fix oauth discovery metadata validation

Rhys Sullivan committed 3 months ago

Commit 7a4abc01 parent 8926d665 files · +194 −27Browse files

Unified · Split

5 files

packages/core/sdk/src/oauth-discovery.test.ts +70 −13
packages/core/sdk/src/oauth-discovery.ts +28 −7
packages/core/sdk/src/oauth-register-dynamic.test.ts +68 −1
packages/core/sdk/src/oauth-service.ts +22 −4
packages/core/sdk/src/testing/oauth-test-server.ts +6 −2

packages/core/sdk/src/oauth-discovery.test.ts+70−13

   );
 describe("canonicalResourceUrl", () => {
-  it("lowercases scheme + host, drops trailing slash, fragment, and query", () => {
+  it("lowercases scheme + host, keeps query + trailing slash, and drops fragment", () => {
     expect(canonicalResourceUrl("https://API.Example.com/v1/mcp/")).toBe(
-      "https://api.example.com/v1/mcp",
+      "https://api.example.com/v1/mcp/",
     );
     expect(canonicalResourceUrl("HTTPS://api.example.com/v1/mcp?x=1#frag")).toBe(
-      "https://api.example.com/v1/mcp",
+      "https://api.example.com/v1/mcp?x=1",
     );
-    expect(canonicalResourceUrl("https://api.example.com/")).toBe("https://api.example.com");
+    expect(canonicalResourceUrl("https://api.example.com/")).toBe("https://api.example.com/");
   });
 });
         }
         if (request.url === "/.well-known/oauth-protected-resource") {
           return sendJson({
-            resource: baseUrl,
+            resource: `${baseUrl}/graphql`,
             authorization_servers: [baseUrl],
             scopes_supported: ["read"],
           });
     ),
   );
+  it.effect("treats a trailing slash as the same authorization-server issuer", () =>
+    withOAuthFixture(
+      (_request, baseUrl) =>
+        sendJson({
+          issuer: `${baseUrl}/`,
+          authorization_endpoint: `${baseUrl}/authorize`,
+          token_endpoint: `${baseUrl}/token`,
+        }),
+      ({ baseUrl }) =>
+        Effect.gen(function* () {
+          const result = yield* discoverAuthorizationServerMetadata(baseUrl);
+          expect(result?.metadata.issuer).toBe(`${baseUrl}/`);
+        }),
+    ),
+  );
   it.effect("requires issuer + authorize + token endpoints", () =>
     withOAuthFixture(
       () => sendJson({ issuer: "http://127.0.0.1" }),
   it.effect("rejects unsupported authorization server endpoint URLs", () =>
     withOAuthFixture(
-      () =>
+      (_request, baseUrl) =>
         sendJson({
-          issuer: "http://example.com",
+          issuer: baseUrl,
           authorization_endpoint: "javascript:alert(1)",
           token_endpoint: "http://example.com/token",
           response_types_supported: ["code"],
   it.effect("allows HTTP authorization server endpoints when the caller opts into local HTTP", () =>
     withOAuthFixture(
-      () =>
+      (_request, baseUrl) =>
         sendJson({
-          issuer: "http://example.com",
+          issuer: baseUrl,
           authorization_endpoint: "http://example.com/authorize",
           token_endpoint: "http://example.com/token",
           response_types_supported: ["code"],
         }
         if (request.url === "/.well-known/oauth-protected-resource") {
           return sendJson({
-            resource: baseUrl,
+            resource: `${baseUrl}/graphql/v2`,
             authorization_servers: [baseUrl],
             scopes_supported: ["openid", "profile", "email", "offline_access", "workspace:member"],
           });
           expect(url.searchParams.get("response_type")).toBe("code");
           expect(url.searchParams.get("state")).toBe("state-xyz");
           expect(url.searchParams.get("code_challenge_method")).toBe("S256");
-          expect(url.searchParams.get("resource")).toBe(baseUrl);
+          expect(url.searchParams.get("resource")).toBe(`${baseUrl}/graphql/v2`);
           expect(result.state.authorizationServerMetadata.token_endpoint).toBe(
             `${baseUrl}/oauth/token`,
           );
-          expect(result.state.resourceMetadata?.resource).toBe(baseUrl);
+          expect(result.state.resourceMetadata?.resource).toBe(`${baseUrl}/graphql/v2`);
         }),
     ),
   );
             });
             const authUrl = new URL(result.authorizationUrl);
-            expect(authUrl.searchParams.get("resource")).toBe(`${baseUrl}/v1/mcp`);
+            expect(authUrl.searchParams.get("resource")).toBe(`${baseUrl}/v1/mcp/`);
           }),
       ),
   );
     ),
   );
+  it.effect("rejects an ancestor resource indicator from previous discovery state", () =>
+    withOAuthFixture(
+      () => notFound(),
+      ({ baseUrl, requests }) =>
+        Effect.gen(function* () {
+          const exit = yield* Effect.exit(
+            beginDynamicAuthorization({
+              endpoint: `${baseUrl}/mcp`,
+              redirectUrl: "https://app/cb",
+              state: "s",
+              previousState: {
+                authorizationServerUrl: baseUrl,
+                authorizationServerMetadataUrl: `${baseUrl}/.well-known/oauth-authorization-server`,
+                authorizationServerMetadata: {
+                  issuer: baseUrl,
+                  authorization_endpoint: `${baseUrl}/authorize`,
+                  token_endpoint: `${baseUrl}/token`,
+                },
+                resourceMetadata: null,
+                clientInformation: {
+                  client_id: "cached-client",
+                },
+                resource: baseUrl,
+              },
+            }),
+          );
+          expect(Exit.isFailure(exit)).toBe(true);
+          if (!Exit.isFailure(exit)) return;
+          const reason = exit.cause.reasons.find(Cause.isFailReason);
+          expect(reason?.error).toEqual(
+            expect.objectContaining({
+              _tag: "OAuthDiscoveryError",
+              message: expect.stringMatching(/resource does not match requested endpoint/),
+            }),
+          );
+          expect((yield* requests).length).toBe(0);
+        }),
+    ),
+  );
   it.effect("rejects servers that don't support PKCE S256", () =>
     withOAuthFixture(
       (request, baseUrl) => {

packages/core/sdk/src/oauth-discovery.ts+28−7

 const validateAuthorizationServerMetadata = (
   metadata: OAuthAuthorizationServerMetadata,
+  expectedIssuer: string,
   policy: OAuthEndpointUrlPolicy = {},
 ): Effect.Effect<void, OAuthDiscoveryError> =>
   Effect.gen(function* () {
     yield* validateEndpointUrl(metadata.issuer, "issuer", policy);
+    const canonicalIssuer = (value: string): string => {
+      const url = new URL(value);
+      const path = url.pathname.replace(/\/+$/, "");
+      return `${url.protocol.toLowerCase()}//${url.host.toLowerCase()}${path}`;
+    };
+    // RFC 8414 issuer identity compares scheme, host, port, and path after URL
+    // normalization; a trailing slash alone does not create a different issuer.
+    if (canonicalIssuer(metadata.issuer) !== canonicalIssuer(expectedIssuer)) {
+      return yield* new OAuthDiscoveryError({
+        message:
+          `Authorization server metadata issuer ${metadata.issuer} does not match the requested ` +
+          `issuer ${expectedIssuer}. Correct the server's issuer metadata or use the matching ` +
+          `authorization server URL.`,
+      });
+    }
     yield* validateEndpointUrl(metadata.authorization_endpoint, "authorization_endpoint", policy);
     yield* validateEndpointUrl(metadata.token_endpoint, "token_endpoint", policy);
     if (metadata.registration_endpoint) {
             }),
         ),
       );
+      if (metadata.resource) {
+        yield* validateResourceIndicator(metadata.resource, canonicalResourceUrl(resourceUrl));
+      }
       return { metadataUrl: url, metadata };
     }
     return null;
             }),
         ),
       );
-      yield* validateAuthorizationServerMetadata(metadata, options.endpointUrlPolicy);
+      yield* validateAuthorizationServerMetadata(metadata, issuer, options.endpointUrlPolicy);
       return { metadataUrl, metadata };
     }
     return null;
 //
 // MCP Authorization 2025-06-18 requires `resource` on /authorize and /token
 // requests. RFC 8707 §2 says the value is "an absolute URI" identifying the
-// protected resource — same scheme + host + (optional) path, no fragment,
+// protected resource. Query components and path trailing slashes are part of
-// no query, lowercased scheme/host.
+// the identifier; fragments are not sent, and scheme/host compare lowercase.
 // ---------------------------------------------------------------------------
 export const canonicalResourceUrl = (value: string): string => {
   const url = new URL(value);
   const scheme = url.protocol.toLowerCase();
   const host = url.host.toLowerCase();
-  const path = url.pathname.replace(/\/+$/, "");
+  return `${scheme}//${host}${url.pathname}${url.search}`;
-  return `${scheme}//${host}${path}`;
 };
 const validateResourceIndicator = (
       }),
   }).pipe(
     Effect.flatMap((actual) =>
-      actual === expected || expected.startsWith(`${actual}/`)
+      actual === expected
         ? Effect.succeed(actual)
         : Effect.fail(
             new OAuthDiscoveryError({
-              message: "Protected resource metadata resource does not match requested endpoint",
+              message:
+                `Protected resource metadata resource does not match requested endpoint: ` +
+                `advertised ${actual}; requested ${expected}. Correct the server's resource ` +
+                `metadata or use the matching resource URL.`,
               cause: { expected, actual },
             }),
           ),

packages/core/sdk/src/oauth-register-dynamic.test.ts+68−1

@@ -8,7 +8,7 @@ import { · 7 unmodified lines
8	OAuthClientSlug,	8	OAuthClientSlug,
9	ToolName,	9	ToolName,
10	} from "./ids";	10	} from "./ids";
11	import { OAuthRegisterDynamicError } from "./oauth-client";	11	import { OAuthProbeError, OAuthRegisterDynamicError } from "./oauth-client";
12	import { definePlugin } from "./plugin";	12	import { definePlugin } from "./plugin";
13	import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";	13	import { makeTestWorkspaceHarness, memoryCredentialsPlugin } from "./test-config";
14	import { serveOAuthTestServer } from "./testing/oauth-test-server";	14	import { serveOAuthTestServer } from "./testing/oauth-test-server";
@@ -58,6 +58,73 @@ const oauthPlugin = definePlugin(() => ({ · 43 unmodified lines
58	const plugins = [memoryCredentialsPlugin(), oauthPlugin] as const;	58	const plugins = [memoryCredentialsPlugin(), oauthPlugin] as const;
59		59
60	describe("oauth.registerDynamicClient", () => {	60	describe("oauth.registerDynamicClient", () => {
		61	it.effect("probe rejects authorization-server metadata with a mismatched issuer", () =>
		62	Effect.scoped(
		63	Effect.gen(function* () {
		64	const advertisedIssuer = "https://issuer.example/mismatched";
		65	const server = yield* serveOAuthTestServer({ advertisedIssuer });
		66	const { executor } = yield* makeTestWorkspaceHarness({ plugins });
		67
		68	const error = yield* Effect.flip(executor.oauth.probe({ url: server.mcpResourceUrl }));
		69	expect(error).toBeInstanceOf(OAuthProbeError);
		70	if (!Predicate.isTagged(error, "OAuthProbeError")) return;
		71	// oxlint-disable-next-line executor/no-unknown-error-message -- test: the tag guard narrows to the public OAuthProbeError contract
		72	const message = error.message;
		73	expect(message).toContain(server.issuerUrl);
		74	expect(message).toContain(advertisedIssuer);
		75	}),
		76	),
		77	);
		78
		79	it.effect("probe rejects protected-resource metadata for a different resource", () =>
		80	Effect.scoped(
		81	Effect.gen(function* () {
		82	const advertisedResource = "https://resource.example/mismatched";
		83	const server = yield* serveOAuthTestServer({ advertisedResource });
		84	const { executor } = yield* makeTestWorkspaceHarness({ plugins });
		85
		86	const error = yield* Effect.flip(executor.oauth.probe({ url: server.mcpResourceUrl }));
		87	expect(error).toBeInstanceOf(OAuthProbeError);
		88	if (!Predicate.isTagged(error, "OAuthProbeError")) return;
		89	// oxlint-disable-next-line executor/no-unknown-error-message -- test: the tag guard narrows to the public OAuthProbeError contract
		90	const message = error.message;
		91	expect(message).toContain(server.mcpResourceUrl);
		92	expect(message).toContain(advertisedResource);
		93	}),
		94	),
		95	);
		96
		97	it.effect("canonicalizes the RFC 8707 resource before persisting a DCR client", () =>
		98	Effect.scoped(
		99	Effect.gen(function* () {
		100	const server = yield* serveOAuthTestServer({ scopes: ["read"] });
		101	const { executor } = yield* makeTestWorkspaceHarness({ plugins });
		102	yield* executor.acme.seed();
		103	const rawResource = `${server.issuerUrl.replace("http://", "HTTP://")}/mcp/?tenant=Acme#fragment`;
		104	const expectedResource = `${server.issuerUrl}/mcp/?tenant=Acme`;
		105
		106	const slug = yield* executor.oauth.registerDynamicClient({
		107	owner: "org",
		108	slug: CLIENT,
		109	issuer: server.issuerUrl,
		110	registrationEndpoint: server.registrationEndpoint,
		111	authorizationUrl: server.authorizationEndpoint,
		112	tokenUrl: server.tokenEndpoint,
		113	resource: rawResource,
		114	scopes: ["read"],
		115	tokenEndpointAuthMethodsSupported: ["none"],
		116	clientName: "Executor",
		117	redirectUri: FLOW_REDIRECT_URI,
		118	originIntegration: INTEG,
		119	});
		120
		121	const clients = yield* executor.oauth.listClients();
		122	const minted = clients.find((client) => String(client.slug) === String(slug));
		123	expect(minted?.resource).toBe(expectedResource);
		124	}),
		125	),
		126	);
		127
61	it.effect("DCR mints + persists a public (no-secret) client that lists + connects", () =>	128	it.effect("DCR mints + persists a public (no-secret) client that lists + connects", () =>
62	Effect.scoped(	129	Effect.scoped(
63	Effect.gen(function* () {	130	Effect.gen(function* () {

packages/core/sdk/src/oauth-service.ts+22−4

 import type { OwnerBinding } from "./plugin";
 import type { CredentialProvider } from "./provider";
 import {
+  canonicalResourceUrl,
   discoverAuthorizationServerMetadata,
   discoverProtectedResourceMetadata,
   OAuthDiscoveryError,
     input: RegisterDynamicClientInput,
     issuer: string | null,
     flowRedirectUri: string | null,
+    resource: string | null,
   ): Effect.Effect<
     {
       readonly existingSlug: OAuthClientSlug | null;
   > =>
     Effect.gen(function* () {
       const candidates = yield* dcrCandidatesForIssuer(input.owner, issuer);
-      const resource = input.resource ?? null;
       // A candidate is reusable only when the callback it registered with the
       // AS still matches the current flow's callback — strict servers reject an
       // authorize request whose redirect_uri differs from the registration
   ): Effect.Effect<OAuthClientSlug, OAuthRegisterDynamicError | StorageFailure> =>
     Effect.gen(function* () {
       const issuer = canonicalDcrIssuer(input.issuer, input.registrationEndpoint);
+      const requestedResource = input.resource ?? null;
+      const resource =
+        requestedResource === null
+          ? null
+          : yield* Effect.try({
+              try: () => canonicalResourceUrl(requestedResource),
+              catch: () =>
+                new OAuthRegisterDynamicError({
+                  message: `OAuth resource must be an absolute URL: ${requestedResource}`,
+                }),
+            });
       // Resolved before the reuse decision: a persisted client registered with
       // a DIFFERENT callback must not be reused (strict servers 400 the
       // authorize request), so the reuse lookup compares against this value.
       const flowRedirectUri = input.redirectUri ?? redirectUri ?? null;
-      const reuse = yield* decideDcrClientReuse(input, issuer, flowRedirectUri);
+      const reuse = yield* decideDcrClientReuse(input, issuer, flowRedirectUri, resource);
       if (reuse.existingSlug !== null) return reuse.existingSlug;
       const slug = reuse.registrationSlug;
         slug,
         authorizationUrl: input.authorizationUrl,
         tokenUrl: input.tokenUrl,
-        resource: input.resource ?? null,
+        resource,
         grant: "authorization_code",
         clientId: information.client_id,
         clientSecret: information.client_secret ?? "",
       const options = { endpointUrlPolicy: deps.endpointUrlPolicy };
       // Try protected-resource metadata first (RFC 9728), then the AS issuer.
       const resource = yield* discoverProtectedResourceMetadata(input.url, options).pipe(
-        Effect.catch(() => Effect.succeed(null)),
+        Effect.mapError(
+          (cause) =>
+            new OAuthProbeError({
+              // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: OAuthDiscoveryError carries a typed `message` field
+              message: `OAuth discovery failed: ${cause.message}`,
+            }),
+        ),
       );
       // EXPLICIT discovery order: when the protected-resource metadata advertises
       // an authorization server, probe that; otherwise probe the input endpoint

packages/core/sdk/src/testing/oauth-test-server.ts+6−2

   readonly invalidRefreshTokenErrorCode?: string;
   readonly idTokenClaims?: Readonly<Record<string, unknown>>;
   readonly refreshIdTokenClaims?: Readonly<Record<string, unknown>>;
+  /** Override the RFC 8414 `issuer` advertised by authorization-server metadata. */
+  readonly advertisedIssuer?: string;
+  /** Override the RFC 9728 `resource` advertised by protected-resource metadata. */
+  readonly advertisedResource?: string;
   /** Gate Dynamic Client Registration on the requested redirect URIs. When set,
    *  `/register` returns `400 invalid_redirect_uri` unless every requested
    *  `redirect_uris` entry is approved. Mirrors authorization servers (e.g.
         if (requestUrl.pathname.startsWith("/.well-known/oauth-protected-resource")) {
           const suffix = requestUrl.pathname.slice("/.well-known/oauth-protected-resource".length);
-          const resource = `${currentIssuerUrl}${suffix}`;
+          const resource = options.advertisedResource ?? `${currentIssuerUrl}${suffix}`;
           return jsonResponse(200, {
             resource,
             authorization_servers: [currentIssuerUrl],
           requestUrl.pathname === "/.well-known/openid-configuration"
         ) {
           return jsonResponse(200, {
-            issuer: currentIssuerUrl,
+            issuer: options.advertisedIssuer ?? currentIssuerUrl,
             authorization_endpoint: `${currentIssuerUrl}/authorize`,
             token_endpoint: `${currentIssuerUrl}/token`,
             registration_endpoint: `${currentIssuerUrl}/register`,

fix oauth discovery metadata validation

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code