源码快照 @ 2026-09-02 (source-only, 剔除非源码素材)
This commit is contained in:
agent-radar
@@ -0,0 +1,157 @@
|
||||
diff --git a/dist/cjs/client/auth.js b/dist/cjs/client/auth.js
|
||||
index c2e4fa91d26f5336889f6afa416147db75fc4872..a100af7bbf30bbddbd799b291f21917d9455f8fb 100644
|
||||
--- a/dist/cjs/client/auth.js
|
||||
+++ b/dist/cjs/client/auth.js
|
||||
@@ -246,7 +246,33 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
|
||||
// 2. PRM scopes_supported
|
||||
// 3. Client metadata scope (user-configured fallback)
|
||||
// The resolved scope is used consistently for both DCR and the authorization request.
|
||||
- const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
|
||||
+ // Treat scopes_supported as an availability declaration, never as the
|
||||
+ // permission set to request. Combine challenge-required scopes with the
|
||||
+ // client-selected least-privilege set and add offline_access only when the
|
||||
+ // server advertises both that scope and refresh-token support.
|
||||
+ const requiredScopes = scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const selectedScopes = provider.clientMetadata.scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const advertisedScopes = metadata?.scopes_supported ?? resourceMetadata?.scopes_supported;
|
||||
+ if (advertisedScopes) {
|
||||
+ const unsupportedScope = selectedScopes.find(selectedScope => !advertisedScopes.includes(selectedScope));
|
||||
+ if (unsupportedScope) {
|
||||
+ throw new Error(`The selected OAuth scope is not advertised by the authorization server or protected resource: ${unsupportedScope}`);
|
||||
+ }
|
||||
+ }
|
||||
+ const resolvedScopes = [...new Set([...requiredScopes, ...selectedScopes])];
|
||||
+ // Some providers publish the only workable permission set in discovery
|
||||
+ // and omit scope from their 401 challenge. Preserve least-privilege
|
||||
+ // selection when configured, but restore the SDK's advertised fallback
|
||||
+ // when neither the provider challenge nor the admin selected scopes.
|
||||
+ if (resolvedScopes.length === 0 && advertisedScopes) {
|
||||
+ resolvedScopes.push(...new Set(advertisedScopes));
|
||||
+ }
|
||||
+ if (resolvedScopes.includes('offline_access') &&
|
||||
+ !requiredScopes.includes('offline_access') &&
|
||||
+ (!advertisedScopes?.includes('offline_access') || !metadata?.grant_types_supported?.includes('refresh_token'))) {
|
||||
+ resolvedScopes.splice(resolvedScopes.indexOf('offline_access'), 1);
|
||||
+ }
|
||||
+ const resolvedScope = resolvedScopes.length > 0 ? resolvedScopes.join(' ') : undefined;
|
||||
// Handle client registration if needed
|
||||
let clientInformation = await Promise.resolve(provider.clientInformation());
|
||||
if (!clientInformation) {
|
||||
diff --git a/dist/cjs/client/index.d.ts b/dist/cjs/client/index.d.ts
|
||||
index 6f567a193626587a2730b5a49293ca5dfd4181ea..e42d261b43ae1cc60f6de9d014401f69c52b4dc7 100644
|
||||
--- a/dist/cjs/client/index.d.ts
|
||||
+++ b/dist/cjs/client/index.d.ts
|
||||
@@ -20,6 +20,11 @@ export declare function getSupportedElicitationModes(capabilities: ClientCapabil
|
||||
supportsUrlMode: boolean;
|
||||
};
|
||||
export type ClientOptions = ProtocolOptions & {
|
||||
+ /**
|
||||
+ * Protocol version to send in the initialize request.
|
||||
+ * @default LATEST_PROTOCOL_VERSION
|
||||
+ */
|
||||
+ protocolVersion?: string;
|
||||
/**
|
||||
* Capabilities to advertise as being supported by this client.
|
||||
*/
|
||||
diff --git a/dist/cjs/client/index.js b/dist/cjs/client/index.js
|
||||
index 6ac1da14dc7f6211ae70f7711c124b76098816d8..075e4475f51aec1332b8d333a3c9972ac6875bce 100644
|
||||
--- a/dist/cjs/client/index.js
|
||||
+++ b/dist/cjs/client/index.js
|
||||
@@ -109,6 +109,7 @@ class Client extends protocol_js_1.Protocol {
|
||||
this._cachedRequiredTaskTools = new Set();
|
||||
this._listChangedDebounceTimers = new Map();
|
||||
this._capabilities = options?.capabilities ?? {};
|
||||
+ this._protocolVersion = options?.protocolVersion ?? types_js_1.LATEST_PROTOCOL_VERSION;
|
||||
this._jsonSchemaValidator = options?.jsonSchemaValidator ?? new ajv_provider_js_1.AjvJsonSchemaValidator();
|
||||
// Store list changed config for setup after connection (when we know server capabilities)
|
||||
if (options?.listChanged) {
|
||||
@@ -297,7 +298,7 @@ class Client extends protocol_js_1.Protocol {
|
||||
const result = await this.request({
|
||||
method: 'initialize',
|
||||
params: {
|
||||
- protocolVersion: types_js_1.LATEST_PROTOCOL_VERSION,
|
||||
+ protocolVersion: this._protocolVersion,
|
||||
capabilities: this._capabilities,
|
||||
clientInfo: this._clientInfo
|
||||
}
|
||||
diff --git a/dist/esm/client/auth.js b/dist/esm/client/auth.js
|
||||
index e183040fc2bba22ca1ccc784984f3310854403b7..57ef181b35a629f966085a0c0a39064590b597ef 100644
|
||||
--- a/dist/esm/client/auth.js
|
||||
+++ b/dist/esm/client/auth.js
|
||||
@@ -216,12 +216,33 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
|
||||
});
|
||||
}
|
||||
const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
|
||||
- // Apply scope selection strategy (SEP-835):
|
||||
- // 1. WWW-Authenticate scope (passed via `scope` param)
|
||||
- // 2. PRM scopes_supported
|
||||
- // 3. Client metadata scope (user-configured fallback)
|
||||
- // The resolved scope is used consistently for both DCR and the authorization request.
|
||||
- const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
|
||||
+ // Treat scopes_supported as an availability declaration, never as the
|
||||
+ // permission set to request. Combine challenge-required scopes with the
|
||||
+ // client-selected least-privilege set and add offline_access only when the
|
||||
+ // server advertises both that scope and refresh-token support.
|
||||
+ const requiredScopes = scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const selectedScopes = provider.clientMetadata.scope?.split(/\s+/).filter(Boolean) ?? [];
|
||||
+ const advertisedScopes = metadata?.scopes_supported ?? resourceMetadata?.scopes_supported;
|
||||
+ if (advertisedScopes) {
|
||||
+ const unsupportedScope = selectedScopes.find(selectedScope => !advertisedScopes.includes(selectedScope));
|
||||
+ if (unsupportedScope) {
|
||||
+ throw new Error(`The selected OAuth scope is not advertised by the authorization server or protected resource: ${unsupportedScope}`);
|
||||
+ }
|
||||
+ }
|
||||
+ const resolvedScopes = [...new Set([...requiredScopes, ...selectedScopes])];
|
||||
+ // Some providers publish the only workable permission set in discovery
|
||||
+ // and omit scope from their 401 challenge. Preserve least-privilege
|
||||
+ // selection when configured, but restore the SDK's advertised fallback
|
||||
+ // when neither the provider challenge nor the admin selected scopes.
|
||||
+ if (resolvedScopes.length === 0 && advertisedScopes) {
|
||||
+ resolvedScopes.push(...new Set(advertisedScopes));
|
||||
+ }
|
||||
+ if (resolvedScopes.includes('offline_access') &&
|
||||
+ !requiredScopes.includes('offline_access') &&
|
||||
+ (!advertisedScopes?.includes('offline_access') || !metadata?.grant_types_supported?.includes('refresh_token'))) {
|
||||
+ resolvedScopes.splice(resolvedScopes.indexOf('offline_access'), 1);
|
||||
+ }
|
||||
+ const resolvedScope = resolvedScopes.length > 0 ? resolvedScopes.join(' ') : undefined;
|
||||
// Handle client registration if needed
|
||||
let clientInformation = await Promise.resolve(provider.clientInformation());
|
||||
if (!clientInformation) {
|
||||
diff --git a/dist/esm/client/index.d.ts b/dist/esm/client/index.d.ts
|
||||
index 6f567a193626587a2730b5a49293ca5dfd4181ea..e42d261b43ae1cc60f6de9d014401f69c52b4dc7 100644
|
||||
--- a/dist/esm/client/index.d.ts
|
||||
+++ b/dist/esm/client/index.d.ts
|
||||
@@ -20,6 +20,11 @@ export declare function getSupportedElicitationModes(capabilities: ClientCapabil
|
||||
supportsUrlMode: boolean;
|
||||
};
|
||||
export type ClientOptions = ProtocolOptions & {
|
||||
+ /**
|
||||
+ * Protocol version to send in the initialize request.
|
||||
+ * @default LATEST_PROTOCOL_VERSION
|
||||
+ */
|
||||
+ protocolVersion?: string;
|
||||
/**
|
||||
* Capabilities to advertise as being supported by this client.
|
||||
*/
|
||||
diff --git a/dist/esm/client/index.js b/dist/esm/client/index.js
|
||||
index 49b12c6cd918c457420fef7ad5528a9443d1a191..cb70263ab608c9f4a426f72362ec208215bc6ea7 100644
|
||||
--- a/dist/esm/client/index.js
|
||||
+++ b/dist/esm/client/index.js
|
||||
@@ -105,6 +105,7 @@ export class Client extends Protocol {
|
||||
this._cachedRequiredTaskTools = new Set();
|
||||
this._listChangedDebounceTimers = new Map();
|
||||
this._capabilities = options?.capabilities ?? {};
|
||||
+ this._protocolVersion = options?.protocolVersion ?? LATEST_PROTOCOL_VERSION;
|
||||
this._jsonSchemaValidator = options?.jsonSchemaValidator ?? new AjvJsonSchemaValidator();
|
||||
// Store list changed config for setup after connection (when we know server capabilities)
|
||||
if (options?.listChanged) {
|
||||
@@ -293,7 +294,7 @@ export class Client extends Protocol {
|
||||
const result = await this.request({
|
||||
method: 'initialize',
|
||||
params: {
|
||||
- protocolVersion: LATEST_PROTOCOL_VERSION,
|
||||
+ protocolVersion: this._protocolVersion,
|
||||
capabilities: this._capabilities,
|
||||
clientInfo: this._clientInfo
|
||||
}
|
||||
Reference in New Issue
Block a user