeUrlSchema.optional()
+}).strip();
 var OAuthProtectedResourceMetadataSchema = import_v43.z.object({
   resource: import_v43.z.string().url(),
   authorization_servers: import_v43.z.array(SafeUrlSchema).optional(),
@@ -378,7 +381,10 @@ var OAuthClientInformationSchema = import_v43.z.object({
   client_id: import_v43.z.string(),
   client_secret: import_v43.z.string().optional(),
   client_id_issued_at: import_v43.z.number().optional(),
-  client_secret_expires_at: import_v43.z.number().optional()
+  client_secret_expires_at: import_v43.z.number().optional(),
+  issuer: SafeUrlSchema.optional(),
+  authorization_server: SafeUrlSchema.optional(),
+  token_endpoint: SafeUrlSchema.optional()
 }).strip();
 var OAuthClientMetadataSchema = import_v43.z.object({
   redirect_uris: import_v43.z.array(SafeUrlSchema),
@@ -476,6 +482,130 @@ var UnauthorizedError = class extends Error {
     this.name = "UnauthorizedError";
   }
 };
+function normalizeUrl(url) {
+  return new URL(url).href;
+}
+function validateAuthorizationResponseIssuer({
+  callbackIssuer,
+  expectedIssuer
+}) {
+  if (callbackIssuer != null && callbackIssuer !== expectedIssuer) {
+    throw new MCPClientOAuthError({
+      message: `OAuth authorization response issuer ${callbackIssuer} does not match expected issuer ${expectedIssuer}`
+    });
+  }
+}
+function createAuthorizationServerInformation(authorizationServerUrl, metadata) {
+  var _a3;
+  return {
+    issuer: (_a3 = metadata == null ? void 0 : metadata.issuer) != null ? _a3 : String(authorizationServerUrl),
+    authorizationServerUrl: normalizeUrl(authorizationServerUrl),
+    tokenEndpoint: normalizeUrl(
+      (metadata == null ? void 0 : metadata.token_endpoint) ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl)
+    )
+  };
+}
+function addAuthorizationServerInformationToTokens(tokens, authorizationServerInformation) {
+  return {
+    ...tokens,
+    issuer: authorizationServerInformation.issuer,
+    authorization_server: authorizationServerInformation.authorizationServerUrl,
+    token_endpoint: authorizationServerInformation.tokenEndpoint
+  };
+}
+function addAuthorizationServerInformationToClientInformation(clientInformation, authorizationServerInformation) {
+  return {
+    ...clientInformation,
+    issuer: authorizationServerInformation.issuer,
+    authorization_server: authorizationServerInformation.authorizationServerUrl,
+    token_endpoint: authorizationServerInformation.tokenEndpoint
+  };
+}
+function getAuthorizationServerInformationFromCredentials(credentials) {
+  if (!(credentials == null ? void 0 : credentials.authorization_server) || !credentials.token_endpoint) {
+    return void 0;
+  }
+  return {
+    issuer: credentials.issuer,
+    authorizationServerUrl: normalizeUrl(credentials.authorization_server),
+    tokenEndpoint: normalizeUrl(credentials.token_endpoint)
+  };
+}
+async function getStoredAuthorizationServerInformation({
+  provider,
+  clientInformation,
+  tokens
+}) {
+  var _a3;
+  const tokenAuthorizationServerInformation = getAuthorizationServerInformationFromCredentials(tokens);
+  if (tokenAuthorizationServerInformation) {
+    return tokenAuthorizationServerInformation;
+  }
+  const providerAuthorizationServerInformation = await ((_a3 = provider.authorizationServerInformation) == null ? void 0 : _a3.call(provider));
+  if (providerAuthorizationServerInformation) {
+    return {
+      issuer: providerAuthorizationServerInformation.issuer,
+      authorizationServerUrl: normalizeUrl(
+        providerAuthorizationServerInformation.authorizationServerUrl
+      ),
+      tokenEndpoint: normalizeUrl(
+        providerAuthorizationServerInformation.tokenEndpoint
+      )
+    };
+  }
+  return getAuthorizationServerInformationFromCredentials(clientInformation);
+}
+async function saveAuthorizationServerInformation({
+  provider,
+  clientInformation,
+  authorizationServerInformation
+}) {
+  if (provider.saveAuthorizationServerInformation) {
+    await provider.saveAuthorizationServerInformation(
+      authorizationServerInformation
+    );
+    return true;
+  }
+  if (provider.saveClientInformation) {
+    await provider.saveClientInformation(
+      addAuthorizationServerInformationToClientInformation(
+        clientInformation,
+        authorizationServerInformation
+      )
+    );
+    return true;
+  }
+  const configuredBinding = getAuthorizationServerInformationFromCredentials(clientInformation);
+  if (configuredBinding) {
+    assertAuthorizationServerInformationMatches({
+      storedAuthorizationServerInformation: configuredBinding,
+      currentAuthorizationServerInformation: authorizationServerInformation
+    });
+    return true;
+  }
+  return false;
+}
+function assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl) {
+  if (!resourceMetadataUrl) {
+    return;
+  }
+  const expectedOrigin = new URL(serverUrl).origin;
+  if (resourceMetadataUrl.origin !== expectedOrigin) {
+    throw new MCPClientOAuthError({
+      message: `OAuth protected resource metadata URL ${resourceMetadataUrl.href} must have the same origin as the MCP server URL ${expectedOrigin}`
+    });
+  }
+}
+function assertAuthorizationServerInformationMatches({
+  storedAuthorizationServerInformation,
+  currentAuthorizationServerInformation
+}) {
+  if (storedAuthorizationServerInformation.issuer != null && currentAuthorizationServerInformation.issuer != null && storedAuthorizationServerInformation.issuer !== currentAuthorizationServerInformation.issuer || storedAuthorizationServerInformation.authorizationServerUrl !== currentAuthorizationServerInformation.authorizationServerUrl || storedAuthorizationServerInformation.tokenEndpoint !== currentAuthorizationServerInformation.tokenEndpoint) {
+    throw new MCPClientOAuthError({
+      message: "OAuth authorization server metadata does not match the metadata that issued the stored credentials"
+    });
+  }
+}
 function extractResourceMetadataUrl(response) {
   var _a3;
   const header = (_a3 = response.headers.get("www-authenticate")) != null ? _a3 : response.headers.get("WWW-Authenticate");
@@ -618,15 +748,18 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 function buildDiscoveryUrls(authorizationServerUrl) {
   const url = typeof authorizationServerUrl === "string" ? new URL(authorizationServerUrl) : authorizationServerUrl;
   const hasPath = url.pathname !== "/";
+  const rootIssuer = url.origin;
   const urlsToTry = [];
   if (!hasPath) {
     urlsToTry.push({
       url: new URL("/.well-known/oauth-authorization-server", url.origin),
-      type: "oauth"
+      type: "oauth",
+      expectedIssuer: rootIssuer
     });
     urlsToTry.push({
       url: new URL("/.well-known/openid-configuration", url.origin),
-      type: "oidc"
+      type: "oidc",
+      expectedIssuer: rootIssuer
     });
     return urlsToTry;
   }
@@ -634,27 +767,42 @@ function buildDiscoveryUrls(authorizationServerUrl) {
   if (pathname.endsWith("/")) {
     pathname = pathname.slice(0, -1);
   }
+  const pathIssuer = `${url.origin}${pathname}`;
   urlsToTry.push({
     url: new URL(
       `/.well-known/oauth-authorization-server${pathname}`,
       url.origin
     ),
-    type: "oauth"
+    type: "oauth",
+    expectedIssuer: pathIssuer
   });
   urlsToTry.push({
     url: new URL("/.well-known/oauth-authorization-server", url.origin),
-    type: "oauth"
+    type: "oauth",
+    expectedIssuer: rootIssuer
   });
   urlsToTry.push({
     url: new URL(`/.well-known/openid-configuration${pathname}`, url.origin),
-    type: "oidc"
+    type: "oidc",
+    expectedIssuer: pathIssuer
   });
+  const oidcDiscoveryUrl = new URL(url.origin);
+  oidcDiscoveryUrl.pathname = `${pathname}/.well-known/openid-configuration`;
   urlsToTry.push({
-    url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
-    type: "oidc"
+    url: oidcDiscoveryUrl,
+    type: "oidc",
+    expectedIssuer: pathIssuer
   });
   return urlsToTry;
 }
+function assertMetadataIssuerMatches(metadata, expectedIssuer) {
+  const issuerMatches = metadata.issuer === expectedIssuer || expectedIssuer === new URL(expectedIssuer).origin && metadata.issuer === `${expectedIssuer}/`;
+  if (!issuerMatches) {
+    throw new MCPClientOAuthError({
+      message: `OAuth authorization server metadata issuer ${metadata.issuer} does not match expected issuer ${expectedIssuer}`
+    });
+  }
+}
 async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
   fetchFn = fetch,
   protocolVersion = LATEST_PROTOCOL_VERSION,
@@ -662,8 +810,14 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
 } = {}) {
   var _a3;
   const headers = { "MCP-Protocol-Version": protocolVersion };
+  const authorizationServerOrigin = new URL(authorizationServerUrl).origin;
   const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
-  for (const { url: endpointUrl, type } of urlsToTry) {
+  if (urlsToTry.some(({ url }) => url.origin !== authorizationServerOrigin)) {
+    throw new MCPClientOAuthError({
+      message: "OAuth discovery URL changed authorization-server origin"
+    });
+  }
+  for (const { url: endpointUrl, type, expectedIssuer } of urlsToTry) {
     const response = await fetchWithCorsRetry(
       endpointUrl,
       headers,
@@ -682,11 +836,14 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
       );
     }
     if (type === "oauth") {
-      return OAuthMetadataSchema.parse(await response.json());
+      const metadata = OAuthMetadataSchema.parse(await response.json());
+      assertMetadataIssuerMatches(metadata, expectedIssuer);
+      return metadata;
     } else {
       const metadata = OpenIdProviderDiscoveryMetadataSchema.parse(
         await response.json()
       );
+      assertMetadataIssuerMatches(metadata, expectedIssuer);
       if (!((_a3 = metadata.code_challenge_methods_supported) == null ? void 0 : _a3.includes("S256"))) {
         throw new Error(
           `Incompatible OIDC provider at ${endpointUrl}: does not support S256 code challenge method required by MCP specification`
@@ -695,7 +852,6 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
       return metadata;
     }
   }
-  return void 0;
 }
 async function startAuthorization(authorizationServerUrl, {
   metadata,
@@ -977,16 +1133,28 @@ async function registerClient(authorizationServerUrl, {
   return OAuthClientInformationFullSchema.parse(await response.json());
 }
 async function auth(provider, options) {
-  var _a3, _b3;
+  var _a3, _b3, _c;
+  const refreshAttempt = {};
   try {
-    return await authInternal(provider, options);
+    return await authInternal(provider, options, refreshAttempt);
   } catch (error) {
     if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
-      await ((_a3 = provider.invalidateCredentials) == null ? void 0 : _a3.call(provider, "all"));
-      return await authInternal(provider, options);
-    } else if (error instanceof InvalidGrantError) {
-      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "tokens"));
+      if (options.authorizationCode !== void 0 || !await ((_a3 = provider.isClientInformationDynamicallyRegistered) == null ? void 0 : _a3.call(provider))) {
+        throw error;
+      }
+      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "all"));
       return await authInternal(provider, options);
+    } else if (error instanceof InvalidGrantError && refreshAttempt.tokens) {
+      const retryAuthorizationServerInformation = getAuthorizationServerInformationFromCredentials(refreshAttempt.tokens);
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: refreshAttempt.tokens
+      }));
+      return await authInternal(
+        provider,
+        options,
+        void 0,
+        retryAuthorizationServerInformation
+      );
     }
     throw error;
   }
@@ -1015,12 +1183,18 @@ async function selectResourceURL(serverUrl, provider, resourceMetadata) {
 async function authInternal(provider, {
   serverUrl,
   authorizationCode,
+  callbackState,
+  callbackIssuer,
   scope,
   resourceMetadataUrl,
   fetchFn
-}) {
+}, refreshAttempt, retryAuthorizationServerInformation) {
+  var _a3, _b3, _c, _d, _e, _f;
   let resourceMetadata;
   let authorizationServerUrl;
+  let clientInformation;
+  let callbackAuthorizationServerInformation;
+  assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl);
   try {
     resourceMetadata = await discoverOAuthProtectedResourceMetadata(
       serverUrl,
@@ -1032,8 +1206,17 @@ async function authInternal(provider, {
     }
   } catch (e) {
   }
+  if (authorizationCode !== void 0) {
+    clientInformation = await Promise.resolve(provider.clientInformation());
+    if (clientInformation) {
+      callbackAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+        provider,
+        clientInformation
+      });
+    }
+  }
   if (!authorizationServerUrl) {
-    authorizationServerUrl = serverUrl;
+    authorizationServerUrl = (_a3 = callbackAuthorizationServerInformation == null ? void 0 : callbackAuthorizationServerInformation.authorizationServerUrl) != null ? _a3 : serverUrl;
   }
   const parsedServerUrl = new URL(serverUrl);
   const parsedAuthorizationServerUrl = new URL(authorizationServerUrl);
@@ -1048,6 +1231,11 @@ async function authInternal(provider, {
     provider,
     resourceMetadata
   );
+  await ((_b3 = provider.validateAuthorizationServerURL) == null ? void 0 : _b3.call(
+    provider,
+    serverUrl,
+    authorizationServerUrl
+  ));
   const metadata = await discoverAuthorizationServerMetadata(
     authorizationServerUrl,
     {
@@ -1055,7 +1243,59 @@ async function authInternal(provider, {
       trustedOrigin: trustedAuthorizationServerOrigin
     }
   );
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  const currentAuthorizationServerInformation = createAuthorizationServerInformation(authorizationServerUrl, metadata);
+  if (retryAuthorizationServerInformation) {
+    assertAuthorizationServerInformationMatches({
+      storedAuthorizationServerInformation: retryAuthorizationServerInformation,
+      currentAuthorizationServerInformation
+    });
+  }
+  const clientMetadata = provider.clientMetadata;
+  if (authorizationCode === void 0) {
+    clientInformation = await Promise.resolve(provider.clientInformation());
+  }
+  let tokens = authorizationCode === void 0 ? await provider.tokens() : void 0;
+  if (clientInformation) {
+    if (clientInformation.issuer != null && clientInformation.issuer !== currentAuthorizationServerInformation.issuer) {
+      throw new MCPClientOAuthError({
+        message: "OAuth authorization server does not match the issuer of the client credentials"
+      });
+    }
+    const clientAuthorizationServerInformation = getAuthorizationServerInformationFromCredentials(clientInformation);
+    if (clientAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation: clientAuthorizationServerInformation,
+        currentAuthorizationServerInformation
+      });
+    }
+    const storedAuthorizationServerInformation = (_c = callbackAuthorizationServerInformation != null ? callbackAuthorizationServerInformation : await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation,
+      tokens
+    })) != null ? _c : retryAuthorizationServerInformation;
+    if (storedAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation,
+        currentAuthorizationServerInformation
+      });
+    }
+    if ((clientInformation.client_secret != null || provider.addClientAuthentication) && clientInformation.issuer == null && !storedAuthorizationServerInformation) {
+      if (authorizationCode === void 0 && await ((_d = provider.isClientInformationDynamicallyRegistered) == null ? void 0 : _d.call(provider))) {
+        if (!provider.invalidateCredentials) {
+          throw new MCPClientOAuthError({
+            message: "invalidateCredentials is required to discard unbound legacy OAuth credentials; clear stored credentials before authorizing again"
+          });
+        }
+        await provider.invalidateCredentials("all");
+        clientInformation = void 0;
+        tokens = void 0;
+      } else {
+        throw new MCPClientOAuthError({
+          message: "OAuth client credentials must be bound to an authorization server: configure their issuer or store authorization server information"
+        });
+      }
+    }
+  }
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error(
@@ -1069,13 +1309,41 @@ async function authInternal(provider, {
     }
     const fullInformation = await registerClient(authorizationServerUrl, {
       metadata,
-      clientMetadata: provider.clientMetadata,
+      clientMetadata,
       fetchFn
     });
-    await provider.saveClientInformation(fullInformation);
-    clientInformation = fullInformation;
+    clientInformation = addAuthorizationServerInformationToClientInformation(
+      fullInformation,
+      currentAuthorizationServerInformation
+    );
+    await provider.saveClientInformation(clientInformation);
   }
   if (authorizationCode !== void 0) {
+    if (provider.storedState) {
+      const expectedState = await provider.storedState();
+      if (expectedState !== void 0 && expectedState !== callbackState) {
+        throw new Error(
+          "OAuth state parameter mismatch - possible CSRF attack"
+        );
+      }
+    }
+    const storedAuthorizationServerInformation = callbackAuthorizationServerInformation != null ? callbackAuthorizationServerInformation : await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation
+    });
+    if (!storedAuthorizationServerInformation) {
+      throw new MCPClientOAuthError({
+        message: "Stored OAuth authorization server metadata is required when exchanging an authorization code"
+      });
+    }
+    validateAuthorizationResponseIssuer({
+      callbackIssuer,
+      expectedIssuer: (_f = (_e = storedAuthorizationServerInformation.issuer) != null ? _e : metadata == null ? void 0 : metadata.issuer) != null ? _f : String(authorizationServerUrl)
+    });
+    assertAuthorizationServerInformationMatches({
+      storedAuthorizationServerInformation,
+      currentAuthorizationServerInformation
+    });
     const codeVerifier2 = await provider.codeVerifier();
     const tokens2 = await exchangeAuthorization(authorizationServerUrl, {
       metadata,
@@ -1087,22 +1355,56 @@ async function authInternal(provider, {
       addClientAuthentication: provider.addClientAuthentication,
       fetchFn
     });
-    await provider.saveTokens(tokens2);
+    await provider.saveTokens(
+      addAuthorizationServerInformationToTokens(
+        tokens2,
+        currentAuthorizationServerInformation
+      )
+    );
     return "AUTHORIZED";
   }
-  const tokens = await provider.tokens();
   if (tokens == null ? void 0 : tokens.refresh_token) {
-    try {
-      const newTokens = await refreshAuthorization(authorizationServerUrl, {
-        metadata,
-        clientInformation,
-        refreshToken: tokens.refresh_token,
-        resource,
-        addClientAuthentication: provider.addClientAuthentication,
-        fetchFn
+    const storedAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation,
+      tokens
+    });
+    if (storedAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation,
+        currentAuthorizationServerInformation
       });
-      await provider.saveTokens(newTokens);
-      return "AUTHORIZED";
+    } else {
+      if (!provider.invalidateCredentials) {
+        throw new MCPClientOAuthError({
+          message: "invalidateCredentials is required to discard unbound legacy OAuth tokens; clear stored tokens before authorizing again"
+        });
+      }
+      await provider.invalidateCredentials("tokens", {
+        tokens: { ...tokens }
+      });
+    }
+    try {
+      if (storedAuthorizationServerInformation) {
+        if (refreshAttempt) {
+          refreshAttempt.tokens = { ...tokens };
+        }
+        const newTokens = await refreshAuthorization(authorizationServerUrl, {
+          metadata,
+          clientInformation,
+          refreshToken: tokens.refresh_token,
+          resource,
+          addClientAuthentication: provider.addClientAuthentication,
+          fetchFn
+        });
+        await provider.saveTokens(
+          addAuthorizationServerInformationToTokens(
+            newTokens,
+            currentAuthorizationServerInformation
+          )
+        );
+        return "AUTHORIZED";
+      }
     } catch (error) {
       if (
         // If this is a ServerError, or an unknown type, log it out and try to continue. Otherwise, escalate so we can fix things and retry.
@@ -1114,6 +1416,9 @@ async function authInternal(provider, {
     }
   }
   const state = provider.state ? await provider.state() : void 0;
+  if (state && provider.saveState) {
+    await provider.saveState(state);
+  }
   const { authorizationUrl, codeVerifier } = await startAuthorization(
     authorizationServerUrl,
     {
@@ -1121,10 +1426,20 @@ async function authInternal(provider, {
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: scope || provider.clientMetadata.scope,
+      scope: scope || clientMetadata.scope,
       resource
     }
   );
+  const savedAuthorizationServerInformation = await saveAuthorizationServerInformation({
+    provider,
+    clientInformation,
+    authorizationServerInformation: currentAuthorizationServerInformation
+  });
+  if (!savedAuthorizationServerInformation) {
+    throw new MCPClientOAuthError({
+      message: "OAuth authorization server metadata must be saveable before starting authorization"
+    });
+  }
   await provider.saveCodeVerifier(codeVerifier);
   await provider.redirectToAuthorization(authorizationUrl);
   return "REDIRECT";