feat: support multi-challenge WWW-Authenticate headers by grandizzy · Pull Request #185 · tempoxyz/mpp-rs

grandizzy · 2026-03-31T14:10:45Z

Client now matches challenges by provider.supports(method, intent) instead of assuming a single challenge, mirroring the mppx TypeScript SDK.

Changes:

split_payment_challenges: splits a combined header into individual Payment challenge slices
parse_www_authenticate_all: handles both separate headers and combined multi-challenge headers
Client (PaymentExt + PaymentMiddleware) iterates all challenges and selects the first one the provider supports
HttpError::NoSupportedChallenge for when no offered challenge matches

Prompted by: georgen

github-actions · 2026-03-31T14:11:11Z

⚠️ Changelog not found.

A changelog entry is required before merging. We've generated a suggested changelog based on your changes:

Preview

---
mpp: minor
---

Added multi-challenge support to `PaymentExt` and `PaymentMiddleware`: both now parse all `WWW-Authenticate` challenges (including multiple header instances and comma-separated challenges per RFC 9110) and select the first one the provider supports via `provider.supports(method, intent)`. Added `HttpError::NoSupportedChallenge` variant for when no offered challenge matches the provider's supported methods.

Add changelog to commit this to your branch.

Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d4417-fcd8-76fd-a3c1-4532e1393c2c

onbjerg · 2026-03-31T14:41:57Z

src/protocol/core/headers.rs

+/// Find the first `tempo` method challenge from one or more WWW-Authenticate
+/// header values.
+///
+/// This is a convenience wrapper around [`parse_www_authenticate_all`] that
+/// filters for `method="tempo"` and returns the first match.
+///
+/// # Examples
+///
+/// ```
+/// use mpp::protocol::core::find_tempo_challenge;
+///
+/// let header = concat!(
+///     r#"Payment id="a", realm="api", method="tempo", intent="charge", request="e30", "#,
+///     r#"Payment id="b", realm="api", method="stripe", intent="charge", request="e30""#,
+/// );
+/// let challenge = find_tempo_challenge(vec![header]).unwrap();
+/// assert_eq!(challenge.id, "a");
+/// assert_eq!(challenge.method.as_str(), "tempo");
+/// ```
+pub fn find_tempo_challenge<'a>(
+    headers: impl IntoIterator<Item = &'a str>,
+) -> Result<PaymentChallenge> {
+    parse_www_authenticate_all(headers)
+        .into_iter()
+        .find(|r| r.as_ref().is_ok_and(|c| c.method.as_str() == "tempo"))
+        .unwrap_or_else(|| {
+            Err(MppError::invalid_challenge_reason(
+                "No Payment challenge with method=\"tempo\" found",
+            ))
+        })
+}


should this be in the tempo module?

Move the Tempo-specific find_tempo_challenge function from protocol::core::headers to protocol::methods::tempo where it belongs. Re-export from protocol::core for backward compatibility. Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

The methods module is gated behind feature = "server" or feature = "tempo", so the re-export must have the same cfg gate. Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

brendanjryan · 2026-03-31T14:58:11Z

src/protocol/core/headers.rs

+    #[test]
+    fn test_parse_www_authenticate_all_multi_challenge() {
+        let header = concat!(
+            r#"Payment id="t1", realm="r", method="tempo", intent="charge", request="e30", "#,


can we also add a test hwich includes non-payment authentication headers e.g. Bearer

added some more integration tests with 358cc68

brendanjryan · 2026-03-31T14:59:54Z

src/protocol/methods/tempo/mod.rs

+/// assert_eq!(challenge.id, "a");
+/// assert_eq!(challenge.method.as_str(), "tempo");
+/// ```
+pub fn find_tempo_challenge<'a>(


I think we may need something more robust than this

the client should iterate through all challenges and compare against their own set of supported methods (intent/method) -- we could select naively from that.

With this implementation i think there is a chance the server returns (session, charge) but the client only accepts charge

equivilant mppx flow

https://github.com/wevm/mppx/blob/main/src/client/internal/Fetch.ts#L48-L73

changed in 1c8b258 to mimic mppx

…rsing Verify that Bearer, Basic, and other non-Payment schemes are silently ignored by parse_www_authenticate_all, both as separate header values and mixed within a single header value. Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

The tempo module is gated behind feature = "tempo" only, not feature = "server". Align the re-export cfg accordingly. Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

Replace single-challenge parsing with multi-challenge matching in both fetch.rs and middleware.rs. The client now parses all challenges from the 402 response and selects the first one the provider supports (by method+intent), matching mppx's Fetch.ts behavior. Remove find_tempo_challenge — it was a Tempo-specific shortcut that is superseded by the generic provider.supports() matching. Add HttpError::NoSupportedChallenge for when no challenge matches. Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

Cover the 5 key scenarios for the new challenge selection logic: - Server offers multiple methods, provider selects supported one - First supported challenge is picked when provider supports many - NoSupportedChallenge error when no match exists - Challenges spread across separate WWW-Authenticate headers - Intent mismatch correctly rejected (tempo/session vs tempo/charge) Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

grandizzy self-assigned this Mar 31, 2026

grandizzy force-pushed the fix/multi-challenge-www-authenticate branch 2 times, most recently from f17f8a9 to b644d00 Compare March 31, 2026 14:17

feat: support multi-challenge WWW-Authenticate headers

9c007fe

Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d4417-fcd8-76fd-a3c1-4532e1393c2c

grandizzy force-pushed the fix/multi-challenge-www-authenticate branch from b644d00 to 9c007fe Compare March 31, 2026 14:29

grandizzy marked this pull request as ready for review March 31, 2026 14:38

grandizzy requested review from Slokh, brendanjryan, mattsse and onbjerg as code owners March 31, 2026 14:38

onbjerg reviewed Mar 31, 2026

View reviewed changes

decofe and others added 4 commits March 31, 2026 14:50

docs: add changelog entry for 0.8.3

dacb19f

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

chore: fix formatting

fe4ff3f

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

brendanjryan reviewed Mar 31, 2026

View reviewed changes

grandizzy marked this pull request as draft March 31, 2026 15:35

decofe and others added 8 commits March 31, 2026 15:35

docs: update changelog for multi-challenge matching

2ba0412

Co-authored-by: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d445a-5f14-754e-93cc-84e2bf98afc1

style: fix formatting

9f20ab5

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

docs: clean up changelog to reflect final PR changes only

f6a15d3

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

style: use consistent realm="api" in test challenge strings

88bb24d

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

style: fix formatting

9d7f5ec

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

grandizzy marked this pull request as ready for review March 31, 2026 18:05

grandizzy requested review from brendanjryan and onbjerg March 31, 2026 18:05

grandizzy mentioned this pull request Mar 31, 2026

feat: support multi-challenge MPP headers and charge intent tempoxyz/tempo-foundry#373

Merged

brendanjryan approved these changes Mar 31, 2026

View reviewed changes

merge: resolve changelog conflict with main

997a186

Co-Authored-By: grandizzy <38490174+grandizzy@users.noreply.github.com> Amp-Thread-ID: https://ampcode.com/threads/T-019d44fc-2a43-73a8-92b6-167ceb7b388f

grandizzy merged commit 2f20798 into main Mar 31, 2026
7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: support multi-challenge WWW-Authenticate headers#185

feat: support multi-challenge WWW-Authenticate headers#185
grandizzy merged 15 commits intomainfrom
fix/multi-challenge-www-authenticate

grandizzy commented Mar 31, 2026 •

edited by decofe

Loading

Uh oh!

github-actions bot commented Mar 31, 2026 •

edited

Loading

Uh oh!

onbjerg Mar 31, 2026

Uh oh!

brendanjryan Mar 31, 2026

Uh oh!

grandizzy Mar 31, 2026

Uh oh!

brendanjryan Mar 31, 2026

Uh oh!

brendanjryan Mar 31, 2026

Uh oh!

grandizzy Mar 31, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

grandizzy commented Mar 31, 2026 • edited by decofe Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Changelog not found.

Uh oh!

onbjerg Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

brendanjryan Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

grandizzy Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

brendanjryan Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

brendanjryan Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

grandizzy Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

grandizzy commented Mar 31, 2026 •

edited by decofe

Loading

github-actions bot commented Mar 31, 2026 •

edited

Loading