[Client] Implement OAuth scope handling (WWW-Authenticate, scopes_supported, step-up, retry-limit, omitted)

Open
#322 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
php
Domain
api, authentication

Research direction

Start with Mcp\Client\Auth\ScopeResolver and AuthCoordinator, then inspect WwwAuthenticateParser and the five named conformance scenarios. Verify each scope-resolution path, including omitted scopes, and confirm that insufficient_scope step-up retries are limited to one; the unit tests and all five baseline scenarios should pass.

Written by the indexing model from the issue text.

Description

auth Client enhancement improves spec compliance

Context

Five baseline scenarios cover scope acquisition strategies the client must follow when constructing authorize/token requests:

  • auth/scope-from-www-authenticate — parse scope="<list>" from WWW-Authenticate insufficient_scope challenges and request those scopes on next authorize.
  • auth/scope-from-scopes-supported — when no challenge hint, fall back to scopes_supported from AS metadata.
  • auth/scope-omitted-when-undefined — when neither source provides scopes, omit the scope parameter entirely (do not send empty string).
  • auth/scope-step-up — on 403/401 with error=insufficient_scope, restart auth flow requesting the augmented scope set.
  • auth/scope-retry-limit — bound step-up retries to one to prevent infinite loops.

Scope

  • Mcp\Client\Auth\ScopeResolver consulted by AuthCoordinator before every authorize/token request.
  • WwwAuthenticateParser returning scope, error, error_description, resource_metadata.
  • Step-up retry counter held in AuthCoordinator state.

Conformance scenarios unblocked

All 5 scope scenarios above.

Dependencies

Blocked by: #316 (401 plumbing), #318 (AS metadata), #319 (Auth Code flow).

Acceptance

  • Unit tests per resolution path.
  • Conformance: 5 baseline scenarios pass.

cc @soyuka

Dominant language
PHP
Stars
1.6k
Forks
173
Avg merge
2d 49m
Merged PRs (30d)
23

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/php-sdk

All issues in modelcontextprotocol/php-sdk

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.