@ai-sdk/mcp 1.0.80 → 1.0.82

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @ai-sdk/mcp
 
+## 1.0.82
+
+### Patch Changes
+
+- 1620182: fix(mcp): avoid duplicate legacy SSE OAuth refreshes for stale 401 responses
+
+## 1.0.81
+
+### Patch Changes
+
+- 5246507: fix(mcp): use the stored authorization server for OAuth callbacks when protected resource metadata rediscovery fails
+
 ## 1.0.80
 
 ### Patch Changes

package/dist/index.js

@@ -1199,9 +1199,11 @@ async function authInternal(provider, {
   resourceMetadataUrl,
   fetchFn
 }) {
-  var _a3, _b3;
+  var _a3, _b3, _c;
   let resourceMetadata;
   let authorizationServerUrl;
+  let clientInformation;
+  let callbackAuthorizationServerInformation;
   assertResourceMetadataUrlSameOrigin(serverUrl, resourceMetadataUrl);
   try {
     resourceMetadata = await discoverOAuthProtectedResourceMetadata(
@@ -1214,15 +1216,24 @@ async function authInternal(provider, {
     }
   } catch (e) {
   }
+  if (authorizationCode !== void 0) {
+    clientInformation = await Promise.resolve(provider.clientInformation());
+    if (clientInformation) {
+      callbackAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+        provider,
+        clientInformation
+      });
+    }
+  }
   if (!authorizationServerUrl) {
-    authorizationServerUrl = serverUrl;
+    authorizationServerUrl = (_a3 = callbackAuthorizationServerInformation == null ? void 0 : callbackAuthorizationServerInformation.authorizationServerUrl) != null ? _a3 : serverUrl;
   }
   const resource = await selectResourceURL(
     serverUrl,
     provider,
     resourceMetadata
   );
-  await ((_a3 = provider.validateAuthorizationServerURL) == null ? void 0 : _a3.call(
+  await ((_b3 = provider.validateAuthorizationServerURL) == null ? void 0 : _b3.call(
     provider,
     serverUrl,
     authorizationServerUrl
@@ -1240,7 +1251,9 @@ async function authInternal(provider, {
     resourceMetadata,
     clientMetadata
   });
-  let clientInformation = await Promise.resolve(provider.clientInformation());
+  if (authorizationCode === void 0) {
+    clientInformation = await Promise.resolve(provider.clientInformation());
+  }
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error(
@@ -1275,7 +1288,7 @@ async function authInternal(provider, {
         );
       }
     }
-    const storedAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
+    const storedAuthorizationServerInformation = callbackAuthorizationServerInformation != null ? callbackAuthorizationServerInformation : await getStoredAuthorizationServerInformation({
       provider,
       clientInformation
     });
@@ -1320,7 +1333,7 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "tokens"));
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
     }
     try {
       if (storedAuthorizationServerInformation) {
@@ -1421,6 +1434,30 @@ var SseMCPTransport = class {
       (0, import_provider_utils3.getRuntimeEnvironmentUserAgent)()
     );
   }
+  /**
+   * Runs a single OAuth recovery flow for concurrent 401 responses.
+   */
+  authorizeOnce(resourceMetadataUrl, scope) {
+    if (!this.authProvider) {
+      return Promise.resolve("REDIRECT");
+    }
+    if (!this.authPromise) {
+      this.authPromise = auth(this.authProvider, {
+        serverUrl: this.url,
+        resourceMetadataUrl,
+        scope,
+        fetchFn: this.fetchFn
+      }).finally(() => {
+        this.authPromise = void 0;
+      });
+    }
+    return this.authPromise;
+  }
+  async accessTokenChanged(requestAuthorization) {
+    var _a3, _b3;
+    const accessToken = (_b3 = await ((_a3 = this.authProvider) == null ? void 0 : _a3.tokens())) == null ? void 0 : _b3.access_token;
+    return accessToken != null && requestAuthorization !== `Bearer ${accessToken}`;
+  }
   async start() {
     return new Promise((resolve, reject) => {
       if (this.connected) {
@@ -1442,12 +1479,10 @@ var SseMCPTransport = class {
             const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
             this.resourceMetadataUrl = resourceMetadataUrl;
             try {
-              const result = await auth(this.authProvider, {
-                serverUrl: this.url,
-                resourceMetadataUrl: this.resourceMetadataUrl,
-                scope,
-                fetchFn: this.fetchFn
-              });
+              const result = await this.authorizeOnce(
+                this.resourceMetadataUrl,
+                scope
+              );
               if (result !== "AUTHORIZED") {
                 const error = new UnauthorizedError();
                 (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);
@@ -1560,7 +1595,7 @@ var SseMCPTransport = class {
     const transportSignal = (_b3 = this.abortController) == null ? void 0 : _b3.signal;
     const requestSignal = (options == null ? void 0 : options.signal) == null ? transportSignal : transportSignal == null ? options.signal : AbortSignal.any([transportSignal, options.signal]);
     const attempt = async (triedAuth = false) => {
-      var _a4, _b4;
+      var _a4, _b4, _c;
       try {
         const headers = await this.commonHeaders({
           "Content-Type": "application/json"
@@ -1574,14 +1609,17 @@ var SseMCPTransport = class {
         };
         const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
+          if (await this.accessTokenChanged(
+            (_a4 = new Headers(headers).get("authorization")) != null ? _a4 : void 0
+          )) {
+            return attempt(true);
+          }
           const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
           this.resourceMetadataUrl = resourceMetadataUrl;
-          const result = await auth(this.authProvider, {
-            serverUrl: this.url,
-            resourceMetadataUrl: this.resourceMetadataUrl,
-            scope,
-            fetchFn: this.fetchFn
-          });
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
+            scope
+          );
           if (result !== "AUTHORIZED") {
             throw new UnauthorizedError();
           }
@@ -1598,10 +1636,10 @@ var SseMCPTransport = class {
           throw error;
         }
       } catch (error) {
-        if ((_a4 = options == null ? void 0 : options.signal) == null ? void 0 : _a4.aborted) {
+        if ((_b4 = options == null ? void 0 : options.signal) == null ? void 0 : _b4.aborted) {
           throw error;
         }
-        (_b4 = this.onerror) == null ? void 0 : _b4.call(this, error);
+        (_c = this.onerror) == null ? void 0 : _c.call(this, error);
         throw error;
       }
     };