Skip to content

Conversation

@bettercallsaulj
Copy link
Collaborator

No description provided.

RahulHere added 30 commits November 24, 2025 22:36
- Created directory structure for auth module following existing MCP patterns
- Added include/mcp/auth/ with placeholder headers for all major components
- Added src/auth/ directory for implementations
- Added tests/auth/ directory for unit tests
- Created placeholder headers with proper include guards:
  - auth.h: Main authentication module interface
  - jwt_validator.h: JWT validation interface
  - jwks_client.h: JWKS client for key management
  - scope_validator.h: OAuth scope validation
  - metadata_generator.h: OAuth metadata generation
  - http_client.h: HTTP client for external calls
  - memory_cache.h: Caching infrastructure
  - auth_c_api.h: C API for FFI bindings
- All headers follow existing mcp-cpp-sdk naming conventions
- Headers use consistent namespace structure (mcp::auth)
- Created comprehensive auth_types.h with all fundamental types
- Defined FFI-compatible handle types (mcp_auth_handle_t, mcp_token_payload_handle_t)
- Implemented AuthErrorCode enum with comprehensive error codes
- Added TokenValidationOptions structure for flexible token validation
- Created TokenPayload structure with standard JWT and custom MCP claims
- Defined OAuthMetadata structure following RFC 8414 specifications
- Implemented AuthConfig structure for client configuration
- Added ValidationResult structure for token validation results
- Created ScopeValidationMode enum for different scope checking strategies
- Added WWWAuthenticateParams for OAuth error responses
- Implemented comprehensive unit tests validating:
  - Handle type sizes for FFI compatibility
  - Error code uniqueness and values
  - Default initialization of all structures
  - Time point handling in token payloads
  - Structure size consistency for ABI stability
- Integrated auth tests into CMake build system
- All tests pass successfully with proper type safety
- Created generic templated MemoryCache class with LRU eviction policy
- Implemented thread-safe operations using mutex locks
- Added TTL (time-to-live) support with automatic expiration
- Key features:
  - LRU eviction when cache reaches capacity
  - Per-entry TTL with optional custom expiration times
  - Thread-safe put, get, remove, and clear operations
  - Automatic cleanup of expired entries
  - Cache statistics and monitoring capabilities
- Comprehensive unit tests covering:
  - Basic insertion and retrieval
  - TTL expiration behavior
  - LRU eviction policy correctness
  - Thread safety with concurrent operations
  - Performance with large caches (10K entries)
  - Complex key and value types
- Used mcp::optional for C++14 compatibility
- All 13 tests pass successfully
- Cache handles up to 10,000 operations/second per thread
- Add HttpClient class with async/sync request methods
- Support for multiple HTTP methods (GET, POST, PUT, DELETE, etc.)
- SSL certificate verification with custom CA bundle support
- Connection pooling statistics tracking
- Request timeout and redirect handling
- Response header parsing and latency measurement
- Thread-safe implementation using std::thread for async
- Comprehensive unit tests using httpbin.org
- C++14 compatible with explicit constructors
- Add JwksClient class for fetching JSON Web Key Sets from JWKS endpoints
- Support for RSA and EC key types with validation
- Memory cache integration with configurable TTL and cache-control header parsing
- Automatic key refresh with background thread support
- Key rotation handling with refresh-before-expiry configuration
- Cache statistics tracking (hits, misses, refresh count)
- JSON parsing using nlohmann/json library
- Find key by ID functionality with O(1) cache lookup
- Comprehensive unit tests for parsing, caching, and validation
- Define JwtHeader and JwtClaims structures for JWT components
- Add JwtValidationConfig for configurable validation rules
- Design JwtValidationResult with detailed validation status
- Support for standard JWT claims (iss, sub, aud, exp, nbf, iat)
- OAuth 2.1 specific claims support (scope, client_id)
- Base64URL encoding/decoding utilities
- JWKS client and scope validator integration points
- Validation statistics tracking
- Interface for RS256 and ES256 algorithm support
- Define OAuthMetadata structure per RFC 8414 specification
- Support for authorization server metadata fields
- WWW-Authenticate header parameter structures
- OAuth error response generation utilities
- Builder pattern for metadata construction
- OAuth 2.1 specific fields (PKCE support)
- Well-known metadata endpoint path generation
- RFC 8414 compliance validation
- JSON serialization for metadata and errors
- Standard OAuth error types (invalid_token, insufficient_scope, etc.)
- Opaque handle types for FFI safety (client, payload, options, metadata)
- Comprehensive error codes matching authentication failure modes
- Library initialization and shutdown functions
- Client lifecycle management (create, destroy, configure)
- Token validation with configurable options
- Token payload extraction and claim access
- OAuth metadata and WWW-Authenticate header generation
- Memory management with clear ownership semantics
- Utility functions for scope validation
- Complete doxygen documentation for all functions
- FFI-compatible signatures following mcp-cpp-sdk patterns
- Library initialization and shutdown with thread safety
- Client lifecycle management with opaque handle pattern
- Validation options creation and configuration
- Token validation stub implementation
- Token payload extraction and claim access functions
- WWW-Authenticate header generation utility
- Memory management with duplicate_string for FFI safety
- Thread-local error message storage
- Error code to string conversion
- Scope validation utility function
- All C++ exceptions caught and converted to error codes
- Follows existing mcp-cpp-sdk C API patterns
- Auth source files successfully integrated into CMakeLists.txt
- libcurl dependency already configured in build system
- Auth C API symbols properly exported in shared library
- Build system successfully compiles all auth components
- Compatible with existing mcp-cpp-sdk build configurations
- Define AuthErrorCode enum matching C API error codes
- Create interfaces for ValidationResult, TokenPayload, and ValidationOptions
- Add OAuth 2.0 metadata types per RFC 8414
- Define JSON Web Key and JWKS response types
- Implement type guards for error checking
- Add comprehensive JSDoc documentation
- Create unit tests for type compatibility
- Follow existing mcp-cpp-sdk TypeScript patterns
- Implement AuthFFILibrary class following existing pattern
- Bind all authentication C API functions using koffi
- Define opaque handle types for FFI safety
- Support library initialization and shutdown
- Implement client lifecycle management bindings
- Add token validation and payload extraction bindings
- Include memory management functions
- Provide singleton instance pattern
- Error handling for missing library
- Compatible with existing mcp-ffi-bindings loading mechanism
- Create McpAuthClient class with async/await interface
- Implement token validation with configurable options
- Add payload extraction with automatic memory cleanup
- Provide scope validation helpers
- Generate WWW-Authenticate headers
- Handle FFI memory management transparently
- Include error handling with AuthError class
- Provide convenience functions for one-off operations
- Follow existing mcp-cpp-sdk TypeScript API patterns
- Ensure proper resource cleanup in all code paths
- Update package.json with auth exports and keywords
- Add subpath export for @mcp/filter-sdk/auth
- Create auth.ts module entry point
- Export auth namespace from main index
- Add auth-specific test script
- Create integration tests for auth module
- Ensure compatibility with existing filter SDK
- Support both namespace and direct imports
- Add comprehensive JWT validation example
- Demonstrate authentication client configuration
- Show token validation with scope checking
- Include payload extraction functionality
- Add error handling scenarios demonstration
- Show WWW-Authenticate header generation
- Include utility functions for error code handling
- Follow existing example patterns in project
- Implement MCP server with JWT authentication middleware
- Add scope-based authorization for different operations
- Include OAuth metadata discovery endpoint
- Demonstrate token extraction from request metadata
- Show protected vs public resource handling
- Implement tool authorization with scope requirements
- Add graceful error handling with WWW-Authenticate headers
- Include usage examples and documentation
- Show real-world authentication patterns
- Integrate with existing MCP SDK server framework
- Add C++ JWT validation performance benchmarks
- Implement single-threaded and concurrent validation tests
- Add memory usage measurements and leak detection
- Create TypeScript FFI overhead performance tests
- Measure client lifecycle and memory characteristics
- Add cache performance benchmarks with LRU metrics
- Include stress testing with sustained load scenarios
- Create comprehensive performance documentation
- Establish baseline measurements and targets
- Document optimization guidelines and best practices
- Add troubleshooting guide for performance issues
- Include production scaling recommendations
- Implement AuthenticatedMcpServer using StreamableHTTPServerTransport
- Add complete C API authentication implementation (mcp_c_auth_api.cc)
- Fix FFI struct marshalling for token validation results
- Support OAuth 2.1 metadata endpoints and client registration proxy
- Add comprehensive scope management matching gopher-auth-sdk-nodejs
- Enable per-session transport management for multi-client support
- Configure library search paths for local SDK exports

Key improvements:
- Reduced server implementation from ~150 to 23 lines of code
- Fixed token validation struct passing between C and JavaScript
- Added support for all OpenID Connect standard scopes
- Proper extraction of MCP scopes from tool configurations
- Add base64url_decode function for decoding JWT components
- Implement parse_jwt_header to extract alg and kid fields
- Add split_jwt function to separate token into header/payload/signature
- Update mcp_auth_validate_token to use real JWT parsing
- Cache parsed alg and kid in mcp_auth_client struct
- Validate RS256, RS384, RS512 algorithms
- Return appropriate error codes for malformed tokens
- Add JSON extraction utilities for strings and numbers
- Parse standard JWT claims: sub, iss, aud, exp, iat, nbf
- Handle both string and array audience claim formats
- Extract OAuth 2.0 scope claim (supports both 'scope' and 'scopes')
- Parse custom claims: email, name, organization_id, server_id
- Validate required JWT fields (sub, iss, exp)
- Store additional claims in claims map for future use
- Add RSA signature verification using OpenSSL EVP API
- Support RS256, RS384, and RS512 algorithms
- Verify JWT signature against base64url encoded header.payload
- Add proper error handling for invalid signatures and keys
- Link OpenSSL libraries (SSL and Crypto) in CMakeLists.txt
- Handle signature decoding from base64url format
- Return appropriate error codes for verification failures

The signature verification is fully implemented but requires public key from JWKS (next task).
- Add HTTP client using libcurl to fetch JWKS from configured URI
- Parse JWKS JSON response to extract RSA public keys
- Convert JWK format (n, e) to PEM format public keys using OpenSSL
- Support RS256, RS384, and RS512 signing keys
- Handle network errors and HTTP status codes properly
- Add timeout and SSL certificate verification
- Filter keys by type (RSA) and use (sig)
- Link libcurl library in CMakeLists.txt

JWKS fetching enables dynamic key retrieval for JWT signature verification.
- Add cache validation with configurable TTL (default 3600 seconds)
- Implement automatic cache refresh when expired
- Check cache timestamp before fetching new keys
- Add cache invalidation mechanism for unknown key IDs
- Thread-safe cache operations using mutex
- Log cached keys for debugging
- Avoid redundant JWKS fetches within cache duration

Caching reduces network overhead and improves token validation performance.
- Match JWT kid header with JWKS keys for exact selection
- Support key rotation by refreshing cache on unknown kid
- Try all available keys when no kid is specified in JWT
- Filter keys by algorithm compatibility
- Auto-refresh JWKS when verification fails with cached keys
- Log successful key matches for debugging
- Return specific error when no matching key found

Key selection enables proper multi-key support and automatic key rotation handling.
- Validate exp claim against current time with clock skew
- Check nbf (not before) claim if present
- Use configurable clock skew (default 60 seconds)
- Return MCP_AUTH_ERROR_EXPIRED_TOKEN for expired tokens
- Handle timezone differences with clock skew tolerance
- Convert timestamps properly to seconds for comparison
- Ignore invalid nbf values gracefully

Expiration checking ensures tokens cannot be used beyond their validity period.
- Compare JWT iss claim with configured issuer
- Handle different issuer URL formats (with/without trailing slash)
- Support both exact match and normalized comparison
- Return MCP_AUTH_ERROR_INVALID_ISSUER for mismatched issuers
- Make issuer validation mandatory when issuer is configured
- Provide detailed error messages with expected vs actual values

Issuer validation ensures tokens are from the expected authorization server.
- Verify JWT aud claim when audience is specified in options
- Check for missing audience claim in token
- Compare expected audience with token audience value
- Support both string and array audience formats (parsed as string)
- Return MCP_AUTH_ERROR_INVALID_AUDIENCE for mismatches
- Make audience validation optional (only when specified)
- Provide detailed error messages for debugging

Audience validation ensures tokens are intended for this resource server.
- Parse space-separated scope strings from JWT
- Check if all required scopes are present in token
- Support hierarchical scope matching (e.g., mcp:weather includes mcp:weather:read)
- Use efficient set-based lookup for scope comparison
- Return MCP_AUTH_ERROR_INSUFFICIENT_SCOPE when scopes missing
- Make scope validation optional (only when required scopes specified)

Scope validation ensures proper authorization for protected resources.
- Create configurable HTTP client with timeout and SSL options
- Add connection and request timeout settings (default 5s and 10s)
- Implement proper HTTPS certificate validation
- Set appropriate headers (Accept, Cache-Control, User-Agent)
- Handle redirects with maximum limit (3 redirects)
- Restrict protocols to HTTPS only for security
- Enable TCP keep-alive for connection stability
- Add RAII cleanup for curl handles and headers
- Provide detailed error messages for common failures
- Log successful requests with status codes

Enhanced HTTP client provides reliable and secure JWKS fetching.
RahulHere added 12 commits December 10, 2025 02:14
- Updated FFI bindings to use correct mcp_auth_validate_token signature with 4 parameters
- Added proper validation result structure with valid, error_code, and error_message fields
- Fixed ES module imports by adding .js extensions
- Normalized error messages for consistent test behavior
- Removed debug logging and cleaned up code
- All tests pass with 100% success rate

The TypeScript SDK now properly integrates with the standalone C++11 auth library
(libgopher_mcp_auth.0.1.0.dylib, 155 KB) instead of the full SDK library.
This commit introduces a complete standalone authentication library that:
- Extracts auth features from the MCP C++ SDK into a lightweight library
- Uses only C++11 features for broad compatibility
- Reduces library size from 13 MB to 155 KB (99% reduction)
- Maintains full authentication functionality

## Key Components Added:

### Build System
- `CMakeLists.txt` for standalone library build
- `CMakeLists_cpp11.txt` for C++11-only compilation
- Build scripts for library and tests
- CMake config for library installation

### Source Code
- `cpp11_compat.h` - Compatibility layer for C++11
- Modified auth implementation files for C++11 compatibility
- Optimized crypto and network components
- README with comprehensive documentation

### Testing
- Standalone test configurations
- Test runner script with detailed output
- Mock mode support for integration tests
- All 62 tests passing (100% success rate)

### Documentation
- AUTH_LIBRARY_CPP11.md - Implementation details
- AUTH_LIBRARY_STANDALONE.md - Usage guide
- AUTH_TESTS_STANDALONE_RESULTS.md - Test results
- STANDALONE_AUTH_LIBRARY_SUMMARY.md - Project overview

## Results:
- Library size: 155 KB (vs 13 MB full SDK)
- All auth features preserved
- C++11 compatible
- No external dependencies beyond standard library
- Successfully integrated with gopher-auth-example-server
- Add Docker configuration for Linux x86_64 builds (Ubuntu 20.04)
- Add native build script for macOS x86_64 (10.14+ compatibility)
- Fix missing includes in auth source files (vector, cstring)
- Successfully build 161KB macOS and 180KB Linux libraries

Both libraries maintain C++11 compatibility and minimal dependencies.
- Add cross-platform verification app (verify_auth.cc)
- Tests dynamic library loading and basic operations
- Add platform-specific build scripts for verification
- Add Windows cross-compilation script using MinGW
- Create comprehensive verification documentation

Successfully tested on macOS x64 (161KB) and Linux x64 (180KB).
- Document dyld load command compatibility issue
- Provide C version for maximum compatibility
- Include compilation instructions with proper flags
- Add troubleshooting for library path issues

The library itself works on macOS 10.14+, only the verification
tool needed compatibility fixes.
- Simplified output to only libgopher_mcp_auth.0.1.0.dylib and verify_auth
- Move support files to docker/mac-x64/ directory
- Add automatic symlink creation for library compatibility
- Include headers and helper scripts in support directory
- Clean build directory after successful build

Output is now minimal and focused on essential files only
…bility (#130)

- Use C version (verify_auth_simple.c) as main verify_auth to avoid dyld loader issues
- C version avoids LC_DYLD_CHAINED_FIXUPS that aren't supported on macOS 10.14.6
- Library itself remains compatible, only verification tool changed
- Successfully tested on build system and ready for macOS 10.14.6
…sues (#130)

- Replace verify_auth with ultra-minimal C89 version
- Use conservative compiler flags to avoid modern features
- Strip binary and remove extended attributes
- Only depends on libSystem.B.dylib (no C++ runtime)
- Should avoid "Killed: 9" error on macOS 10.14.6
- Switch to using the pre-built verify_auth_c that was tested and works
- This avoids the "Killed: 9" issue on macOS 10.14.6
- The binary only depends on libSystem.B.dylib
- Build script now copies the working binary instead of recompiling
- Add verify_auth.cc to src/auth for CMake build
- Update CMakeLists.txt to build verify_auth executable
- Use same compiler settings and macOS 10.14 target as library
- Build script now copies CMake-built verify_auth
- Ensures consistency between library and verification tool
- Build verify_auth from the original source file that worked before
- Use same compiler flags: -std=c++11 -stdlib=libc++ -mmacosx-version-min=10.14
- This is the exact source that produced the working binaries
- Comprehensive test output with all library functions
- **macOS Build**: Simplified build with verification tools for macOS 10.14+ compatibility
  - Multiple verification tools (simple, full, safe) for different testing scenarios
  - Proper dylib versioning and linking

- **Linux Build**: Docker-based build for Ubuntu 20.04
  - Consistent build environment using Docker containers
  - Verification tool with dlinfo support

- **Windows Build**: Cross-compilation using MinGW-w64
  - Windows native implementation using CryptoAPI and WinHTTP
  - No external OpenSSL/CURL dependencies required
  - Real cryptography and networking functionality

All platforms now have:
- Organized directory structure (docker/platform-arch/)
- Verification tools to test library loading and functionality
- Consistent build scripts with colored output
- Minimal external dependencies
@github-actions
Copy link

❌ Code Formatting Check Failed

Some files in this PR are not properly formatted according to the project's clang-format rules.

To fix this issue:

make format

Then commit and push the changes.

@bettercallsaulj
Copy link
Collaborator Author

Sample: libgopher_mcp_auth.zip

RahulHere added 16 commits December 12, 2025 00:33
- Update auth-adapter/express-adapter.ts with latest OAuth integration features
  - Dynamic redirect_uri handling for MCP Inspector
  - Configurable scopes support
  - PKCE code verifier handling
  - Fixed import paths for auth-adapter directory location
- Add sdk-index.ts to export SDK components
- Update session-manager.ts with minor fixes

The Express adapter provides clean separation between OAuth helper
and Express-specific implementation, with proper support for
MCP Inspector's dynamic port allocation.
Add auth-adapter directory to TypeScript compilation includes
to ensure the express-adapter.ts file is properly compiled.
- Update build-mac-x64.sh to include TypeScript SDK and tests
- Create typescript-test.ts for verifying library works with Node.js
- Add package.json and tsconfig.json for TypeScript test environment
- Organize output into typescript/sdk and typescript/tests directories
- Include run-test.sh script for easy test execution

The build now produces:
  - C verification (verify_auth)
  - TypeScript SDK files (typescript/sdk/)
  - TypeScript test suite (typescript/tests/)

This ensures the library can be used from both C and TypeScript/Node.js
environments on macOS.
Update build-mac-x64.sh to copy only authentication-related TypeScript
files instead of all SDK files. This keeps the output focused on the
auth library functionality.

Files included:
- auth-types.ts
- auth.ts
- mcp-auth-api.ts
- mcp-auth-ffi-bindings.ts
- oauth-helper.ts
- session-manager.ts
- sdk-index.ts
- express-adapter.ts
- Update function names to match actual exported symbols (mcp_auth_* not gopher_mcp_auth_*)
- Skip token validation to avoid network calls in tests
- Add error handling for cleanup functions
- Fix library path in fallback test

The TypeScript test now correctly verifies:
- Library can be loaded
- Version can be retrieved
- Client can be created
- Error handling works
- Basic FFI interaction functions properly
…130)

- Remove complex FFI dependencies (koffi, ffi-napi) that require Node.js 18+
- Add simple-test.js that uses shell commands instead of FFI
- Works with Node.js 10.19.0 and later versions
- Remove macOS TypeScript tests as requested
- Keep only basic library verification tests for Linux

The simplified approach verifies:
- Library file exists and is valid ELF shared object
- Required symbols are exported (mcp_auth_*)
- Dependencies are properly linked (libssl, libcrypto, libcurl)
- Library size is reasonable
…ty (#130)

- Add simple-test.js for Windows that uses basic file checks instead of FFI
- Add run_test.bat to copy DLL and run JavaScript test
- Works with Node.js 10.19.0 and later versions on Windows
- Checks for PE/DLL format, exports (if tools available), and dependencies
- Handles both gopher_mcp_auth.dll and libgopher_mcp_auth.dll naming

The simplified approach verifies:
- DLL file exists and is valid PE format
- Required symbols are exported (if dumpbin/objdump available)
- Common Windows dependencies (kernel32.dll, msvcrt.dll)
- Library size is reasonable
Removed build-windows-x64-simple.sh and build-windows-x64-prebuilt.sh
along with their corresponding Dockerfiles as they are not needed.

The main build-windows-x64.sh script is sufficient and provides:
- Windows native APIs (CryptoAPI and WinHTTP)
- Self-contained DLL with no external dependencies
- Verification tool and JavaScript tests
- Simplified test infrastructure for Node.js 10+
Key changes to match gopher-auth-sdk-nodejs OAuth flow:

1. Dynamic Client Registration:
   - Added /realms/:realm/clients-registrations/openid-connect endpoint
   - Proxies registration requests to Keycloak with scope filtering
   - Creates actual dynamic clients instead of returning pre-configured ones
   - MCP Inspector now uses dynamically registered client_id for auth

2. Scope Filtering and Validation:
   - Filter out invalid scopes (web-origins, acr, etc.)
   - Deduplicate scope lists
   - Validate against configurable whitelist
   - Default to allowed scopes when none provided

3. Discovery Metadata Updates:
   - Point registration_endpoint to dynamic registration path
   - Filter scopes_supported to only allowed scopes
   - Ensure proper realm extraction from auth server URL

4. Enhanced CORS Support:
   - Added OPTIONS handlers for all OAuth endpoints
   - Support for dynamic registration path pattern

The OAuth flow now matches gopher-auth-sdk-nodejs:
- MCP Inspector requests dynamic registration
- Server filters/validates scopes
- Keycloak registers clean client
- MCP Inspector uses dynamic client_id for auth
Sync OAuth improvements from gopher-auth-example-server:
- Fix redirect_uri handling to preserve dynamic client URIs
- Don't replace redirect_uri for dynamically registered clients
- Make GOPHER_CLIENT_ID/SECRET optional for pure dynamic registration
- Add null checks for validation results to prevent TypeScript errors
- Improve session ID extraction with proper null handling

Key fixes:
- Dynamic clients keep their original redirect_uris (e.g., http://localhost:6274/oauth/callback)
- No more Invalid parameter: redirect_uri errors with MCP Inspector
- Support true OAuth 2.1 dynamic client registration flow
Implements token exchange functionality to exchange Keycloak access tokens
for external IDP tokens (Google, GitHub, Microsoft, etc.)

Key features:
- RFC 8693 compliant token exchange implementation
- Environment-based IDP configuration via AVAILABLE_IDP_ALIASES
- IDP alias validation with helpful error messages
- GET /oauth/idps endpoint to list configured IDPs
- POST /oauth/token-exchange endpoint for token exchange
- Support for default IDP and environment-specific IDP lists
- Comprehensive error handling with TokenExchangeError class

Configuration:
- Set AVAILABLE_IDP_ALIASES in .env with comma-separated IDP aliases
- Aliases must match exactly what's configured in Keycloak
- Optional DEFAULT_IDP_ALIAS for default IDP selection
- Environment-specific lists: PRODUCTION_IDP_ALIASES, etc.

Prerequisites:
- Keycloak must have token exchange enabled (--features=token-exchange)
- IDPs must have "Store Tokens" and "Stored Tokens Readable" enabled
- Client must have token-exchange permissions configured

This enables MCP servers to act on behalf of users with external
service providers while maintaining security through Keycloak.
…130)

- Replace complex IDP validation with simple EXCHANGE_IDPS environment variable
- Support parallel token exchange for multiple IDPs (comma-separated list)
- Store all exchanged tokens in req.externalTokens map for multi-IDP access
- Improve token exchange logging with detailed success/failure information
- Simplify configuration: just list IDPs to exchange, no validation needed
- Add IDP configuration display in server startup logs

Breaking changes:
- Removed AUTO_EXCHANGE_TOKEN, DEFAULT_IDP_ALIAS, AVAILABLE_IDP_ALIASES
- Now use single EXCHANGE_IDPS variable (e.g., "github,google,microsoft")
The C++ implementation was incorrectly treating any response containing
an 'account-link-url' field as an error requiring account linking, even
when the response also contained a valid access_token.

This fix matches the Node.js SDK behavior:
- First check for access_token in the response
- Only treat it as an account-linking error if there's no access_token
  but there is an account-link-url
- Ignore account-link-url if access_token is present (some Keycloak
  configurations include this URL even on successful exchanges)

This resolves the issue where C++ SDK was failing with 'account-link-required'
while Node.js SDK was succeeding with the same Keycloak configuration.
- Fix TypeScript import paths after directory restructuring
- Add mock mode support to token exchange integration tests
- Clean up CMakeLists.txt for auth tests
- Add missing TypeScript source files to auth/src directory

These changes support the token exchange fix and improve test coverage.
Updated docker/build-mac-x64.sh to copy TypeScript files from the new
directory structure (sdk/typescript/auth/src/) instead of the old
locations. The script now:

- Checks for the new auth/src directory structure first
- Falls back to old structure for backward compatibility
- Copies the express-adapter from both possible locations
- Includes the new index.ts file in the SDK bundle

This ensures the build script works with the reorganized TypeScript
code after the directory restructuring.
  longer needed

  The enhanced features have been merged into the main SDK, making the
  simplified index-basic.ts redundant. The main index.ts now handles
  all functionality including automatic token re-exchange.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants