Alternative: XAA as OAuthClientProvider with Layer 2 utilities

[pcarleton]

Alternative implementation for PR #1328

This is an alternative approach to #1328 (SEP-990 Enterprise Managed OAuth). Instead of a standalone middleware, this implements Cross-App Access as an OAuthClientProvider with composable Layer 2 utilities.

Design

Layer 2: crossAppAccess.ts (~130 lines)

• requestJwtAuthorizationGrant() — standalone RFC 8693 token exchange utility
• discoverAndRequestJwtAuthGrant() — convenience wrapper with IDP discovery

Layer 3: CrossAppAccessProvider in authExtensions.ts

• Takes an assertion callback that receives orchestrator context and returns a JAG
• Plugs into withOAuth for token caching, 401 retry, client_secret_basic, Zod validation
• Uses saveAuthorizationServerUrl (PR feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL #1527) and new saveResourceUrl to get MCP AS info from the orchestrator

Usage

const provider = new CrossAppAccessProvider({
    assertion: async (ctx) => requestJwtAuthorizationGrant({
        tokenEndpoint: 'https://idp.example.com/token',
        audience: ctx.authorizationServerUrl,
        resource: ctx.resourceUrl,
        idToken: await getIdToken(),
        clientId: 'my-idp-client',
        clientSecret: 'my-idp-secret',
        scope: ctx.scope,
        fetchFn: ctx.fetchFn
    }),
    clientId: 'my-mcp-client',
    clientSecret: 'my-mcp-secret'
});

const transport = new StreamableHTTPClientTransport(serverUrl, {
    authProvider: provider
});

Key decisions

• Assertion callback decouples IDP interaction from the provider — callers can use the Layer 2 utility for standard flows or bring their own JAG source
• saveResourceUrl added to OAuthClientProvider (same pattern as saveAuthorizationServerUrl in feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL #1527) so providers can access orchestrator-discovered state
• No qs dependency — uses URLSearchParams like the rest of the codebase

Depends on

• PR feat: expose discoverOAuthServerInfo() and add provider caching for auth server URL #1527 for saveAuthorizationServerUrl / authorizationServerUrl on the provider interface

Conformance

Passes auth/cross-app-access-complete-flow scenario (9/9 checks).

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2f95627

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR