Feat/dpop server conformance fixture - #2631
Draft
gbshankar wants to merge 2 commits into
Draft
Conversation
Implements the server half of SEP-1932: a hand-rolled WebCrypto DPoP proof validator (packages/server/src/server/middleware/dpop.ts) covering RFC 9449 Section 4.3's validation order and RFC 7638 JWK thumbprints across all 10 asymmetric algs (ES256/384/512, RS256/384/512, PS256/384/512, EdDSA) - no new dependency, keeps @modelcontextprotocol/ server runtime-neutral. dpopAuth.ts adds verifyDpopToken/dpopAuthChallengeResponse/ requireDpopAuth mirroring the existing bearerAuth.ts trio, sharing the WWW-Authenticate builder (extracted to authChallenge.ts) so Bearer and DPoP challenges stay consistent. AuthInfo.cnf.jkt (core-internal) lets a verifier surface RFC 9449 Section 6 token binding as a typed field. verifyBearerToken now rejects a DPoP-bound token presented as Bearer (RFC 9449 Section 7.1). packages/middleware/express/src/auth/dpopAuth.ts adapts requireDpopAuth for Express, reconstructing the request URI for htu from req.protocol/host/originalUrl. 77 new unit + integration tests (real generated keys per algorithm, real listening-server HTTP round trips for the Express adapter) - no unit test synthesizes a fake CryptoKey. Independent of the client-side DPoP PR (modelcontextprotocol#2629) - no shared files.
Adds the fixture and launcher for auth/dpop-server-validation (conformance#395, open/unmerged - stacked on the now-merged modelcontextprotocol#394): - src/dpopTestServer.ts: an MCP server gated by @modelcontextprotocol/ express's requireDpopAuth (added in the parent PR), so the referee exercises the real SDK validator over the wire rather than a mock. Its own verifyAccessToken (independent WebCrypto JWT check against DPOP_ISSUER_JWK/DPOP_ISSUER/DPOP_AUDIENCE) is deliberately separate from @modelcontextprotocol/server's dpop.ts so a shared bug can't hide from the test. - scripts/run-dpop-server-conformance.sh: generates a throwaway ES256 issuer keypair, hands the public half to the fixture and the private half to the referee (which mints the tokens it probes with - see resolveIssuer() in conformance's src/scenarios/server/auth/dpop.ts), starts the fixture, runs the scenario, tears down. - test:conformance:server:dpop script (both package.json files). Status: NOT YET RUN end-to-end. auth/dpop-server-validation isn't in the @modelcontextprotocol/conformance version this repo pins (needs conformance#395 released, or a local link per test/conformance/ README.md's "Running Tests Against Local Conformance Repo"). No CI leg is added here for the same reason - intentionally deferred, not an oversight. dpopTestServer.ts typechecks/lints/formats clean; the script itself has not been executed. Stacked on the server DPoP validation PR (this branch is built on top of it, so its commit is included here too).
🦋 Changeset detectedLatest commit: aa5797a The changes in this PR will be included in the next version bump. This PR includes changesets to release 10 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@modelcontextprotocol/client
@modelcontextprotocol/codemod
@modelcontextprotocol/core
@modelcontextprotocol/server
@modelcontextprotocol/server-legacy
@modelcontextprotocol/express
@modelcontextprotocol/fastify
@modelcontextprotocol/hono
@modelcontextprotocol/node
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
How Has This Been Tested?
Breaking Changes
Types of changes
Checklist
Additional context