starred/aryx
1
0
Fork 0
mirror of https://github.com/davidkaya/aryx.git synced 2026-08-25 12:23:57 +02:00
Code Issues 3 Packages Projects Releases 10 Wiki Activity

fix: add origin-only well-known URL fallback for OAuth discovery

Browse Source 
Some MCP servers (e.g., eschat.microsoft.com/mcp) serve their
OAuth Protected Resource Metadata at the origin without the path
suffix. Add a third candidate URL that strips the path, matching
VS Code's discovery behavior.

Tried in order:
1. RFC 9728: {origin}/.well-known/{suffix}{path}
2. Appended: {origin}{path}/.well-known/{suffix}
3. Origin-only: {origin}/.well-known/{suffix}

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
David Kaya
2026-03-28 19:53:25 +01:00
co-authored by Copilot
parent b985a06df3
commit 216b17b2ac
3 changed files with 41 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/main/mcpOAuthDiscovery.test.ts
+23 -1
View File
@@ -1,6 +1,6 @@
import { describe, expect, test } from 'bun:test';
import { buildWellKnownUrl, buildWellKnownUrlFallback } from '@main/services/mcpTokenStore';
import { buildWellKnownUrl, buildWellKnownUrlFallback, buildWellKnownUrlOriginOnly } from '@main/services/mcpTokenStore';
describe('buildWellKnownUrl', () => {
test('inserts well-known segment after origin for URL with path', () => {
@@ -50,3 +50,25 @@ describe('buildWellKnownUrlFallback', () => {
.toBe('https://auth.example.com/.well-known/oauth-authorization-server');
});
});
describe('buildWellKnownUrlOriginOnly', () => {
test('strips path and returns origin-only well-known URL', () => {
expect(buildWellKnownUrlOriginOnly('https://eschat.microsoft.com/mcp', 'oauth-protected-resource'))
.toBe('https://eschat.microsoft.com/.well-known/oauth-protected-resource');
});
test('handles multi-level path', () => {
expect(buildWellKnownUrlOriginOnly('https://example.com/v1/mcp/api', 'oauth-protected-resource'))
.toBe('https://example.com/.well-known/oauth-protected-resource');
});
test('matches RFC URL when base has no path', () => {
expect(buildWellKnownUrlOriginOnly('https://auth.example.com/', 'oauth-authorization-server'))
.toBe('https://auth.example.com/.well-known/oauth-authorization-server');
});
test('handles URL with port', () => {
expect(buildWellKnownUrlOriginOnly('https://mcp.example.com:8443/v1/', 'oauth-protected-resource'))
.toBe('https://mcp.example.com:8443/.well-known/oauth-protected-resource');
});
});