make backwards compatibile

src/client/auth.test.ts

@@ -6,6 +6,8 @@ import {
   registerClient,
   discoverOAuthProtectedResourceMetadata,
   extractResourceMetadataUrl,
+  auth,
+  type OAuthClientProvider,
 } from "./auth.js";
 
 // Mock fetch globally
@@ -79,11 +81,8 @@ describe("OAuth Authorization", () => {
       expect(metadata).toEqual(validMetadata);
       const calls = mockFetch.mock.calls;
       expect(calls.length).toBe(1);
-      const [url, options] = calls[0];
+      const [url] = calls[0];
       expect(url.toString()).toBe("https://resource.example.com/.well-known/oauth-protected-resource");
-      expect(options.headers).toEqual({
-        "MCP-Protocol-Version": "2024-11-05"
-      });
     });
 
     it("returns metadata when first fetch fails but second without MCP header succeeds", async () => {
@@ -668,4 +667,101 @@ describe("OAuth Authorization", () => {
       ).rejects.toThrow("Dynamic client registration failed");
     });
   });
+
+  describe("auth function", () => {
+    const mockProvider: OAuthClientProvider = {
+      get redirectUrl() { return "http://localhost:3000/callback"; },
+      get clientMetadata() {
+        return {
+          redirect_uris: ["http://localhost:3000/callback"],
+          client_name: "Test Client",
+        };
+      },
+      clientInformation: jest.fn(),
+      tokens: jest.fn(),
+      saveTokens: jest.fn(),
+      redirectToAuthorization: jest.fn(),
+      saveCodeVerifier: jest.fn(),
+      codeVerifier: jest.fn(),
+    };
+
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it("falls back to /.well-known/oauth-authorization-server when no protected-resource-metadata", async () => {
+      // Setup: First call to protected resource metadata fails (404)
+      // Second call to auth server metadata succeeds
+      let callCount = 0;
+      mockFetch.mockImplementation((url) => {
+        callCount++;
+
+        const urlString = url.toString();
+
+        if (callCount === 1 && urlString.includes("/.well-known/oauth-protected-resource")) {
+          // First call - protected resource metadata fails with 404
+          return Promise.resolve({
+            ok: false,
+            status: 404,
+          });
+        } else if (callCount === 2 && urlString.includes("/.well-known/oauth-authorization-server")) {
+          // Second call - auth server metadata succeeds
+          return Promise.resolve({
+            ok: true,
+            status: 200,
+            json: async () => ({
+              issuer: "https://auth.example.com",
+              authorization_endpoint: "https://auth.example.com/authorize",
+              token_endpoint: "https://auth.example.com/token",
+              registration_endpoint: "https://auth.example.com/register",
+              response_types_supported: ["code"],
+              code_challenge_methods_supported: ["S256"],
+            }),
+          });
+        } else if (callCount === 3 && urlString.includes("/register")) {
+          // Third call - client registration succeeds
+          return Promise.resolve({
+            ok: true,
+            status: 200,
+            json: async () => ({
+              client_id: "test-client-id",
+              client_secret: "test-client-secret",
+              client_id_issued_at: 1612137600,
+              client_secret_expires_at: 1612224000,
+              redirect_uris: ["http://localhost:3000/callback"],
+              client_name: "Test Client",
+            }),
+          });
+        }
+
+        return Promise.reject(new Error(`Unexpected fetch call: ${urlString}`));
+      });
+
+      // Mock provider methods
+      (mockProvider.clientInformation as jest.Mock).mockResolvedValue(undefined);
+      (mockProvider.tokens as jest.Mock).mockResolvedValue(undefined);
+      mockProvider.saveClientInformation = jest.fn();
+
+      // Call the auth function
+      const result = await auth(mockProvider, {
+        resourceServerUrl: "https://resource.example.com",
+      });
+
+      // Verify the result
+      expect(result).toBe("REDIRECT");
+
+      // Verify the sequence of calls
+      expect(mockFetch).toHaveBeenCalledTimes(3);
+
+      // First call should be to protected resource metadata
+      expect(mockFetch.mock.calls[0][0].toString()).toBe(
+        "https://resource.example.com/.well-known/oauth-protected-resource"
+      );
+
+      // Since protected resource metadata failed, it should fallback to discovering
+      // the auth server metadata from the default location (but the auth function
+      // expects authorization_servers from the resource metadata, so this test
+      // needs to be updated to handle that case properly)
+    });
+  });
 });

src/client/auth.ts

@@ -87,18 +87,24 @@ export async function auth(
   { resourceServerUrl,
     authorizationCode,
     scope,
-  protectedResourceMetadata }: {
+    resourceMetadataUrl
+  }: {
     resourceServerUrl: string | URL;
     authorizationCode?: string;
     scope?: string;
-    protectedResourceMetadata?: OAuthProtectedResourceMetadata }): Promise<AuthResult> {
+    resourceMetadataUrl?: URL }): Promise<AuthResult> {
 
-  let resourceMetadata = protectedResourceMetadata ?? await discoverOAuthProtectedResourceMetadata(resourceServerUrl);
+  let authorizationServerUrl = resourceServerUrl;
+  try {
+    const resourceMetadata = await discoverOAuthProtectedResourceMetadata(
+      resourceMetadataUrl || resourceServerUrl);
 
-  if (resourceMetadata.authorization_servers === undefined || resourceMetadata.authorization_servers.length === 0) {
-    throw new Error("Server does not specify any authorization servers.");
+    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
+      authorizationServerUrl = resourceMetadata.authorization_servers[0];
+    }
+  } catch (error) {
+    console.warn("Could not load OAuth Protected Resource metadata, falling back to /.well-known/oauth-authorization-server", error)
   }
-  const authorizationServerUrl = resourceMetadata.authorization_servers[0];
 
   const metadata = await discoverOAuthMetadata(authorizationServerUrl);
 
@@ -509,4 +515,4 @@ export async function registerClient(
   }
 
   return OAuthClientInformationFullSchema.parse(await response.json());
-}
+}

src/client/sse.test.ts

@@ -668,9 +668,6 @@ describe("SSEClientTransport", () => {
         currentTokens = tokens;
       });
 
-      // Create server that accepts SSE but returns 401 on POST with expired token
-      resourceServer.close();
-
       // Create server that returns 401 for expired token, then accepts new token
       resourceServer.close();
       authServer.close();

src/client/sse.ts

@@ -1,8 +1,7 @@
 import { EventSource, type ErrorEvent, type EventSourceInit } from "eventsource";
 import { Transport } from "../shared/transport.js";
 import { JSONRPCMessage, JSONRPCMessageSchema } from "../types.js";
-import { auth, AuthResult, discoverOAuthProtectedResourceMetadata, extractResourceMetadataUrl, OAuthClientProvider, UnauthorizedError } from "./auth.js";
-import { OAuthProtectedResourceMetadata } from "../shared/auth.js";
+import { auth, AuthResult, extractResourceMetadataUrl, OAuthClientProvider, UnauthorizedError } from "./auth.js";
 
 export class SseError extends Error {
   constructor(
@@ -59,7 +58,7 @@ export class SSEClientTransport implements Transport {
   private _endpoint?: URL;
   private _abortController?: AbortController;
   private _url: URL;
-  private _protectedResourceMetadata: OAuthProtectedResourceMetadata | undefined;
+  private _resourceMetadataUrl?: URL;
   private _eventSourceInit?: EventSourceInit;
   private _requestInit?: RequestInit;
   private _authProvider?: OAuthClientProvider;
@@ -73,7 +72,7 @@ export class SSEClientTransport implements Transport {
     opts?: SSEClientTransportOptions,
   ) {
     this._url = url;
-    this._protectedResourceMetadata = undefined;
+    this._resourceMetadataUrl = undefined;
     this._eventSourceInit = opts?.eventSourceInit;
     this._requestInit = opts?.requestInit;
     this._authProvider = opts?.authProvider;
@@ -86,7 +85,7 @@ export class SSEClientTransport implements Transport {
 
     let result: AuthResult;
     try {
-      result = await auth(this._authProvider, { resourceServerUrl: this._url, protectedResourceMetadata: this._protectedResourceMetadata });
+      result = await auth(this._authProvider, { resourceServerUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
     } catch (error) {
       this.onerror?.(error as Error);
       throw error;
@@ -196,7 +195,7 @@ export class SSEClientTransport implements Transport {
       throw new UnauthorizedError("No auth provider");
     }
 
-    const result = await auth(this._authProvider, { resourceServerUrl: this._url, authorizationCode, protectedResourceMetadata: this._protectedResourceMetadata });
+    const result = await auth(this._authProvider, { resourceServerUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl });
     if (result !== "AUTHORIZED") {
       throw new UnauthorizedError("Failed to authorize");
     }
@@ -229,12 +228,9 @@ export class SSEClientTransport implements Transport {
       if (!response.ok) {
         if (response.status === 401 && this._authProvider) {
 
-          const resourceMetadataUrl = extractResourceMetadataUrl(response);
-          this._protectedResourceMetadata = await discoverOAuthProtectedResourceMetadata(this._url, {
-            resourceMetadataUrl: resourceMetadataUrl
-          })
+          this._resourceMetadataUrl = extractResourceMetadataUrl(response);
 
-          const result = await auth(this._authProvider, { resourceServerUrl: this._url, protectedResourceMetadata: this._protectedResourceMetadata });
+          const result = await auth(this._authProvider, { resourceServerUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
           if (result !== "AUTHORIZED") {
             throw new UnauthorizedError();
           }

src/client/streamableHttp.ts

@@ -1,7 +1,6 @@
-import { OAuthProtectedResourceMetadata } from "src/shared/auth.js";
 import { Transport } from "../shared/transport.js";
 import { isInitializedNotification, isJSONRPCRequest, isJSONRPCResponse, JSONRPCMessage, JSONRPCMessageSchema } from "../types.js";
-import { auth, AuthResult, discoverOAuthProtectedResourceMetadata, extractResourceMetadataUrl, OAuthClientProvider, UnauthorizedError } from "./auth.js";
+import { auth, AuthResult, extractResourceMetadataUrl, OAuthClientProvider, UnauthorizedError } from "./auth.js";
 import { EventSourceParserStream } from "eventsource-parser/stream";
 
 // Default reconnection options for StreamableHTTP connections
@@ -120,7 +119,7 @@ export type StreamableHTTPClientTransportOptions = {
 export class StreamableHTTPClientTransport implements Transport {
   private _abortController?: AbortController;
   private _url: URL;
-  private _protectedResourceMetadata: OAuthProtectedResourceMetadata | undefined;
+  private _resourceMetadataUrl?: URL;
   private _requestInit?: RequestInit;
   private _authProvider?: OAuthClientProvider;
   private _sessionId?: string;
@@ -135,7 +134,7 @@ export class StreamableHTTPClientTransport implements Transport {
     opts?: StreamableHTTPClientTransportOptions,
   ) {
     this._url = url;
-    this._protectedResourceMetadata = undefined;
+    this._resourceMetadataUrl = undefined;
     this._requestInit = opts?.requestInit;
     this._authProvider = opts?.authProvider;
     this._sessionId = opts?.sessionId;
@@ -149,7 +148,7 @@ export class StreamableHTTPClientTransport implements Transport {
 
     let result: AuthResult;
     try {
-      result = await auth(this._authProvider, { resourceServerUrl: this._url, protectedResourceMetadata: this._protectedResourceMetadata });
+      result = await auth(this._authProvider, { resourceServerUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
     } catch (error) {
       this.onerror?.(error as Error);
       throw error;
@@ -359,7 +358,7 @@ export class StreamableHTTPClientTransport implements Transport {
       throw new UnauthorizedError("No auth provider");
     }
 
-    const result = await auth(this._authProvider, { resourceServerUrl: this._url, authorizationCode, protectedResourceMetadata: this._protectedResourceMetadata });
+    const result = await auth(this._authProvider, { resourceServerUrl: this._url, authorizationCode, resourceMetadataUrl: this._resourceMetadataUrl });
     if (result !== "AUTHORIZED") {
       throw new UnauthorizedError("Failed to authorize");
     }
@@ -405,12 +404,9 @@ export class StreamableHTTPClientTransport implements Transport {
       if (!response.ok) {
         if (response.status === 401 && this._authProvider) {
 
-          const resourceMetadataUrl = extractResourceMetadataUrl(response);
-          this._protectedResourceMetadata = await discoverOAuthProtectedResourceMetadata(this._url, {
-            resourceMetadataUrl: resourceMetadataUrl
-          })
+          this._resourceMetadataUrl = extractResourceMetadataUrl(response);
 
-          const result = await auth(this._authProvider, { resourceServerUrl: this._url, protectedResourceMetadata: this._protectedResourceMetadata });
+          const result = await auth(this._authProvider, { resourceServerUrl: this._url, resourceMetadataUrl: this._resourceMetadataUrl });
           if (result !== "AUTHORIZED") {
             throw new UnauthorizedError();
           }