fix(auth): preserve refresh_token when refresh response omits it

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }

crates/rmcp/src/transport/auth.rs

@@ -1693,14 +1693,21 @@ impl AuthorizationManager {
  for scope in refresh_scopes {
  refresh_request = refresh_request.add_scope(Scope::new(scope));
  }
- let token_result = refresh_request
+ let mut token_result = refresh_request
  .request_async(&OAuth2HttpClient {
  client: self.http_client.as_ref(),
  redirect_policy: self.refresh_redirect_policy,
  })
  .await
  .map_err(|e| AuthError::TokenRefreshFailed(e.to_string()))?;
 
+ // RFC 6749 section 6: issuing a new refresh token on refresh is optional.
+ // When the response omits one, keep the existing refresh token rather than
+ // dropping it. When a new one is present, the response value is used as-is.
+ if token_result.refresh_token().is_none() {
+ token_result.set_refresh_token(Some(refresh_token_value));
+ }
+
  let granted_scopes: Vec<String> = match token_result.scopes() {
  Some(scopes) => scopes.iter().map(|s| s.to_string()).collect(),
  None => self.current_scopes.read().await.clone(),
@@ -5554,4 +5561,101 @@ mod tests {
  "scope should be absent when granted_scopes is empty, body: {body}"
  );
  }
+
+ #[tokio::test]
+ async fn refresh_token_preserves_existing_refresh_token_when_response_omits_it() {
+ use oauth2::TokenResponse;
+ // start_token_server returns a response without a refresh_token, matching
+ // an authorization server that does not rotate refresh tokens on refresh.
+ let (base_url, _captured) = start_token_server().await;
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "returned response should keep the previous refresh token"
+ );
+
+ let reloaded = manager
+ .credential_store
+ .load()
+ .await
+ .unwrap()
+ .unwrap()
+ .token_response
+ .unwrap();
+ assert_eq!(
+ reloaded.refresh_token().map(|t| t.secret().as_str()),
+ Some("my-refresh-token"),
+ "stored credentials should keep the previous refresh token"
+ );
+ }
+
+ #[tokio::test]
+ async fn refresh_token_replaces_refresh_token_when_response_includes_new_one() {
+ use axum::{Router, body::Body, http::Response, routing::post};
+ use oauth2::TokenResponse;
+
+ let app = Router::new().route(
+ "/token",
+ post(|| async {
+ Response::builder()
+ .status(200)
+ .header("content-type", "application/json")
+ .body(Body::from(
+ r#"{"access_token":"new-token","token_type":"Bearer","expires_in":3600,"refresh_token":"rotated-refresh-token"}"#,
+ ))
+ .unwrap()
+ }),
+ );
+ let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+ let addr = listener.local_addr().unwrap();
+ tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
+ let base_url = format!("http://{}", addr);
+
+ let mut manager = manager_with_metadata(Some(AuthorizationMetadata {
+ authorization_endpoint: format!("{}/authorize", base_url),
+ token_endpoint: format!("{}/token", base_url),
+ ..Default::default()
+ }))
+ .await;
+ manager.configure_client(test_client_config()).unwrap();
+
+ let stored = StoredCredentials {
+ client_id: "my-client".to_string(),
+ token_response: Some(make_token_response_with_refresh(
+ "old-token",
+ "my-refresh-token",
+ )),
+ granted_scopes: vec![],
+ token_received_at: Some(AuthorizationManager::now_epoch_secs()),
+ };
+ manager.credential_store.save(stored).await.unwrap();
+
+ let result = manager.refresh_token().await.unwrap();
+ assert_eq!(
+ result.refresh_token().map(|t| t.secret().as_str()),
+ Some("rotated-refresh-token"),
+ "a rotated refresh token from the response should replace the old one"
+ );
+ }
 }