fix: bound OAuth authorization to one deadline

Author: pmor

dist/chunk-QTFHAWVT.js dist/chunk-YZXW5VW3.jsdist/chunk-QTFHAWVT.js renamed to dist/chunk-YZXW5VW3.js

@@ -20609,13 +20609,17 @@ async function discoverOAuthServerInfo(serverUrl, headers = {}) {
     wwwAuthenticateScope
   };
 }
-async function finishOAuthAuthorization(finishAuth, authorizationCode, authTimeoutMs = 3e4) {
+async function finishOAuthAuthorization(finishAuth, authorizationCode, authTimeoutMs = 3e4, authorizationDeadlineMs = Date.now() + authTimeoutMs) {
+  const remainingMs = authorizationDeadlineMs - Date.now();
+  if (remainingMs <= 0) {
+    throw new Error("OAuth authorization deadline expired before token exchange");
+  }
   let timeout;
   try {
     await Promise.race([
       finishAuth(authorizationCode),
       new Promise((_, reject) => {
-        timeout = setTimeout(() => reject(new Error(`OAuth token exchange timed out after ${authTimeoutMs / 1e3} seconds`)), authTimeoutMs);
+        timeout = setTimeout(() => reject(new Error(`OAuth token exchange timed out after ${remainingMs / 1e3} seconds`)), remainingMs);
       })
     ]);
   } finally {
@@ -20724,11 +20728,17 @@ async function connectToRemoteServer(client, serverUrl, authProvider, headers, a
       }
       log("Authentication required. Waiting for authorization...");
       debugLog("Waiting for auth code from callback server");
+      const authorizationDeadlineMs = Date.now() + authTimeoutMs;
       const code = await waitForAuthCode();
       debugLog("Received auth code from callback server");
       try {
         log("Completing authorization...");
-        await finishOAuthAuthorization((authorizationCode) => transport.finishAuth(authorizationCode), code, authTimeoutMs);
+        await finishOAuthAuthorization(
+          (authorizationCode) => transport.finishAuth(authorizationCode),
+          code,
+          authTimeoutMs,
+          authorizationDeadlineMs
+        );
         markAuthCompleted();
         debugLog("Authorization completed successfully");
         if (recursionReasons.has(REASON_AUTH_NEEDED)) {

dist/client.js

@@ -12,7 +12,7 @@ import {
   parseCommandLineArgs,
   setupSignalHandlers,
   version
-} from "./chunk-QTFHAWVT.js";
+} from "./chunk-YZXW5VW3.js";
 
 // src/client.ts
 import { EventEmitter } from "events";

dist/proxy.js

@@ -11,7 +11,7 @@ import {
   mcpProxy,
   parseCommandLineArgs,
   setupSignalHandlers
-} from "./chunk-QTFHAWVT.js";
+} from "./chunk-YZXW5VW3.js";
 
 // src/proxy.ts
 import { EventEmitter } from "events";
@@ -174,13 +174,14 @@ async function runProxy(serverUrl, callbackPort, headers, transportStrategy = "h
         log("OAuth was completed by another process; verifying the shared token");
         return;
       }
+      const authorizationDeadlineMs = Date.now() + authState.authTimeoutMs;
       const code = await authState.waitForNextAuthCode();
       const oauthTransport = remoteTransport;
       if (!oauthTransport.finishAuth) {
         throw new Error("Remote transport does not support OAuth authorization completion");
       }
       log("Completing renewed authorization...");
-      await finishOAuthAuthorization(oauthTransport.finishAuth.bind(oauthTransport), code, authState.authTimeoutMs);
+      await finishOAuthAuthorization(oauthTransport.finishAuth.bind(oauthTransport), code, authState.authTimeoutMs, authorizationDeadlineMs);
       authState.markAuthCompleted();
       log("Renewed OAuth token; verifying it with the remote MCP server");
     };

src/lib/utils.test.ts

@@ -18,6 +18,12 @@ import { OAuthAuthorizationPendingError } from './types'
 // All sanitizeUrl tests have been moved to the strict-url-sanitise package
 
 describe('finishOAuthAuthorization', () => {
+  it('rejects immediately when the shared authorization deadline has already expired', async () => {
+    await expect(finishOAuthAuthorization(async () => undefined, 'authorization-code', 20, Date.now() - 1)).rejects.toThrow(
+      'OAuth authorization deadline expired before token exchange',
+    )
+  })
+
   it('rejects when token exchange does not complete before the authorization deadline', async () => {
     await expect(finishOAuthAuthorization(() => new Promise<void>(() => {}), 'authorization-code', 20)).rejects.toThrow(
       'OAuth token exchange timed out after 0.02 seconds',

src/lib/utils.ts

@@ -547,13 +547,19 @@ export async function finishOAuthAuthorization(
   finishAuth: (authorizationCode: string) => Promise<void>,
   authorizationCode: string,
   authTimeoutMs: number = 30000,
+  authorizationDeadlineMs: number = Date.now() + authTimeoutMs,
 ): Promise<void> {
+  const remainingMs = authorizationDeadlineMs - Date.now()
+  if (remainingMs <= 0) {
+    throw new Error('OAuth authorization deadline expired before token exchange')
+  }
+
   let timeout: ReturnType<typeof setTimeout> | undefined
   try {
     await Promise.race([
       finishAuth(authorizationCode),
       new Promise<void>((_, reject) => {
-        timeout = setTimeout(() => reject(new Error(`OAuth token exchange timed out after ${authTimeoutMs / 1000} seconds`)), authTimeoutMs)
+        timeout = setTimeout(() => reject(new Error(`OAuth token exchange timed out after ${remainingMs / 1000} seconds`)), remainingMs)
       }),
     ])
   } finally {
@@ -728,12 +734,18 @@ export async function connectToRemoteServer(
 
       // Wait for the authorization code from the callback
       debugLog('Waiting for auth code from callback server')
+      const authorizationDeadlineMs = Date.now() + authTimeoutMs
       const code = await waitForAuthCode()
       debugLog('Received auth code from callback server')
 
       try {
         log('Completing authorization...')
-        await finishOAuthAuthorization((authorizationCode) => transport.finishAuth(authorizationCode), code, authTimeoutMs)
+        await finishOAuthAuthorization(
+          (authorizationCode) => transport.finishAuth(authorizationCode),
+          code,
+          authTimeoutMs,
+          authorizationDeadlineMs,
+        )
         markAuthCompleted()
         debugLog('Authorization completed successfully')
 

src/proxy.ts

@@ -130,6 +130,7 @@ async function runProxy(
         return
       }
 
+      const authorizationDeadlineMs = Date.now() + authState.authTimeoutMs
       const code = await authState.waitForNextAuthCode()
       const oauthTransport = remoteTransport as typeof remoteTransport & {
         finishAuth?: (authorizationCode: string) => Promise<void>
@@ -138,7 +139,7 @@ async function runProxy(
         throw new Error('Remote transport does not support OAuth authorization completion')
       }
       log('Completing renewed authorization...')
-      await finishOAuthAuthorization(oauthTransport.finishAuth.bind(oauthTransport), code, authState.authTimeoutMs)
+      await finishOAuthAuthorization(oauthTransport.finishAuth.bind(oauthTransport), code, authState.authTimeoutMs, authorizationDeadlineMs)
       authState.markAuthCompleted()
       log('Renewed OAuth token; verifying it with the remote MCP server')
     }