Extract the authorization-server routes into their own module#472
Merged
Conversation
Move the seven hosted-OAuth-proxy endpoints (RFC 8414 AS metadata x2, RFC 7591 register, and the authorize/consent/callback/token flow) plus their helpers (errorReason, readAuthorizeQuery, serializeAuthorizeQuery, redirectHostOf, setTxnCookie, resolveClient) out of the transport's buildApp into a new mountAuthorizationServer() under src/auth/authorizationServer/, where the rest of the AS code lives (per AGENTS.md). buildApp now calls it with a small deps object. Verbatim move — routes and their per-endpoint 404 guards are unchanged, so behaviour is preserved; the end-to-end proxy suite drives every moved route. streamableHttp.ts drops from 1331 to ~1000 lines. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
alistair3149
marked this pull request as ready for review
July 23, 2026 13:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves the seven hosted-OAuth-proxy endpoints — RFC 8414 AS metadata (×2), RFC 7591 registration, and the
authorize/consent/oauth/callback/tokenflow — plus their helpers (errorReason,readAuthorizeQuery,serializeAuthorizeQuery,redirectHostOf,setTxnCookie,resolveClient) out of the transport'sbuildAppand into a newmountAuthorizationServer()insrc/auth/authorizationServer/router.ts, where the rest of the AS code already lives (per AGENTS.md).buildAppnow calls it with a small deps object.streamableHttp.ts: 1331 → 977 lines. The AS surface is now one 391-line module instead of ~275 lines interleaved with the MCP transport wiring.Behaviour
Verbatim move — every route body and its per-endpoint 404 guard is unchanged, so behaviour is identical. The end-to-end proxy suite drives every moved route (register → authorize → consent → callback → token, plus AS metadata), and it stays green.
Testing
Full gate green:
fmt:check,lint,tsc, and the whole suite (incl. the e2e proxy flow). Pure-internal refactor, so no CHANGELOG/README change per AGENTS.md.🤖 Generated with Claude Code