stacklok / toolhive / 21969383186

62%

push

github

Add offline_access to default scopes and fix PRM scope discovery (#3794)

MCP clients like VS Code resolve OAuth scopes from the Protected
Resource Metadata (RFC 9728) scopes_supported field. When no explicit
scopes were configured, the PRM handler defaulted to ["openid"],
causing clients to never request offline_access and therefore never
receive refresh tokens.

Separate the PRM and auth server default scopes. Per RFC 9728,
PRM scopes_supported describes what the resource server needs (minimal:
["openid"]), while auth server scopes describe what the AS supports
(["openid", "profile", "email", "offline_access"]). These are distinct
concerns that should not share a single constant.

When the embedded auth server is configured, the config builder now
propagates the AS's ScopesSupported to the PRM so clients discover the
full set of supported scopes including offline_access. When using an
external OIDC provider without explicit scopes, the PRM safely defaults
to ["openid"].

Add integration tests verifying refresh token issuance with
offline_access and its absence without it.

Fixes: #3776

14 of 14 new or added lines in 1 file covered. (100.0%)

44124 of 71174 relevant lines covered (61.99%)

76.95 hits per line