Merge pull request #50 from nestm-dev/codex/oauth-dcr-response-compatibility

fix(client): accept compatible DCR success responses

Author: kauandotnet

.changeset/soft-mice-register.md

@@ -0,0 +1,5 @@
+---
+"@nestm/mcp-client": patch
+---
+
+Accept successful legacy dynamic-registration responses that follow the MCP SDK schema while still rejecting conflicting security-sensitive metadata.

packages/mcp-client/src/oauth/dynamic-registration.ts

@@ -173,10 +173,6 @@ export class McpClientOAuthDynamicRegistration {
 				true,
 			);
 		}
-		if (response.status !== 201) {
-			await discardResponse(response);
-			throw registrationError(McpClientOAuthDynamicRegistrationErrorCode.ResponseInvalid, true);
-		}
 
 		try {
 			const body = await readBoundedJson(response);
@@ -329,22 +325,25 @@ function normalizeRegistrationResult(
 	if (!sameStrings(redirectUris, input.redirectUris)) {
 		throw registrationError(McpClientOAuthDynamicRegistrationErrorCode.ResponseInvalid);
 	}
-	if (value.application_type !== input.applicationType) {
+	if (value.application_type !== undefined && value.application_type !== input.applicationType) {
 		throw registrationError(McpClientOAuthDynamicRegistrationErrorCode.ResponseInvalid);
 	}
-	if (value.token_endpoint_auth_method !== "none") {
+	if (
+		value.token_endpoint_auth_method !== undefined &&
+		value.token_endpoint_auth_method !== "none"
+	) {
 		throw registrationError(McpClientOAuthDynamicRegistrationErrorCode.ResponseInvalid);
 	}
-	const responseTypes = normalizeRemoteStringList(value.response_types, 16);
-	const grantTypes = normalizeRemoteStringList(value.grant_types, 16);
-	if (!responseTypes.includes("code") || !grantTypes.includes("authorization_code")) {
+	const responseTypes = normalizeRemoteOptionalStringList(value.response_types, 16);
+	const grantTypes = normalizeRemoteOptionalStringList(value.grant_types, 16);
+	if (
+		(responseTypes !== undefined && !responseTypes.includes("code")) ||
+		(grantTypes !== undefined && !grantTypes.includes("authorization_code"))
+	) {
 		throw registrationError(McpClientOAuthDynamicRegistrationErrorCode.ResponseInvalid);
 	}
 	const clientIdIssuedAt = normalizeRemoteOptionalTimestamp(value.client_id_issued_at);
 	const clientSecretExpiresAt = normalizeRemoteOptionalTimestamp(value.client_secret_expires_at);
-	if ((clientSecret === undefined) !== (clientSecretExpiresAt === undefined)) {
-		throw registrationError(McpClientOAuthDynamicRegistrationErrorCode.ResponseInvalid);
-	}
 	const registeredScopes = normalizeRemoteOptionalScope(value.scope);
 	return Object.freeze({
 		issuer: input.issuer,
@@ -513,6 +512,13 @@ function normalizeRemoteStringList(value: unknown, maximumCount: number): readon
 	return Object.freeze(result);
 }
 
+function normalizeRemoteOptionalStringList(
+	value: unknown,
+	maximumCount: number,
+): readonly string[] | undefined {
+	return value === undefined ? undefined : normalizeRemoteStringList(value, maximumCount);
+}
+
 function normalizeRemoteOptionalSecret(value: unknown): string | undefined {
 	if (value === undefined) return undefined;
 	return requireRemoteBoundedText(value, MAX_CLIENT_SECRET_LENGTH);

packages/mcp-client/tests/oauth-dynamic-registration.test.ts

@@ -87,6 +87,30 @@ describe("McpClientOAuthDynamicRegistration", () => {
 		expect(Object.isFrozen(result.client.authentication)).toBe(true);
 	});
 
+	it("accepts an SDK-compatible 2xx response with only required echoed metadata", async () => {
+		const registration = new McpClientOAuthDynamicRegistration({
+			fetch: async () =>
+				jsonResponse(
+					{
+						client_id: "minimally-registered-public-client",
+						client_secret: "optional-non-confidential-secret",
+						redirect_uris: [REDIRECT_URI],
+					},
+					200,
+				),
+			endpointPolicy: allowEndpoint,
+		});
+
+		await expect(registerDefault(registration)).resolves.toEqual({
+			issuer: ISSUER_URL,
+			client: {
+				clientId: "minimally-registered-public-client",
+				authentication: { method: "none" },
+			},
+			clientSecret: "optional-non-confidential-secret",
+		});
+	});
+
 	it.each([
 		{ name: "claimed HTTPS", redirectUri: "https://native.example.test/oauth/callback" },
 		{ name: "loopback HTTP", redirectUri: "http://127.0.0.1:9876/oauth/callback" },
@@ -252,10 +276,6 @@ describe("McpClientOAuthDynamicRegistration", () => {
 	});
 
 	it.each([
-		{
-			name: "non-201 successful status",
-			response: () => jsonResponse(registrationResponse(), 200),
-		},
 		{
 			name: "declared oversized body",
 			response: () =>
@@ -290,13 +310,12 @@ describe("McpClientOAuthDynamicRegistration", () => {
 			response: () => jsonResponse(registrationResponse({ client_secret: "x".repeat(8_193) }), 201),
 		},
 		{
-			name: "client secret without an expiry",
+			name: "redirect URI substitution",
 			response: () =>
-				jsonResponse(registrationResponse({ client_secret_expires_at: undefined }), 201),
-		},
-		{
-			name: "client secret expiry without a secret",
-			response: () => jsonResponse(registrationResponse({ client_secret: undefined }), 201),
+				jsonResponse(
+					registrationResponse({ redirect_uris: ["https://evil.example.test/callback"] }),
+					201,
+				),
 		},
 		{
 			name: "confidential authentication substitution",
@@ -310,6 +329,14 @@ describe("McpClientOAuthDynamicRegistration", () => {
 			name: "application type substitution",
 			response: () => jsonResponse(registrationResponse({ application_type: "native" }), 201),
 		},
+		{
+			name: "authorization-code response type removal",
+			response: () => jsonResponse(registrationResponse({ response_types: ["token"] }), 201),
+		},
+		{
+			name: "authorization-code grant removal",
+			response: () => jsonResponse(registrationResponse({ grant_types: ["refresh_token"] }), 201),
+		},
 		{
 			name: "non-NQCHAR registered scope",
 			response: () => jsonResponse(registrationResponse({ scope: 'tools"read' }), 201),