@cloudflare/workers-oauth-provider 0.8.1 → 0.8.2

package/README.md

@@ -393,11 +393,11 @@ new OAuthProvider({
 
 Setup:
 
-1. Configure your IdP as an ID-JAG issuer with this worker's origin as the resource and a public JWKS endpoint.
+1. Configure your IdP as an ID-JAG issuer with a public JWKS endpoint. If it includes the optional `resource` claim, configure it with the MCP endpoint URL.
 2. Set `resourceMetadata.resource` to the MCP endpoint URL (required when EMA is enabled).
 3. Implement `trustedIssuers` as a resolver — for multi-tenant deployments it can read `env` / `clientInfo` to look up per-tenant IdP config without redeploying.
 
-The AS enforces `resolved.issuer === iss` (confused-deputy guard) and validates ID-JAG `typ`, signature, audience, client binding, resource, `exp` / `iat` / `nbf`, max lifetime, and `jti` replay. Refresh tokens are not issued for this grant — the ID-JAG itself is the renewable assertion.
+The AS enforces `resolved.issuer === iss` (confused-deputy guard) and validates ID-JAG `typ`, signature, audience, client binding, any supplied resource, `exp` / `iat` / `nbf`, max lifetime, and `jti` replay. When the optional `resource` claim is omitted, the AS uses `resourceMetadata.resource`, so issued tokens remain pinned to the configured MCP resource. Refresh tokens are not issued for this grant — the ID-JAG itself is the renewable assertion.
 
 ### Public clients
 
@@ -410,7 +410,7 @@ enterpriseManagedAuthorization: {
 }
 ```
 
-This is useful for clients registered via a [Client ID Metadata Document (CIMD)](https://modelcontextprotocol.io/), which are always public and therefore cannot present a client secret. With this enabled, trust rests on the IdP-issued, signature-verified, short-lived, single-use ID-JAG assertion (audience-, resource-, and client-bound) rather than on a separately presented client secret. Leave it unset (default `false`) to keep the spec-default behavior of requiring client authentication.
+This is useful for clients registered via a [Client ID Metadata Document (CIMD)](https://modelcontextprotocol.io/), which are always public and therefore cannot present a client secret. With this enabled, trust rests on the IdP-issued, signature-verified, short-lived, single-use ID-JAG assertion (audience- and client-bound), together with the provider's configured resource pinning, rather than on a separately presented client secret. Leave it unset (default `false`) to keep the spec-default behavior of requiring client authentication.
 
 Experimental — the MCP extension is still a draft.
 

package/dist/oauth-provider.d.ts

@@ -102,7 +102,11 @@ interface EmaIdJagClaims {
   sub: string;
   /** Authorization server issuer URL or URLs for which this assertion is intended. */
   aud: string | string[];
-  /** RFC 9728 resource identifier of the MCP server. */
+  /**
+   * Effective RFC 9728 resource identifier of the MCP server. When the ID-JAG
+   * omits its optional `resource` claim, the provider supplies its configured
+   * `resourceMetadata.resource` value.
+   */
   resource: string;
   /** OAuth client identifier this assertion was issued to. */
   client_id: string;
@@ -140,7 +144,10 @@ interface EmaClaimsMapperInput<Env = Cloudflare.Env> {
   claims: EmaIdJagClaims;
   /** Authenticated OAuth client that presented the assertion. */
   clientInfo: ClientInfo;
-  /** Validated MCP resource identifier from the assertion. */
+  /**
+   * Effective MCP resource identifier. Taken from the assertion when present,
+   * otherwise from the provider's configured `resourceMetadata.resource`.
+   */
   resource: string;
   /** Requested scopes after downscoping to the assertion's scope claim, if present. */
   requestedScope: string[];
@@ -281,8 +288,9 @@ interface EmaOptions<Env = Cloudflare.Env> {
    * always public (`none`) and therefore cannot present a client secret. The
    * security trade-off is documented in the README: the trust then rests on
    * the IdP-issued, signature-verified, short-lived, single-use ID-JAG
-   * assertion (audience-, resource-, and client-bound) rather than on a
-   * separately presented client secret.
+   * assertion (audience- and client-bound), together with the provider's
+   * configured resource pinning, rather than on a separately presented client
+   * secret.
    */
   allowPublicClients?: boolean;
 }

package/dist/oauth-provider.js

@@ -469,13 +469,14 @@ function isWellFormedTrustedIssuer(issuer) {
 	return true;
 }
 /**
-* Validate every required ID-JAG claim and produce a typed `ValidatedIdJag`.
+* Validate the ID-JAG claims and produce a typed `ValidatedIdJag`.
 *
 * Enforces (in order):
-*   - presence + type of `iss`, `sub`, `aud`, `resource`, `client_id`, `jti`, `exp`, `iat`
+*   - presence + type of `iss`, `sub`, `aud`, `client_id`, `jti`, `exp`, `iat`
 *   - `aud` contains the AS's expected audience
 *   - `client_id` matches the authenticated client
-*   - `resource` is a valid RFC 8707 URI and matches the AS's configured resource
+*   - optional `resource` is a valid RFC 8707 URI and matches the AS's configured resource
+*   - the configured resource is used when `resource` is omitted
 *   - `exp` is in the future
 *   - `iat` is not more than `clockSkewSeconds` in the future
 *   - `nbf` (if present) is ≤ `now + clockSkewSeconds`
@@ -495,7 +496,7 @@ function validateIdJagClaims(input) {
 	if (!sub.ok) return sub;
 	const aud = readAudienceClaim(rawClaims);
 	if (!aud.ok) return aud;
-	const resource = readRequiredString(rawClaims, "resource");
+	const resource = rawClaims.resource === void 0 ? ok(configuredResource) : readRequiredString(rawClaims, "resource");
 	if (!resource.ok) return resource;
 	const claimClientId = readRequiredString(rawClaims, "client_id");
 	if (!claimClientId.ok) return claimClientId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",