@ai-sdk/mcp 1.0.27 → 1.0.29

package/dist/index.mjs

@@ -919,6 +919,7 @@ async function selectResourceURL(serverUrl, provider, resourceMetadata) {
 async function authInternal(provider, {
   serverUrl,
   authorizationCode,
+  callbackState,
   scope,
   resourceMetadataUrl,
   fetchFn
@@ -971,6 +972,14 @@ async function authInternal(provider, {
     clientInformation = fullInformation;
   }
   if (authorizationCode !== void 0) {
+    if (provider.storedState) {
+      const expectedState = await provider.storedState();
+      if (expectedState !== void 0 && expectedState !== callbackState) {
+        throw new Error(
+          "OAuth state parameter mismatch - possible CSRF attack"
+        );
+      }
+    }
     const codeVerifier2 = await provider.codeVerifier();
     const tokens2 = await exchangeAuthorization(authorizationServerUrl, {
       metadata,
@@ -1009,6 +1018,9 @@ async function authInternal(provider, {
     }
   }
   const state = provider.state ? await provider.state() : void 0;
+  if (state && provider.saveState) {
+    await provider.saveState(state);
+  }
   const { authorizationUrl, codeVerifier } = await startAuthorization(
     authorizationServerUrl,
     {
@@ -1030,12 +1042,14 @@ var SseMCPTransport = class {
   constructor({
     url,
     headers,
-    authProvider
+    authProvider,
+    redirect = "follow"
   }) {
     this.connected = false;
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
+    this.redirectMode = redirect;
   }
   async commonHeaders(base) {
     const headers = {
@@ -1069,7 +1083,8 @@ var SseMCPTransport = class {
           });
           const response = await fetch(this.url.href, {
             headers,
-            signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal
+            signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
+            redirect: this.redirectMode
           });
           if (response.status === 401 && this.authProvider && !triedAuth) {
             this.resourceMetadataUrl = extractResourceMetadataUrl(response);
@@ -1188,7 +1203,8 @@ var SseMCPTransport = class {
           method: "POST",
           headers,
           body: JSON.stringify(message),
-          signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal
+          signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
+          redirect: this.redirectMode
         };
         const response = await fetch(endpoint, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
@@ -1236,7 +1252,8 @@ var HttpMCPTransport = class {
   constructor({
     url,
     headers,
-    authProvider
+    authProvider,
+    redirect = "follow"
   }) {
     this.inboundReconnectAttempts = 0;
     this.reconnectionOptions = {
@@ -1248,6 +1265,7 @@ var HttpMCPTransport = class {
     this.url = new URL(url);
     this.headers = headers;
     this.authProvider = authProvider;
+    this.redirectMode = redirect;
   }
   async commonHeaders(base) {
     const headers = {
@@ -1288,7 +1306,8 @@ var HttpMCPTransport = class {
         await fetch(this.url, {
           method: "DELETE",
           headers,
-          signal: this.abortController.signal
+          signal: this.abortController.signal,
+          redirect: this.redirectMode
         }).catch(() => void 0);
       }
     } catch (e) {
@@ -1308,7 +1327,8 @@ var HttpMCPTransport = class {
           method: "POST",
           headers,
           body: JSON.stringify(message),
-          signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal
+          signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
+          redirect: this.redirectMode
         };
         const response = await fetch(this.url, init);
         const sessionId = response.headers.get("mcp-session-id");
@@ -1457,7 +1477,8 @@ var HttpMCPTransport = class {
       const response = await fetch(this.url.href, {
         method: "GET",
         headers,
-        signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal
+        signal: (_a3 = this.abortController) == null ? void 0 : _a3.signal,
+        redirect: this.redirectMode
       });
       const sessionId = response.headers.get("mcp-session-id");
       if (sessionId) {