@ai-sdk/mcp 1.0.97 → 1.0.98

package/dist/index.mjs

@@ -429,6 +429,7 @@ var OAuthClientInformationSchema = z3.object({
   client_secret: z3.string().optional(),
   client_id_issued_at: z3.number().optional(),
   client_secret_expires_at: z3.number().optional(),
+  issuer: SafeUrlSchema.optional(),
   authorization_server: SafeUrlSchema.optional(),
   token_endpoint: SafeUrlSchema.optional()
 }).strip();
@@ -1209,10 +1210,16 @@ async function auth(provider, options) {
       await ((_b3 = provider.invalidateCredentials) == null ? void 0 : _b3.call(provider, "all"));
       return await authInternal(provider, options);
     } else if (error instanceof InvalidGrantError && refreshAttempt.tokens) {
+      const retryAuthorizationServerInformation = getAuthorizationServerInformationFromCredentials(refreshAttempt.tokens);
       await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
         tokens: refreshAttempt.tokens
       }));
-      return await authInternal(provider, options);
+      return await authInternal(
+        provider,
+        options,
+        void 0,
+        retryAuthorizationServerInformation
+      );
     }
     throw error;
   }
@@ -1245,8 +1252,8 @@ async function authInternal(provider, {
   scope,
   resourceMetadataUrl,
   fetchFn
-}, refreshAttempt) {
-  var _a3, _b3, _c;
+}, refreshAttempt, retryAuthorizationServerInformation) {
+  var _a3, _b3, _c, _d, _e;
   let resourceMetadata;
   let authorizationServerUrl;
   let clientInformation;
@@ -1301,6 +1308,12 @@ async function authInternal(provider, {
     }
   );
   const currentAuthorizationServerInformation = createAuthorizationServerInformation(authorizationServerUrl, metadata);
+  if (retryAuthorizationServerInformation) {
+    assertAuthorizationServerInformationMatches({
+      storedAuthorizationServerInformation: retryAuthorizationServerInformation,
+      currentAuthorizationServerInformation
+    });
+  }
   const clientMetadata = provider.clientMetadata;
   const selectedScope = selectScope({
     scope,
@@ -1310,6 +1323,37 @@ async function authInternal(provider, {
   if (authorizationCode === void 0) {
     clientInformation = await Promise.resolve(provider.clientInformation());
   }
+  const tokens = authorizationCode === void 0 ? await provider.tokens() : void 0;
+  if (clientInformation) {
+    if (clientInformation.issuer != null && clientInformation.issuer !== ((_c = metadata == null ? void 0 : metadata.issuer) != null ? _c : authorizationServerUrl.toString())) {
+      throw new MCPClientOAuthError({
+        message: "OAuth authorization server does not match the issuer of the client credentials"
+      });
+    }
+    const clientAuthorizationServerInformation = getAuthorizationServerInformationFromCredentials(clientInformation);
+    if (clientAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation: clientAuthorizationServerInformation,
+        currentAuthorizationServerInformation
+      });
+    }
+    const storedAuthorizationServerInformation = (_d = callbackAuthorizationServerInformation != null ? callbackAuthorizationServerInformation : await getStoredAuthorizationServerInformation({
+      provider,
+      clientInformation,
+      tokens
+    })) != null ? _d : retryAuthorizationServerInformation;
+    if (storedAuthorizationServerInformation) {
+      assertAuthorizationServerInformationMatches({
+        storedAuthorizationServerInformation,
+        currentAuthorizationServerInformation
+      });
+    }
+    if ((clientInformation.client_secret != null || provider.addClientAuthentication) && clientInformation.issuer == null && !storedAuthorizationServerInformation) {
+      throw new MCPClientOAuthError({
+        message: "OAuth client credentials must be bound to an authorization server: configure their issuer or store authorization server information"
+      });
+    }
+  }
   if (!clientInformation) {
     if (authorizationCode !== void 0) {
       throw new Error(
@@ -1376,7 +1420,6 @@ async function authInternal(provider, {
     );
     return "AUTHORIZED";
   }
-  const tokens = await provider.tokens();
   if (tokens == null ? void 0 : tokens.refresh_token) {
     const storedAuthorizationServerInformation = await getStoredAuthorizationServerInformation({
       provider,
@@ -1389,7 +1432,7 @@ async function authInternal(provider, {
         currentAuthorizationServerInformation
       });
     } else {
-      await ((_c = provider.invalidateCredentials) == null ? void 0 : _c.call(provider, "tokens", {
+      await ((_e = provider.invalidateCredentials) == null ? void 0 : _e.call(provider, "tokens", {
         tokens: { ...tokens }
       }));
     }