@@ -907,54 +907,6 @@ describe("OAuth Authorization", () => {
907
907
) ;
908
908
} ) ;
909
909
910
- it ( "canonicalizes resource URI by removing fragment" , async ( ) => {
911
- // Mock successful metadata discovery
912
- mockFetch . mockImplementation ( ( url ) => {
913
- const urlString = url . toString ( ) ;
914
- if ( urlString . includes ( "/.well-known/oauth-authorization-server" ) ) {
915
- return Promise . resolve ( {
916
- ok : true ,
917
- status : 200 ,
918
- json : async ( ) => ( {
919
- issuer : "https://auth.example.com" ,
920
- authorization_endpoint : "https://auth.example.com/authorize" ,
921
- token_endpoint : "https://auth.example.com/token" ,
922
- response_types_supported : [ "code" ] ,
923
- code_challenge_methods_supported : [ "S256" ] ,
924
- } ) ,
925
- } ) ;
926
- }
927
- return Promise . resolve ( { ok : false , status : 404 } ) ;
928
- } ) ;
929
-
930
- // Mock provider methods
931
- ( mockProvider . clientInformation as jest . Mock ) . mockResolvedValue ( {
932
- client_id : "test-client" ,
933
- client_secret : "test-secret" ,
934
- } ) ;
935
- ( mockProvider . tokens as jest . Mock ) . mockResolvedValue ( undefined ) ;
936
- ( mockProvider . saveCodeVerifier as jest . Mock ) . mockResolvedValue ( undefined ) ;
937
- ( mockProvider . redirectToAuthorization as jest . Mock ) . mockResolvedValue ( undefined ) ;
938
-
939
- // Call the auth function with a resource that has a fragment
940
- const result = await auth ( mockProvider , {
941
- serverUrl : "https://api.example.com/mcp-server#fragment" ,
942
- } ) ;
943
-
944
- expect ( result ) . toBe ( "REDIRECT" ) ;
945
-
946
- // Verify redirectToAuthorization was called with the canonicalized resource
947
- expect ( mockProvider . redirectToAuthorization ) . toHaveBeenCalledWith (
948
- expect . objectContaining ( {
949
- searchParams : expect . any ( URLSearchParams ) ,
950
- } )
951
- ) ;
952
-
953
- const redirectCall = ( mockProvider . redirectToAuthorization as jest . Mock ) . mock . calls [ 0 ] ;
954
- const authUrl : URL = redirectCall [ 0 ] ;
955
- expect ( authUrl . searchParams . get ( "resource" ) ) . toBe ( "https://api.example.com/mcp-server" ) ;
956
- } ) ;
957
-
958
910
it ( "passes resource parameter through authorization flow" , async ( ) => {
959
911
// Mock successful metadata discovery
960
912
mockFetch . mockImplementation ( ( url ) => {
@@ -1125,91 +1077,6 @@ describe("OAuth Authorization", () => {
1125
1077
expect ( body . get ( "refresh_token" ) ) . toBe ( "refresh123" ) ;
1126
1078
} ) ;
1127
1079
1128
- it ( "handles derived resource parameter from serverUrl" , async ( ) => {
1129
- // Mock successful metadata discovery
1130
- mockFetch . mockImplementation ( ( url ) => {
1131
- const urlString = url . toString ( ) ;
1132
- if ( urlString . includes ( "/.well-known/oauth-authorization-server" ) ) {
1133
- return Promise . resolve ( {
1134
- ok : true ,
1135
- status : 200 ,
1136
- json : async ( ) => ( {
1137
- issuer : "https://auth.example.com" ,
1138
- authorization_endpoint : "https://auth.example.com/authorize" ,
1139
- token_endpoint : "https://auth.example.com/token" ,
1140
- response_types_supported : [ "code" ] ,
1141
- code_challenge_methods_supported : [ "S256" ] ,
1142
- } ) ,
1143
- } ) ;
1144
- }
1145
- return Promise . resolve ( { ok : false , status : 404 } ) ;
1146
- } ) ;
1147
-
1148
- // Mock provider methods
1149
- ( mockProvider . clientInformation as jest . Mock ) . mockResolvedValue ( {
1150
- client_id : "test-client" ,
1151
- client_secret : "test-secret" ,
1152
- } ) ;
1153
- ( mockProvider . tokens as jest . Mock ) . mockResolvedValue ( undefined ) ;
1154
- ( mockProvider . saveCodeVerifier as jest . Mock ) . mockResolvedValue ( undefined ) ;
1155
- ( mockProvider . redirectToAuthorization as jest . Mock ) . mockResolvedValue ( undefined ) ;
1156
-
1157
- // Call auth with just serverUrl (resource is derived from it)
1158
- const result = await auth ( mockProvider , {
1159
- serverUrl : "https://api.example.com/mcp-server" ,
1160
- } ) ;
1161
-
1162
- expect ( result ) . toBe ( "REDIRECT" ) ;
1163
-
1164
- // Verify that resource parameter is always included (derived from serverUrl)
1165
- const redirectCall = ( mockProvider . redirectToAuthorization as jest . Mock ) . mock . calls [ 0 ] ;
1166
- const authUrl : URL = redirectCall [ 0 ] ;
1167
- expect ( authUrl . searchParams . has ( "resource" ) ) . toBe ( true ) ;
1168
- expect ( authUrl . searchParams . get ( "resource" ) ) . toBe ( "https://api.example.com/mcp-server" ) ;
1169
- } ) ;
1170
-
1171
- it ( "handles resource with multiple fragments" , async ( ) => {
1172
- // Mock successful metadata discovery
1173
- mockFetch . mockImplementation ( ( url ) => {
1174
- const urlString = url . toString ( ) ;
1175
- if ( urlString . includes ( "/.well-known/oauth-authorization-server" ) ) {
1176
- return Promise . resolve ( {
1177
- ok : true ,
1178
- status : 200 ,
1179
- json : async ( ) => ( {
1180
- issuer : "https://auth.example.com" ,
1181
- authorization_endpoint : "https://auth.example.com/authorize" ,
1182
- token_endpoint : "https://auth.example.com/token" ,
1183
- response_types_supported : [ "code" ] ,
1184
- code_challenge_methods_supported : [ "S256" ] ,
1185
- } ) ,
1186
- } ) ;
1187
- }
1188
- return Promise . resolve ( { ok : false , status : 404 } ) ;
1189
- } ) ;
1190
-
1191
- // Mock provider methods
1192
- ( mockProvider . clientInformation as jest . Mock ) . mockResolvedValue ( {
1193
- client_id : "test-client" ,
1194
- client_secret : "test-secret" ,
1195
- } ) ;
1196
- ( mockProvider . tokens as jest . Mock ) . mockResolvedValue ( undefined ) ;
1197
- ( mockProvider . saveCodeVerifier as jest . Mock ) . mockResolvedValue ( undefined ) ;
1198
- ( mockProvider . redirectToAuthorization as jest . Mock ) . mockResolvedValue ( undefined ) ;
1199
-
1200
- // Call auth with resource containing multiple # symbols
1201
- const result = await auth ( mockProvider , {
1202
- serverUrl : "https://api.example.com/mcp-server#fragment#another" ,
1203
- } ) ;
1204
-
1205
- expect ( result ) . toBe ( "REDIRECT" ) ;
1206
-
1207
- // Verify the resource is properly canonicalized (everything after first # removed)
1208
- const redirectCall = ( mockProvider . redirectToAuthorization as jest . Mock ) . mock . calls [ 0 ] ;
1209
- const authUrl : URL = redirectCall [ 0 ] ;
1210
- expect ( authUrl . searchParams . get ( "resource" ) ) . toBe ( "https://api.example.com/mcp-server" ) ;
1211
- } ) ;
1212
-
1213
1080
it ( "verifies resource parameter distinguishes between different paths on same domain" , async ( ) => {
1214
1081
// Mock successful metadata discovery
1215
1082
mockFetch . mockImplementation ( ( url ) => {
0 commit comments