Skip to content

Commit 587670e

Browse files
committed
docs: remove cross-SDK comparisons from two-leg flow
1 parent 59dfc68 commit 587670e

2 files changed

Lines changed: 4 additions & 4 deletions

File tree

‎docs/_client/authorization.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -180,8 +180,7 @@ provider = MCP::Client::OAuth::Provider.new(
180180

181181
`callback_handler` keeps the flow open until the code comes back, so the process that sent the user to the authorization server stays blocked for as long as
182182
the user takes to sign in and consent. That suits CLI and desktop clients. In a web application the redirect arrives as a separate HTTP request, often served
183-
by a different process, and relaying the code to a request held open for that long is impractical. Omit `callback_handler` and the flow runs in two legs,
184-
as the TypeScript SDK's `auth()` and `finishAuth()` and the Rust SDK's `get_authorization_url` and `exchange_code_for_token` do:
183+
by a different process, and relaying the code to a request held open for that long is impractical. Omit `callback_handler` and the flow runs in two legs:
185184

186185
1. When the transport meets a `401`, or a `403` step-up challenge, the flow runs discovery and registration as usual, saves a pending authorization in `storage`
187186
keyed by the `state` it generated, hands the authorization URL to `redirect_handler`, and raises `MCP::Client::OAuth::Flow::AuthorizationPendingError`

‎lib/mcp/client/oauth/in_memory_storage.rb‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,9 @@ module OAuth
3030
# `client_information`, `save_client_information(info)`) and pass it via
3131
# `Provider.new(storage: ...)`. The shape mirrors Python SDK's
3232
# `TokenStorage` Protocol; TypeScript's `OAuthClientProvider` rolls
33-
# the same responsibilities into a single object. A web application finishing authorizations in whichever process
34-
# receives the redirect needs a shared store for the pending authorizations too, as the Rust SDK's `StateStore` does.
33+
# the same responsibilities into a single object.
34+
# A web application may receive the redirect in another process, so pending authorizations
35+
# need shared storage.
3536
class InMemoryStorage
3637
attr_accessor :tokens, :client_information
3738

0 commit comments

Comments
 (0)