@ai-sdk/mcp 1.0.90 → 1.0.92

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @ai-sdk/mcp
 
+## 1.0.92
+
+### Patch Changes
+
+- ff05827: fix(mcp): authorization server paths beginning with repeated slashes should not bypass authorization server validation
+
+## 1.0.91
+
+### Patch Changes
+
+- 5267a7a: Preserve stored OAuth credentials when an authorization-code exchange returns `invalid_grant`, without retrying the rejected code.
+
+  Add optional token context to `OAuthClientProvider.invalidateCredentials` so providers sharing storage can atomically delete only the rejected token generation and preserve tokens saved by a concurrent refresh.
+
 ## 1.0.90
 
 ### Patch Changes

package/dist/index.d.mts

@@ -184,8 +184,15 @@ interface OAuthClientProvider {
      * If implemented, provides a way for the client to invalidate (e.g. delete) the specified
      * credentials, in the case where the server has indicated that they are no longer valid.
      * This avoids requiring the user to intervene manually.
+     *
+     * For token invalidation, context identifies the token generation being invalidated
+     * when available. Providers sharing storage must atomically compare and delete
+     * that generation so a concurrent refresh's tokens are preserved. Omitting or
+     * ignoring context retains unconditional invalidation.
      */
-    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier'): void | Promise<void>;
+    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier', context?: {
+        tokens: OAuthTokens;
+    }): void | Promise<void>;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;

package/dist/index.d.ts

@@ -184,8 +184,15 @@ interface OAuthClientProvider {
      * If implemented, provides a way for the client to invalidate (e.g. delete) the specified
      * credentials, in the case where the server has indicated that they are no longer valid.
      * This avoids requiring the user to intervene manually.
+     *
+     * For token invalidation, context identifies the token generation being invalidated
+     * when available. Providers sharing storage must atomically compare and delete
+     * that generation so a concurrent refresh's tokens are preserved. Omitting or
+     * ignoring context retains unconditional invalidation.
      */
-    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier'): void | Promise<void>;
+    invalidateCredentials?(scope: 'all' | 'client' | 'tokens' | 'verifier', context?: {
+        tokens: OAuthTokens;
+    }): void | Promise<void>;
     get redirectUrl(): string | URL;
     get clientMetadata(): OAuthClientMetadata;
     clientInformation(): OAuthClientInformation | undefined | Promise<OAuthClientInformation | undefined>;

package/dist/index.js

@@ -860,8 +860,10 @@ function buildDiscoveryUrls(authorizationServerUrl) {
     type: "oidc",
     expectedIssuer: pathIssuer
   });
+  const oidcDiscoveryUrl = new URL(url.origin);
+  oidcDiscoveryUrl.pathname = `${pathname}/.well-known/openid-configuration`;
   urlsToTry.push({
-    url: new URL(`${pathname}/.well-known/openid-configuration`, url.origin),
+    url: oidcDiscoveryUrl,
     type: "oidc",
     expectedIssuer: pathIssuer
   });
@@ -882,7 +884,13 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, {
 } = {}) {
   var _a3;
   const headers = { "MCP-Protocol-Version": protocolVersion };
+  const authorizationServerOrigin = new URL(authorizationServerUrl).origin;
   const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
+  if (urlsToTry.some(({ url }) => url.origin !== authorizationServerOrigin)) {
+    throw new MCPClientOAuthError({
+      message: "OAuth discovery URL changed authorization-server origin"
+    });
+  }
   for (const { url: endpointUrl, type, expectedIssuer } of urlsToTry) {
     const response = await fetchWithCorsRetry(
       endpointUrl,
@@ -1215,8 +1223,9 @@ async function registerClient(authorizationServerUrl, {
 }
 async function auth(provider, options) {
   var _a3, _b3, _c;
+  const refreshAttempt = {};
   try {
-    return await authInternal(provider, options);
+    return await authInternal(provider, options, refreshAttempt);
   } catch (error) {
     if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
       if (options.authorizationCode !== void 0 || !await ((_a3 = provider.isClientInformationDynamicallyRegistered) == null ? void 0 : _a3.call(provider))) {
@@ -1224,8 +1233,10 @@ async function auth(provider, options) {
       }
       await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "all"));
       return await authInternal(provider, options);
-    } else if (error instanceof InvalidGrantError) {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
+    } else if (error instanceof InvalidGrantError && refreshAttempt.tokens) {
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: refreshAttempt.tokens
+      }));
       return await authInternal(provider, options);
     }
     throw error;
@@ -1259,7 +1270,7 @@ async function authInternal(provider, {
   scope,
   resourceMetadataUrl,
   fetchFn
-}) {
+}, refreshAttempt) {
   var _a3, _b3, _c;
   let resourceMetadata;
   let authorizationServerUrl;
@@ -1403,10 +1414,15 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens"));
+      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+        tokens: { ...tokens }
+      }));
     }
     try {
       if (storedAuthorizationServerInformation) {
+        if (refreshAttempt) {
+          refreshAttempt.tokens = { ...tokens };
+        }
         const newTokens = await refreshAuthorization(authorizationServerUrl, {
           metadata,
           clientInformation,