Summary

• validate the RFC 9207 authorization response issuer before deleting the stored authorization state
• keep valid callbacks one-time by deleting state immediately after issuer validation succeeds
• add regression coverage for missing and mismatched required iss

Why

The returned OAuth state is only the lookup key. An unknown state loads no StoredAuthorizationState and deletes nothing. But an authorization server that received the authorization request can send a callback with the correct state and a forged or missing required iss. Previously RMCP loaded and deleted the real stored state before issuer validation rejected that callback. That consumed the PKCE verifier, so the later legitimate callback could not complete.

The new order is load state, validate iss, delete state, then exchange the code. Invalid issuer callbacks do not reach the token endpoint or consume state; a valid callback still consumes the one-time state before token exchange.

Tests

• cargo fmt --check
• cargo test -p rmcp --lib --features auth invalid_issuer_does_not_consume_authorization_state
• cargo test -p rmcp --lib --features auth