Merge branch 'main' into copilot/add-logger-factory-to-streamable-http

Author: stephentoub

src/Common/Polyfills/System/IdHelpers.cs

@@ -0,0 +1,40 @@
+using System.Threading;
+
+namespace System;
+
+/// <summary>
+/// Provides helper methods for monotonic ID generation.
+/// </summary>
+internal static class IdHelpers
+{
+    private static long s_counter;
+
+    /// <summary>
+    /// Creates a strictly monotonically increasing identifier string using 64-bit timestamp ticks
+    /// and a 64-bit counter, formatted as a 32-character hexadecimal string (GUID-like).
+    /// </summary>
+    /// <param name="timestamp">The timestamp to embed in the identifier.</param>
+    /// <returns>A new strictly monotonically increasing identifier string.</returns>
+    /// <remarks>
+    /// <para>
+    /// This method creates a 128-bit identifier composed of two 64-bit values:
+    /// - High 64 bits: <see cref="DateTimeOffset.Ticks"/> from the timestamp
+    /// - Low 64 bits: A globally monotonically increasing counter
+    /// </para>
+    /// <para>
+    /// The resulting string is strictly monotonically increasing when compared lexicographically,
+    /// which is required for keyset pagination to work correctly. Unlike <c>Guid.CreateVersion7</c>,
+    /// which uses random bits for intra-millisecond uniqueness, this implementation guarantees
+    /// strict ordering for all identifiers regardless of when they were created.
+    /// </para>
+    /// </remarks>
+    public static string CreateMonotonicId(DateTimeOffset timestamp)
+    {
+        long ticks = timestamp.UtcTicks;
+        long counter = Interlocked.Increment(ref s_counter);
+
+        // Format as 32-character hex string (16 bytes = 128 bits)
+        // High 64 bits: timestamp ticks, Low 64 bits: counter
+        return $"{ticks:x16}{counter:x16}";
+    }
+}

src/ModelContextProtocol.Core/ModelContextProtocol.Core.csproj

@@ -7,7 +7,6 @@
     <PackageId>ModelContextProtocol.Core</PackageId>
     <Description>Core .NET SDK for the Model Context Protocol (MCP)</Description>
     <PackageReadmeFile>README.md</PackageReadmeFile>
-    <AllowUnsafeBlocks>True</AllowUnsafeBlocks>
     <!-- Suppress the experimental tasks warning -->
     <NoWarn>$(NoWarn);MCPEXP001</NoWarn>
   </PropertyGroup>
@@ -19,6 +18,7 @@
   <PropertyGroup Condition="'$(TargetFramework)' == 'netstandard2.0'">
     <!-- CS0436: Allow ObsoleteAttribute to be redefined internally -->
     <NoWarn>$(NoWarn);CS0436</NoWarn>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
   </PropertyGroup>
 
   <ItemGroup>

src/ModelContextProtocol.Core/Server/InMemoryMcpTaskStore.cs

@@ -3,7 +3,11 @@
 using System.Diagnostics.CodeAnalysis;
 using System.Text.Json;
 
+#if MCP_TEST_TIME_PROVIDER
+namespace ModelContextProtocol.Tests.Internal;
+#else
 namespace ModelContextProtocol;
+#endif
 
 /// <summary>
 /// Provides an in-memory implementation of <see cref="IMcpTaskStore"/> for development and testing.
@@ -35,6 +39,9 @@ public sealed class InMemoryMcpTaskStore : IMcpTaskStore, IDisposable
     private readonly int _pageSize;
     private readonly int? _maxTasks;
     private readonly int? _maxTasksPerSession;
+#if MCP_TEST_TIME_PROVIDER
+    private readonly TimeProvider _timeProvider;
+#endif
 
     /// <summary>
     /// Initializes a new instance of the <see cref="InMemoryMcpTaskStore"/> class.
@@ -120,6 +127,9 @@ public InMemoryMcpTaskStore(
         _pageSize = pageSize;
         _maxTasks = maxTasks;
         _maxTasksPerSession = maxTasksPerSession;
+#if MCP_TEST_TIME_PROVIDER
+        _timeProvider = TimeProvider.System;
+#endif
 
         cleanupInterval ??= TimeSpan.FromMinutes(1);
         if (cleanupInterval.Value != Timeout.InfiniteTimeSpan)
@@ -128,6 +138,26 @@ public InMemoryMcpTaskStore(
         }
     }
 
+#if MCP_TEST_TIME_PROVIDER
+    /// <summary>
+    /// Initializes a new instance of the <see cref="InMemoryMcpTaskStore"/> class with a custom time provider.
+    /// This constructor is only available for testing purposes.
+    /// </summary>
+    internal InMemoryMcpTaskStore(
+        TimeSpan? defaultTtl,
+        TimeSpan? maxTtl,
+        TimeSpan? pollInterval,
+        TimeSpan? cleanupInterval,
+        int pageSize,
+        int? maxTasks,
+        int? maxTasksPerSession,
+        TimeProvider timeProvider)
+        : this(defaultTtl, maxTtl, pollInterval, cleanupInterval, pageSize, maxTasks, maxTasksPerSession)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+#endif
+
     /// <inheritdoc/>
     public Task<McpTask> CreateTaskAsync(
         McpTaskMetadata taskParams,
@@ -155,7 +185,7 @@ public Task<McpTask> CreateTaskAsync(
         }
 
         var taskId = GenerateTaskId();
-        var now = DateTimeOffset.UtcNow;
+        var now = GetUtcNow();
 
         // Determine TTL: use requested, fall back to default, respect max limit
         var ttl = taskParams.TimeToLive ?? _defaultTtl;
@@ -242,7 +272,7 @@ public Task<McpTask> StoreTaskResultAsync(
             var updatedEntry = new TaskEntry(entry)
             {
                 Status = status,
-                LastUpdatedAt = DateTimeOffset.UtcNow,
+                LastUpdatedAt = GetUtcNow(),
                 StoredResult = result
             };
 
@@ -303,7 +333,7 @@ public Task<McpTask> UpdateTaskStatusAsync(
             {
                 Status = status,
                 StatusMessage = statusMessage,
-                LastUpdatedAt = DateTimeOffset.UtcNow,
+                LastUpdatedAt = GetUtcNow(),
             };
 
             if (_tasks.TryUpdate(taskId, updatedEntry, entry))
@@ -321,32 +351,22 @@ public Task<ListTasksResult> ListTasksAsync(
         string? sessionId = null,
         CancellationToken cancellationToken = default)
     {
-        // Parse cursor: format is "CreatedAt|TaskId" for keyset pagination
-        (DateTimeOffset, string)? parsedCursor = null;
-        if (cursor != null)
-        {
-            var parts = cursor.Split('|');
-            if (parts.Length == 2 &&
-                DateTimeOffset.TryParse(parts[0], out var parsedDate))
-            {
-                parsedCursor = (parsedDate, parts[1]);
-            }
-        }
-
         // Stream enumeration - filter by session, exclude expired, apply keyset pagination
         var query = _tasks.Values
             .Where(e => sessionId == null || e.SessionId == sessionId)
             .Where(e => !IsExpired(e));
 
-        // Apply keyset filter if cursor provided: (CreatedAt, TaskId) > cursor
-        if (parsedCursor is { } parsedCursorValue)
+        // Apply keyset filter if cursor provided: TaskId > cursor
+        // UUID v7 task IDs are monotonically increasing and inherently time-ordered
+        if (cursor != null)
         {
-            query = query.Where(e => (e.CreatedAt, e.TaskId).CompareTo(parsedCursorValue) > 0);
+            query = query.Where(e => string.CompareOrdinal(e.TaskId, cursor) > 0);
         }
 
-        // Order by (CreatedAt, TaskId) for stable, deterministic pagination
+        // Order by TaskId for stable, deterministic pagination
+        // UUID v7 task IDs sort chronologically due to embedded timestamp
         var page = query
-            .OrderBy(e => (e.CreatedAt, e.TaskId))
+            .OrderBy(e => e.TaskId, StringComparer.Ordinal)
             .Take(_pageSize + 1) // Take one extra to check if there's a next page
             .Select(e => e.ToMcpTask())
             .ToList();
@@ -356,7 +376,7 @@ public Task<ListTasksResult> ListTasksAsync(
         if (page.Count > _pageSize)
         {
             var lastItemInPage = page[_pageSize - 1]; // Last item we'll actually return
-            nextCursor = $"{lastItemInPage.CreatedAt:O}|{lastItemInPage.TaskId}";
+            nextCursor = lastItemInPage.TaskId;
             page.RemoveAt(_pageSize); // Remove the extra item
         }
         else
@@ -397,7 +417,7 @@ public Task<McpTask> CancelTaskAsync(string taskId, string? sessionId = null, Ca
             var updatedEntry = new TaskEntry(entry)
             {
                 Status = McpTaskStatus.Cancelled,
-                LastUpdatedAt = DateTimeOffset.UtcNow,
+                LastUpdatedAt = GetUtcNow(),
             };
 
             if (_tasks.TryUpdate(taskId, updatedEntry, entry))
@@ -417,20 +437,31 @@ public void Dispose()
         _cleanupTimer?.Dispose();
     }
 
-    private static string GenerateTaskId() => Guid.NewGuid().ToString("N");
+    private string GenerateTaskId() =>
+        IdHelpers.CreateMonotonicId(GetUtcNow());
 
     private static bool IsTerminalStatus(McpTaskStatus status) =>
         status is McpTaskStatus.Completed or McpTaskStatus.Failed or McpTaskStatus.Cancelled;
 
+#if MCP_TEST_TIME_PROVIDER
+    private DateTimeOffset GetUtcNow() => _timeProvider.GetUtcNow();
+#else
+    private static DateTimeOffset GetUtcNow() => DateTimeOffset.UtcNow;
+#endif
+
+#if MCP_TEST_TIME_PROVIDER
+    private bool IsExpired(TaskEntry entry)
+#else
     private static bool IsExpired(TaskEntry entry)
+#endif
     {
         if (entry.TimeToLive == null)
         {
             return false; // Unlimited lifetime
         }
 
         var expirationTime = entry.CreatedAt + entry.TimeToLive.Value;
-        return DateTimeOffset.UtcNow >= expirationTime;
+        return GetUtcNow() >= expirationTime;
     }
 
     private void CleanupExpiredTasks(object? state)

tests/Common/Utils/TestConstants.cs

@@ -10,4 +10,16 @@ public static class TestConstants
     /// Set to 60 seconds to provide sufficient buffer for slow CI environments.
     /// </summary>
     public static readonly TimeSpan DefaultTimeout = TimeSpan.FromSeconds(60);
+
+    /// <summary>
+    /// Timeout for HttpClient operations in tests.
+    /// Set to 60 seconds to provide sufficient buffer for slow CI environments.
+    /// </summary>
+    public static readonly TimeSpan HttpClientTimeout = TimeSpan.FromSeconds(60);
+
+    /// <summary>
+    /// Timeout for short-lived HTTP requests during polling operations.
+    /// Set to 2 seconds for quick failure detection while polling.
+    /// </summary>
+    public static readonly TimeSpan HttpClientPollingTimeout = TimeSpan.FromSeconds(2);
 }

tests/ModelContextProtocol.AspNetCore.Tests/MapMcpStreamableHttpTests.cs

@@ -1,4 +1,5 @@
 using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Primitives;
 using ModelContextProtocol.Client;
@@ -355,4 +356,60 @@ public async Task EnablePollingAsync_ThrowsInvalidOperationException_WhenNoEvent
         Assert.NotNull(capturedException);
         Assert.Contains("event stream store", capturedException.Message, StringComparison.OrdinalIgnoreCase);
     }
+
+    [Fact]
+    public async Task AdditionalHeaders_AreSent_InPostAndDeleteRequests()
+    {
+        Assert.SkipWhen(Stateless, "DELETE requests are not sent in stateless mode due to lack of session ID.");
+
+        bool wasPostRequest = false;
+        bool wasDeleteRequest = false;
+
+        Builder.Services.AddMcpServer().WithHttpTransport(ConfigureStateless).WithTools<EchoHttpContextUserTools>();
+
+        await using var app = Builder.Build();
+
+        app.Use(next =>
+        {
+            return async context =>
+            {
+                Assert.Equal("Bearer testToken", context.Request.Headers["Authorize"]);
+                if (context.Request.Method == HttpMethods.Post)
+                {
+                    wasPostRequest = true;
+                }
+                else if (context.Request.Method == HttpMethods.Delete)
+                {
+                    wasDeleteRequest = true;
+                }
+                await next(context);
+            };
+        });
+
+        app.MapMcp();
+
+        await app.StartAsync(TestContext.Current.CancellationToken);
+
+        var transportOptions = new HttpClientTransportOptions
+        {
+            Endpoint = new("http://localhost:5000/"),
+            Name = "In-memory Streamable HTTP Client",
+            TransportMode = HttpTransportMode.StreamableHttp,
+            AdditionalHeaders = new Dictionary<string, string>
+            {
+                ["Authorize"] = "Bearer testToken"
+            },
+        };
+
+        await using var mcpClient = await ConnectAsync(transportOptions: transportOptions);
+
+        // Do a tool call to ensure there's more than just the initialize request
+        await mcpClient.ListToolsAsync(cancellationToken: TestContext.Current.CancellationToken);
+
+        // Dispose the client to trigger the DELETE request
+        await mcpClient.DisposeAsync();
+
+        Assert.True(wasPostRequest, "POST request was not made");
+        Assert.True(wasDeleteRequest, "DELETE request was not made");
+    }
 }

tests/ModelContextProtocol.AspNetCore.Tests/OAuth/OAuthTestBase.cs

@@ -83,6 +83,11 @@ public async ValueTask DisposeAsync()
 
     protected async Task<WebApplication> StartMcpServerAsync(string path = "", string? authScheme = null)
     {
+        // Wait for the OAuth server to be ready before starting the MCP server.
+        // This prevents race conditions in CI where the OAuth server may not be
+        // fully initialized when the first test request is made.
+        await TestOAuthServer.ServerStarted.WaitAsync(TestContext.Current.CancellationToken);
+
         Builder.Services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
         {
             options.TokenValidationParameters.ValidAudience = $"{McpServerUrl}{path}";

tests/ModelContextProtocol.AspNetCore.Tests/ServerConformanceTests.cs

@@ -47,7 +47,7 @@ public async ValueTask InitializeAsync()
         // Wait for server to be ready (retry for up to 30 seconds)
         var timeout = TimeSpan.FromSeconds(30);
         var stopwatch = Stopwatch.StartNew();
-        using var httpClient = new HttpClient { Timeout = TimeSpan.FromSeconds(2) };
+        using var httpClient = new HttpClient { Timeout = TestConstants.HttpClientPollingTimeout };
 
         while (stopwatch.Elapsed < timeout)
         {

tests/ModelContextProtocol.AspNetCore.Tests/Utils/KestrelInMemoryTest.cs

@@ -42,7 +42,7 @@ public KestrelInMemoryTest(ITestOutputHelper testOutputHelper)
     protected static void ConfigureHttpClient(HttpClient httpClient)
     {
         httpClient.BaseAddress = new Uri("http://localhost:5000/");
-        httpClient.Timeout = TimeSpan.FromSeconds(10);
+        httpClient.Timeout = TestConstants.HttpClientTimeout;
     }
 
     public override void Dispose()

tests/ModelContextProtocol.TestOAuthServer/Program.cs

@@ -33,6 +33,7 @@ public sealed class Program
 
     private readonly ILoggerProvider? _loggerProvider;
     private readonly IConnectionListenerFactory? _kestrelTransport;
+    private readonly TaskCompletionSource _serverStarted = new(TaskCreationOptions.RunContinuationsAsynchronously);
 
     /// <summary>
     /// Initializes a new instance of the <see cref="Program"/> class with logging and transport parameters.
@@ -47,6 +48,11 @@ public Program(ILoggerProvider? loggerProvider = null, IConnectionListenerFactor
         _kestrelTransport = kestrelTransport;
     }
 
+    /// <summary>
+    /// Gets a task that completes when the server has started and is ready to accept connections.
+    /// </summary>
+    public Task ServerStarted => _serverStarted.Task;
+
     // Track if we've already issued an already-expired token for the CanAuthenticate_WithTokenRefresh test which uses the test-refresh-client registration.
     public bool HasRefreshedToken { get; set; }
 
@@ -541,7 +547,20 @@ IResult HandleMetadataRequest(HttpContext context, string? issuerPath = null)
         Console.WriteLine($"Demo Client ID: {clientId}");
         Console.WriteLine($"Demo Client Secret: {clientSecret}");
 
-        await app.RunAsync(cancellationToken);
+        await app.StartAsync(cancellationToken);
+        _serverStarted.TrySetResult();
+
+        // Wait until cancellation is requested
+        try
+        {
+            await Task.Delay(Timeout.Infinite, cancellationToken);
+        }
+        catch (OperationCanceledException)
+        {
+            // Expected when cancellation is requested
+        }
+
+        await app.StopAsync();
     }
 
     /// <summary>