@cloudflare/workers-oauth-provider 1.2.2 → 1.2.3

package/dist/oauth-provider.js

@@ -209,7 +209,7 @@ function isValidOAuthScopeToken(scopeToken) {
 
 //#endregion
 //#region package.json
-var version = "1.2.2";
+var version = "1.2.3";
 
 //#endregion
 //#region src/oauth-http.ts
@@ -1039,6 +1039,32 @@ function requestCarriesResourceQuery(requestUrl, resourceUrl) {
 	for (const [name, value] of resourceUrl.searchParams) if (!requestUrl.searchParams.getAll(name).includes(value)) return false;
 	return true;
 }
+/**
+* The configured resource a client-supplied resource indicator names when it is
+* not an exact match: one with the same origin and path whose query parameters
+* the indicator carries, as a request URL the resource covers would. With
+* several such resources, the one with the most query parameters wins and a tie
+* names none. A value without a query never matches here.
+*/
+function findCoveringResource(requested, configured) {
+	let url;
+	try {
+		url = new URL(requested);
+	} catch {
+		return;
+	}
+	if (url.search === "") return void 0;
+	const covering = configured.map((resource) => ({
+		resource,
+		url: new URL(resource)
+	})).filter((candidate) => candidate.url.origin === url.origin && (candidate.url.pathname || "/") === (url.pathname || "/") && requestCarriesResourceQuery(url, candidate.url)).map(({ resource, url: url$1 }) => ({
+		resource,
+		specificity: [...url$1.searchParams].length
+	})).sort((a, b) => b.specificity - a.specificity);
+	if (covering.length === 0) return void 0;
+	if (covering.length > 1 && covering[0].specificity === covering[1].specificity) return void 0;
+	return covering[0].resource;
+}
 
 //#endregion
 //#region src/oauth-client-metadata.ts
@@ -4705,6 +4731,27 @@ var OAuthProviderImpl = class {
 		if (typeof singular !== "string" || !validateResourceUri(singular)) return void 0;
 		return this.resourceServers.map((server) => server.resourceMetadata.resource).find((configured) => isExactResource(singular, configured));
 	}
+	/**
+	* Resolve a client-supplied RFC 8707 resource indicator to a configured resource.
+	*
+	* An exact match wins. Otherwise a request may name the URL it uses at the resource
+	* when that URL differs from a configured resource only by query parameters the
+	* configured resource does not constrain, such as `https://mcp.example.com/mcp?mode=x`
+	* for `https://mcp.example.com/mcp`. The resource server already treats that URL as
+	* covered by the resource (its 401 points at the resource's metadata, and the
+	* resource's tokens are accepted there), and RFC 8707 §2.2 lets the authorization
+	* server map a requested value to a more general resource. The audience stays the
+	* configured resource, so the token is no broader. See {@link findCoveringResource}.
+	* Only client requests use this; stored audiences and configuration stay exact.
+	*/
+	findRequestedResource(value) {
+		const exact = this.findConfiguredResource(value);
+		if (exact) return exact;
+		const distinct = Array.isArray(value) ? [...new Set(value)] : [value];
+		const singular = distinct.length === 1 ? distinct[0] : void 0;
+		if (typeof singular !== "string" || !validateResourceUri(singular)) return void 0;
+		return findCoveringResource(singular, this.resourceServers.map((server) => server.resourceMetadata.resource));
+	}
 	/** Select the audience for a new interactive authorization. */
 	resolveAuthorizationRequestResource(requestedResource) {
 		if (requestedResource === void 0) {
@@ -4712,7 +4759,7 @@ var OAuthProviderImpl = class {
 			if (defaultResource) return defaultResource;
 			throw new AuthorizationError("invalid_target", { description: "The resource parameter is required when the authorization server has multiple resources" });
 		}
-		const configured = this.findConfiguredResource(requestedResource);
+		const configured = this.findRequestedResource(requestedResource);
 		if (!configured) throw new AuthorizationError("invalid_target", { description: "The resource parameter must name exactly one configured protected resource" });
 		return configured;
 	}
@@ -4740,7 +4787,7 @@ var OAuthProviderImpl = class {
 	/** Validate explicit resource syntax and configured-resource policy. */
 	validateTokenRequestResourceIndicator(requestedResource) {
 		if (requestedResource === void 0) return;
-		if (!this.findConfiguredResource(requestedResource)) throw new OAuthError("invalid_target", {
+		if (!this.findRequestedResource(requestedResource)) throw new OAuthError("invalid_target", {
 			description: "The resource parameter must name exactly one configured protected resource",
 			internal: {
 				category: "resource-indicator",
@@ -4759,7 +4806,7 @@ var OAuthProviderImpl = class {
 			}
 		});
 		const resourceWasProvided = requestedResource !== void 0;
-		const requestedAudience = resourceWasProvided ? this.findConfiguredResource(requestedResource) : void 0;
+		const requestedAudience = resourceWasProvided ? this.findRequestedResource(requestedResource) : void 0;
 		if (resourceWasProvided && (!requestedAudience || requestedAudience !== subjectAudience)) throw new OAuthError("invalid_target", {
 			description: "The requested resource must exactly match the subject token audience",
 			internal: {
@@ -4778,7 +4825,7 @@ var OAuthProviderImpl = class {
 		const resourceWasProvided = requestedResource !== void 0;
 		const grantResourceWasStored = grantedResource !== void 0;
 		const canonicalGrantResource = this.findStoredConfiguredResource(grantedResource);
-		const canonicalRequestedResource = resourceWasProvided ? this.findConfiguredResource(requestedResource) : void 0;
+		const canonicalRequestedResource = resourceWasProvided ? this.findRequestedResource(requestedResource) : void 0;
 		if (grantResourceWasStored && !canonicalGrantResource) throw new OAuthError("invalid_grant", {
 			description: "The authorization grant is not bound to a configured resource",
 			internal: {

package/docs/authorization-server.md

@@ -147,7 +147,7 @@ Conforming MCP clients are required to send `resource` in authorization and toke
 - An authorization-code or refresh-token request may omit `resource`; the server inherits the resource already stored on the grant. If present, it must match that grant and cannot retarget it.
 - Malformed, unknown, or multi-valued resource input returns `invalid_target` before code consumption, callbacks, refresh rotation, or storage writes.
 
-ASCII case differences in the URI scheme and host are accepted, but port, path, query, trailing slash, and array cardinality remain strict. The authorization server always stores and returns the configured lowercase scheme-and-host spelling. The token response includes the selected resource, and the access-token audience contains that resource alone.
+ASCII case differences in the URI scheme and host are accepted, but port, path, trailing slash, and array cardinality remain strict. A client may also name the URL it uses at the resource when that URL adds query parameters the resource does not constrain, such as `https://mcp.example.com/mcp?mode=direct` for `https://mcp.example.com/mcp`: the protected route already accepts the resource's tokens there and points its `401` at the resource's metadata, so the authorization server maps the value to the resource (RFC 8707 §2.2). The query parameters a query-bearing resource names must be present, and when several resources cover a value the one with the most query parameters wins; a tie is rejected. Stored grant and token audiences, and `validateToken`'s resource argument, stay exact. The authorization server always stores and returns the configured lowercase scheme-and-host spelling. The token response includes the selected resource, and the access-token audience contains that resource alone.
 
 Token exchange cannot change the resource. Both the subject-token audience and any explicit requested resource must resolve to the same registered canonical value. A token is exchanged by the client its grant was issued to unless `tokenExchangeCallback` returns `allowCrossClientExchange: true`. Internally and externally validated tokens are accepted at a protected route only when their audience matches that route's resource.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-oauth-provider",
-  "version": "1.2.2",
+  "version": "1.2.3",
   "description": "OAuth provider for Cloudflare Workers",
   "main": "dist/oauth-provider.js",
   "types": "dist/oauth-provider.d.ts",