[scenario] authz metadata discovery tests: compatibility with 2025-03-26 spec, prm root, and www-authenticate

examples/clients/typescript/helpers/ConformanceOAuthProvider.ts

@@ -67,7 +67,9 @@ export class ConformanceOAuthProvider implements OAuthClientProvider {
           throw new Error('No auth code in redirect URL');
         }
       } else {
-        throw new Error('No redirect location received');
+        throw new Error(
+          `No redirect location received, from '${authorizationUrl.toString()}'`
+        );
       }
     } catch (error) {
       console.error('Failed to fetch authorization URL:', error);

examples/clients/typescript/helpers/withOAuthRetry.ts

@@ -14,7 +14,6 @@ export const handle401 = async (
   serverUrl: string | URL
 ): Promise<void> => {
   const resourceMetadataUrl = extractResourceMetadataUrl(response);
-
   let result = await auth(provider, {
     serverUrl,
     resourceMetadataUrl,

package.json

@@ -26,7 +26,7 @@
     "dist"
   ],
   "bin": {
-    "conformance": "dist/index.mjs"
+    "conformance": "dist/index.js"
   },
   "devDependencies": {
     "@eslint/js": "^9.8.0",
@@ -43,7 +43,7 @@
     "vitest": "^4.0.5"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.20.1",
+    "@modelcontextprotocol/sdk": "^1.22.0",
     "commander": "^14.0.2",
     "express": "^5.1.0",
     "lefthook": "^2.0.2",

src/scenarios/client/auth/basic-dcr.ts

@@ -9,22 +9,20 @@ export class AuthBasicDCRScenario implements Scenario {
   name = 'auth/basic-dcr';
   description =
     'Tests Basic OAuth flow with DCR, PRM at path-based location, OAuth metadata at root location, and no scopes required';
-  private authServer = new ServerLifecycle(() => this.authBaseUrl);
-  private server = new ServerLifecycle(() => this.baseUrl);
+  private authServer = new ServerLifecycle();
+  private server = new ServerLifecycle();
   private checks: ConformanceCheck[] = [];
-  private baseUrl: string = '';
-  private authBaseUrl: string = '';
 
   async start(): Promise<ScenarioUrls> {
     this.checks = [];
 
-    const authApp = createAuthServer(this.checks, () => this.authBaseUrl);
-    this.authBaseUrl = await this.authServer.start(authApp);
+    const authApp = createAuthServer(this.checks, this.authServer.getUrl);
+    await this.authServer.start(authApp);
 
     const app = createServer(
       this.checks,
-      () => this.baseUrl,
-      () => this.authBaseUrl
+      this.server.getUrl,
+      this.authServer.getUrl
     );
 
     // For this scenario, reject PRM requests at root location since we have the path-based PRM.
@@ -58,9 +56,9 @@ export class AuthBasicDCRScenario implements Scenario {
       }
     );
 
-    this.baseUrl = await this.server.start(app);
+    await this.server.start(app);
 
-    return { serverUrl: `${this.baseUrl}/mcp` };
+    return { serverUrl: `${this.server.getUrl()}/mcp` };
   }
 
   async stop() {