@ai-sdk/mcp 2.0.31 → 2.0.32

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @ai-sdk/mcp
 
+## 2.0.32
+
+### Patch Changes
+
+- 1011e33: Select MCP OAuth authorization scopes from `WWW-Authenticate` challenges or Protected Resource Metadata.
+
 ## 2.0.31
 
 ### Patch Changes

package/dist/index.js

@@ -631,26 +631,41 @@ function assertAuthorizationServerInformationMatches({
     });
   }
 }
-function extractResourceMetadataUrl(response) {
-  var _a3;
+function extractWWWAuthenticateParams(response) {
+  var _a3, _b3;
   const header = (_a3 = response.headers.get("www-authenticate")) != null ? _a3 : response.headers.get("WWW-Authenticate");
   if (!header) {
-    return void 0;
+    return {};
   }
   const [type, scheme] = header.split(" ");
   if (type.toLowerCase() !== "bearer" || !scheme) {
-    return void 0;
-  }
-  const regex = /resource_metadata="([^"]*)"/;
-  const match = header.match(regex);
-  if (!match) {
-    return void 0;
+    return {};
   }
+  const resourceMetadataMatch = header.match(
+    /(?:^|[,\s])resource_metadata="([^"]*)"/i
+  );
+  const scope = (_b3 = header.match(/(?:^|[,\s])scope="([^"]*)"/i)) == null ? void 0 : _b3[1];
+  let resourceMetadataUrl;
   try {
-    return new URL(match[1]);
+    resourceMetadataUrl = resourceMetadataMatch ? new URL(resourceMetadataMatch[1]) : void 0;
   } catch (e) {
-    return void 0;
   }
+  return { resourceMetadataUrl, scope };
+}
+function selectScope({
+  scope,
+  resourceMetadata,
+  clientMetadata
+}) {
+  var _a3;
+  if (scope) {
+    return scope;
+  }
+  const resourceScopes = (_a3 = resourceMetadata == null ? void 0 : resourceMetadata.scopes_supported) == null ? void 0 : _a3.join(" ");
+  if (resourceScopes) {
+    return resourceScopes;
+  }
+  return clientMetadata.scope;
 }
 function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
   if (pathname.endsWith("/")) {
@@ -1279,7 +1294,11 @@ async function authInternal(provider, {
       clientInformation,
       state,
       redirectUrl: provider.redirectUrl,
-      scope: scope || provider.clientMetadata.scope,
+      scope: selectScope({
+        scope,
+        resourceMetadata,
+        clientMetadata: provider.clientMetadata
+      }),
       resource
     }
   );
@@ -1357,11 +1376,13 @@ var SseMCPTransport = class {
             redirect: this.redirectMode
           });
           if (response.status === 401 && this.authProvider && !triedAuth) {
-            this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+            const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+            this.resourceMetadataUrl = resourceMetadataUrl;
             try {
               const result = await auth(this.authProvider, {
                 serverUrl: this.url,
                 resourceMetadataUrl: this.resourceMetadataUrl,
+                scope,
                 fetchFn: this.fetchFn
               });
               if (result !== "AUTHORIZED") {
@@ -1490,11 +1511,13 @@ var SseMCPTransport = class {
         };
         const response = await this.fetchFn(endpoint.href, init);
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
           try {
             const result = await auth(this.authProvider, {
               serverUrl: this.url,
               resourceMetadataUrl: this.resourceMetadataUrl,
+              scope,
               fetchFn: this.fetchFn
             });
             if (result !== "AUTHORIZED") {
@@ -1620,7 +1643,7 @@ var HttpMCPTransport = class {
   /**
    * Runs a single OAuth recovery flow for concurrent 401 responses.
    */
-  authorizeOnce(resourceMetadataUrl) {
+  authorizeOnce(resourceMetadataUrl, scope) {
     if (!this.authProvider) {
       return Promise.resolve("REDIRECT");
     }
@@ -1628,6 +1651,7 @@ var HttpMCPTransport = class {
       this.authPromise = auth(this.authProvider, {
         serverUrl: this.url,
         resourceMetadataUrl,
+        scope,
         fetchFn: this.fetchFn
       }).finally(() => {
         this.authPromise = void 0;
@@ -1691,9 +1715,13 @@ var HttpMCPTransport = class {
         const response = await this.fetchFn(this.url.href, init);
         this.applySessionIdFromResponse(response);
         if (response.status === 401 && this.authProvider && !triedAuth) {
-          this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+          const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+          this.resourceMetadataUrl = resourceMetadataUrl;
           try {
-            const result = await this.authorizeOnce(this.resourceMetadataUrl);
+            const result = await this.authorizeOnce(
+              this.resourceMetadataUrl,
+              scope
+            );
             if (result !== "AUTHORIZED") {
               const error2 = new UnauthorizedError();
               throw error2;
@@ -1869,9 +1897,13 @@ var HttpMCPTransport = class {
       });
       this.applySessionIdFromResponse(response);
       if (response.status === 401 && this.authProvider && !triedAuth) {
-        this.resourceMetadataUrl = extractResourceMetadataUrl(response);
+        const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+        this.resourceMetadataUrl = resourceMetadataUrl;
         try {
-          const result = await this.authorizeOnce(this.resourceMetadataUrl);
+          const result = await this.authorizeOnce(
+            this.resourceMetadataUrl,
+            scope
+          );
           if (result !== "AUTHORIZED") {
             const error = new UnauthorizedError();
             (_b3 = this.onerror) == null ? void 0 : _b3.call(this, error);