fix(client): allow cached malformed legacy issuer fallback

Author: mattzcarey

packages/client/src/client/auth.ts

@@ -622,20 +622,46 @@ function validateAuthorizationServerMetadataIssuer(metadata: { issuer: string }
     }
 }
 
+function isLegacyFallbackDiscoveryState(cachedState: OAuthDiscoveryState, serverUrl: string | URL): boolean {
+    if (cachedState.resourceMetadata?.authorization_servers?.length) {
+        return false;
+    }
+
+    try {
+        const cachedIssuer = normalizeDiscoveredIssuerIdentifier(cachedState.authorizationServerUrl, 'Cached authorization server URL');
+        const legacyFallbackIssuer = normalizeDiscoveredIssuerIdentifier(new URL('/', serverUrl), 'MCP server URL');
+        return cachedIssuer === legacyFallbackIssuer;
+    } catch {
+        return false;
+    }
+}
+
+function hasMalformedAuthorizationServerMetadataIssuer(metadata: { issuer: string } | undefined): boolean {
+    if (!metadata) {
+        return false;
+    }
+
+    try {
+        normalizeDiscoveredIssuerIdentifier(metadata.issuer, 'Authorization server metadata issuer');
+        return false;
+    } catch {
+        return true;
+    }
+}
+
 function isStaleLegacyFallbackDiscoveryState(
     cachedState: OAuthDiscoveryState,
     metadata: { issuer: string } | undefined,
     serverUrl: string | URL
 ): boolean {
-    if (!metadata || cachedState.resourceMetadata?.authorization_servers?.length) {
+    if (!metadata || !isLegacyFallbackDiscoveryState(cachedState, serverUrl)) {
         return false;
     }
 
     try {
         const cachedIssuer = normalizeDiscoveredIssuerIdentifier(cachedState.authorizationServerUrl, 'Cached authorization server URL');
-        const legacyFallbackIssuer = normalizeDiscoveredIssuerIdentifier(new URL('/', serverUrl), 'MCP server URL');
         const metadataIssuer = normalizeDiscoveredIssuerIdentifier(metadata.issuer, 'Authorization server metadata issuer');
-        return cachedIssuer === legacyFallbackIssuer && metadataIssuer !== cachedIssuer;
+        return metadataIssuer !== cachedIssuer;
     } catch {
         return false;
     }
@@ -766,12 +792,16 @@ async function authInternal(
         try {
             validateAuthorizationServerMetadataIssuer(metadata, authorizationServerUrl);
         } catch (error) {
-            if (!isStaleLegacyFallbackDiscoveryState(cachedState, metadata, serverUrl)) {
-                throw error;
-            }
+            const canUseMalformedLegacyFallbackState =
+                isLegacyFallbackDiscoveryState(cachedState, serverUrl) && hasMalformedAuthorizationServerMetadataIssuer(metadata);
+            if (!canUseMalformedLegacyFallbackState) {
+                if (!isStaleLegacyFallbackDiscoveryState(cachedState, metadata, serverUrl)) {
+                    throw error;
+                }
 
-            await provider.invalidateCredentials?.('discovery');
-            useCachedDiscoveryState = false;
+                await provider.invalidateCredentials?.('discovery');
+                useCachedDiscoveryState = false;
+            }
         }
     }
 

packages/client/test/client/auth.test.ts

@@ -4713,6 +4713,35 @@ describe('SEP-2468: RFC 9207 authorization response iss validation', () => {
             expect(provider.saveTokens).not.toHaveBeenCalled();
         });
 
+        it('uses cached legacy no-PRM fallback metadata with an invalid issuer during code exchange', async () => {
+            const legacyAuthMetadata: AuthorizationServerMetadata = {
+                ...authServerMetadata,
+                issuer: 'auth.example.com',
+                authorization_endpoint: 'https://auth.example.com/oauth/authorize',
+                token_endpoint: 'https://auth.example.com/oauth/token'
+            };
+            const invalidateCredentials = vi.fn();
+            const provider: OAuthClientProvider = {
+                ...createMockProvider(legacyAuthMetadata),
+                discoveryState: vi.fn().mockResolvedValue({
+                    authorizationServerUrl: 'https://resource.example.com/',
+                    authorizationServerMetadata: legacyAuthMetadata
+                }),
+                invalidateCredentials
+            };
+
+            const result = await auth(provider, {
+                serverUrl: 'https://resource.example.com',
+                authorizationCode: 'code123'
+            });
+
+            expect(result).toBe('AUTHORIZED');
+            expect(invalidateCredentials).not.toHaveBeenCalled();
+            expect(tokenEndpointCalls()).toHaveLength(1);
+            expect(tokenEndpointCalls()[0]?.[0]?.toString()).toBe(legacyAuthMetadata.token_endpoint);
+            expect(provider.saveTokens).toHaveBeenCalled();
+        });
+
         it('rejects when the AS advertises iss support and the caller reports a response without iss (null)', async () => {
             const provider = createMockProvider();