Ground the OAuth metadata doc types in the SDK's - #524
Merged
Conversation
ProtectedResourceDoc and AsMetadataDoc were hand-declared alongside the SDK's RFC 9728 and RFC 8414 types. Alias them to the SDK types instead, narrowed to the fields this server always emits, so the field names and shapes cannot drift from the spec schemas. TokenResponse stays local on purpose: it encodes what our parser actually enforces (expires_in required, token_type tolerated absent), which is the inverse of the SDK's OAuthTokens contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Name all six narrowed AS-metadata fields' advertisements, and fence off the plausible swap of TokenResponse for the SDK's OAuthTokens, whose contract is the inverse of what post() enforces. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the hand-declared
ProtectedResourceDoc(RFC 9728) andAsMetadataDoc(RFC 8414) interfaces with aliases of the SDK'sOAuthProtectedResourceMetadataandOAuthMetadatatypes, narrowed withRequired<Pick<…>>to the fields this server always emits. Field names and shapes can no longer drift from the spec schemas, and a renamed SDK field becomes a compile error here. Types only — the emitted documents are unchanged, and no new dependency is added (both types are exported by@modelcontextprotocol/server).One trade-off to weigh: the SDK schemas are loose objects, so the aliases carry a
[k: string]: unknownindex signature and a typo'd key in a builder literal is no longer an excess-property compile error. The per-field unit tests on both builders still catch a typo in any currently-emitted field at runtime.TokenResponsedeliberately stays local: our parser enforcesexpires_inand tolerates a missingtoken_type, which is the inverse of the SDK'sOAuthTokenscontract on both fields, so adopting it would misstate what the code validates.Verified: full suite and typecheck green; a fixed-input smoke script confirmed the emitted documents are byte-identical between this branch's build and a master-equivalent build.
🤖 Generated with Claude Code