modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

feat(core): port v1.5 InspectorClient + transports + auth subsystem (#1302) (#1306)

Browse source 
* wip(core): bulk-copy v1.5 InspectorClient runtime files (#1302)

Verbatim ports from origin/v1.5/main into v2/main core/:

- logging/ (2 files)
- storage/ + storage/adapters/ (4 files)
- auth/ + auth/browser/ + auth/node/ + auth/remote/ (16 files)
- mcp/config.ts + mcp/node/ (4 files, stdio transport)
- mcp/remote/ + mcp/remote/node/ (12 files, HTTP/SSE transport)
- mcp/inspectorClient.ts (~2169 LOC), messageTrackingTransport,
  fetchTracking, oauthManager, index, state/index

Total: ~7,800 LOC of source files, copied unmodified via
`git show origin/v1.5/main:<path> > <dest>`.

Also:
- Add deps: pino, hono, @hono/node-server, atomically, zustand, @types/node
- tsconfig.app.json: extend paths to resolve new node-only deps from
  core/, add "node" to types, disable erasableSyntaxOnly (v1.5 code
  uses parameter properties — TODO to re-enable in follow-up)

Compiles down to 47 type errors, all in three categories:
- 24 TS2305: v2 dropped v1.5 type exports (InspectorClientOptions,
  CreateTransport, InspectorClientEnvironment, AppRendererClient,
  SamplingCreateMessage class, ElicitationCreateMessage class,
  jsonUtils helpers, OAuth events). Per user direction, will re-add
  these to v2's diverged files (types.ts, samplingCreateMessage.ts,
  etc.) so the ported code stays verbatim.
- 15 TS7006: implicit-any params in v1.5 code (v1.5 tsconfig was
  looser than v2's noImplicitAny). Need explicit annotations.
- 8 other TS errors: ../package.json import, Transport|null narrowing,
  hono Context generic mismatch, one unused parameter.

Tests not yet ported (19 files, ~11,170 LOC).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* wip(core): integrate ported v1.5 InspectorClient + port tests (#1302)

Source integration (typecheck + build now pass):
- Re-add v1.5 types/classes dropped during v2 evolution:
  - types.ts: CreateTransport*, AppRendererClient, InspectorClient{Environment,Options}
  - samplingCreateMessage.ts / elicitationCreateMessage.ts: classes + keep v2's
    InspectorPending{Sampling,Elicitation} interface
  - inspectorClientEventTarget.ts: oauth* event keys
  - json/jsonUtils.ts: convertParameterValue / convertToolParameters /
    convertPromptArguments + ParameterSchema
- inspectorClient.ts: replace `../package.json` import (v2 has no
  core/package.json) with a hardcoded identity constant
- remote/node/server.ts: cast hono Context for streamSSE (hono's
  generic typing tightened since v1.5)
- oauth-callback-server.ts: drop unused hostname field
- tsconfig: enable @types/node, add paths for new bare-module deps
  (pino, zustand, hono, atomically) in app + test configs
- vite.config.ts: mirror those module aliases for the unit project
  (which runs from repoRoot)

Tests ported (19 files, ~11K LOC) under clients/web/src/test/core/:
- All core/__tests__/auth/* (7 files)
- inspectorClient.test.ts + 4 OAuth variants
- mcp/oauthManager.test.ts, jsonUtils.test.ts
- transport, remote-transport, remote-server-config, storage-adapters
- helpers/oauth-client-fixtures.ts
Bulk-rewrote `from "../mcp/…"` → `from "@inspector/core/mcp/…"` etc.

Current state:
- typecheck: 0 errors
- build: passes (vite v8, 788 modules)
- unit tests: 1014 / 1034 pass (937 pre-existing + 77 new core tests)
- 20 failures in 13 files; failure modes:
  - 13 file-load failures needing the v1.5 `test-servers/` package
    (@modelcontextprotocol/inspector-test-server) which isn't in v2 yet
    or real fs/network not available in happy-dom
  - 7 assertion failures in discovery.test.ts + state-machine.test.ts
    (SDK 1.29 vs 1.25 API drift — mocks don't match new shape)

Coverage gate not yet checked against new files.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* wip(core): port test-servers, more types, partial test integration (#1302)

- Port v1.5 test-servers/ package (12 files, ~5K LOC) under
  repo-root/test-servers/, wire @modelcontextprotocol/inspector-test-server
  alias in both vite.config.ts (regex form) and tsconfig.test.json.
- Add deps: express ^5, yaml ^2, @types/express ^5.
- Re-export InspectorClientOptions/Environment/Transport* from inspectorClient.ts
  so v1.5 tests that import them from that module path keep resolving.
- Switch InspectorClientEventMap to use SamplingCreateMessage /
  ElicitationCreateMessage classes (matches v1.5 event payload contracts)
  while keeping the InspectorPending{Sampling,Elicitation} interfaces in
  the *.ts modules for v2 consumers that still use them.
- Fix verbatim-module-syntax issue in test-servers and drop unused stdio
  config field.
- Adjust inspectorClient.test.ts task types to TaskWithOptionalCreatedAt
  (SDK 1.29 tightened Task shape vs v1.5's 1.25).
- Drop spurious maxMessages/maxFetchRequests/maxStderrLogEvents from
  remote-transport.test.ts (never on InspectorClientOptions).

State:
- typecheck: 0 errors
- build: passes
- unit tests: 1099 / 1270 pass
- 171 failures in 10 test files, almost all integration tests that need
  real HTTP/fs/network (happy-dom can't host them). Next: add a node-env
  vitest project to run these properly.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(core): port v1.5 InspectorClient + transports + auth subsystem (#1302)

Bulk-port of the v1.5 core runtime (~7,800 LOC source + ~16K LOC tests +
~5K LOC test-servers/) into v2. Files copied verbatim from origin/v1.5/main
via `git show >`; only minimal adapters added on the v2 side.

Subsystems landed
-----------------
- core/logging/, core/storage/, core/auth/ (browser + node + remote)
- core/mcp/ runtime: inspectorClient.ts (2169 LOC), oauthManager,
  messageTrackingTransport, fetchTracking, config, index
- core/mcp/node/ (stdio transport)
- core/mcp/remote/ + remote/node/ (HTTP/SSE transport + Hono server)
- test-servers/ package (composable MCP test servers, fixtures, harness)

v2 adapter layer
----------------
- types.ts: append CreateTransport*, AppRendererClient,
  InspectorClient{Environment,Options} (v2 had pruned these — v1.5 needs them)
- samplingCreateMessage / elicitationCreateMessage: keep v1.5 classes AND
  v2's Inspector Pending* interfaces in the same files
- inspectorClientEventTarget: add oauth* event keys; switch pending
  sampling/elicitation payloads to the classes (matches v1.5 contracts)
- json/jsonUtils: append convertParameterValue/convertToolParameters/
  convertPromptArguments + ParameterSchema
- inspectorClient.ts: re-export Options/Environment/Transport* so tests
  that import these from `inspectorClient.js` keep resolving; replace
  `../package.json` import with a hardcoded identity (v2 has no core/package.json)
- remote/node/server.ts: cast hono Context for streamSSE (hono generic
  tightened since v1.5)
- oauth-callback-server: drop unused hostname field
- tsconfig.app.json / tsconfig.test.json: add @types/node + paths for
  pino/zustand/hono/@hono/node-server/atomically/express/yaml, disable
  erasableSyntaxOnly (parameter-property syntax from v1.5)
- vite.config.ts: regex-form module aliases (so the package's exports
  field handles subpaths like `hono/streaming`, `zustand/middleware`),
  alias for @modelcontextprotocol/inspector-test-server → test-servers/src

Tests
-----
- 19 v1.5 test files copied under clients/web/src/test/core/,
  imports rewired to @inspector/core/* and @modelcontextprotocol/inspector-test-server
- 1004 unit tests pass; 298 storybook tests pass; coverage gate passes

Known follow-ups (out-of-scope here, tracked in TODOs)
------------------------------------------------------
- 13 integration test files are excluded from the unit project (spawn real
  HTTP/stdio servers; run real OAuth flows; mock SDK auth → happy-dom CORS).
  Needs a node-env vitest project. Files listed under `test.projects[0].test.exclude`.
- Source files exercised only by those integration tests are excluded from
  the coverage gate pending the node-env project. Listed under
  `test.coverage.exclude` with comment.
- Manual smoke tests against real stdio / HTTP / OAuth server per the AC
  on #1302 still need verification locally.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs/fix: address #1306 review (AGENTS tree, #1307 links, @types/node, .substr)

- AGENTS.md: expand the project-structure tree to include all v1.5-ported
  subsystems (core/auth/{browser,node,remote}, core/storage, core/logging,
  core/mcp/{node,remote/{,node}}, core/mcp/state) plus the new top-level
  test-servers/ directory (with a note about its @modelcontextprotocol/
  inspector-test-server alias).
- vite.config.ts: reference #1307 from both the test exclude block and the
  coverage exclude block so the next person editing either sees the
  marching order for shrinking the lists.
- package.json: restore @types/node to ^24 (an earlier `npm install
  --save-dev @types/node@^22` accidentally pinned it lower than the repo
  was using; nothing here required ^22).
- core/mcp/fetchTracking.ts: replace deprecated .substr(2, 9) with
  .slice(2, 11) to match the convention in core/mcp/inspectorClient.ts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-05-15 15:36:17 -04:00 • committed by GitHub
commit 0ead1deea6
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 24387 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

661
test-servers/src/test-server-oauth.ts Normal file
View file

@ -0,0 +1,661 @@
/**
* OAuth Test Server Infrastructure
*
* Provides OAuth 2.1 authorization server functionality for test servers.
* Integrates with Express apps to add OAuth endpoints and Bearer token verification.
*/
import crypto from "node:crypto";
import type { Request, Response } from "express";
import express from "express";
import type { ServerConfig } from "./composable-test-server.js";
/**
* OAuth configuration from ServerConfig
*/
export type OAuthConfig = NonNullable<ServerConfig["oauth"]>;
/**
* Set up OAuth routes on an Express application
* This adds all OAuth endpoints (authorization, token, metadata, etc.)
*
* @param app - Express application
* @param config - OAuth configuration
*/
export function setupOAuthRoutes(
app: express.Application,
config: OAuthConfig,
): void {
// OAuth metadata endpoints (RFC 8414)
setupMetadataEndpoints(app, config);
// OAuth authorization endpoint
setupAuthorizationEndpoint(app, config);
// OAuth token endpoint
setupTokenEndpoint(app, config);
// Dynamic Client Registration endpoint (if enabled)
if (config.supportDCR) {
setupDCREndpoint(app);
}
}
/**
* Create Bearer token verification middleware
* Returns 401 if token is missing or invalid when requireAuth is true
*
* @param config - OAuth configuration
* @returns Express middleware function
*/
export function createBearerTokenMiddleware(
config: OAuthConfig,
): express.RequestHandler {
return async (req: Request, res: Response, next: express.NextFunction) => {
if (!config.requireAuth) {
return next();
}
const authHeader = req.headers.authorization;
if (!authHeader || !authHeader.startsWith("Bearer ")) {
// Return 401 - the SDK's transport should detect this and throw an error
// For streamable-http, the SDK checks response status and throws StreamableHTTPError with code 401
res.status(401);
res.setHeader("Content-Type", "application/json");
res.setHeader("WWW-Authenticate", "Bearer");
// Return a JSON-RPC error response format that the SDK will recognize
res.json({
jsonrpc: "2.0",
error: {
code: -32603,
message: "Unauthorized: Missing or invalid Bearer token (401)",
},
id: null,
});
return;
}
const token = authHeader.substring(7); // Remove "Bearer " prefix
// Verify token (simplified for test server - in production, use proper JWT verification)
if (!isValidToken(token)) {
// Return 401 - the SDK's transport should detect this and throw an error
res.status(401);
res.setHeader("Content-Type", "application/json");
res.setHeader("WWW-Authenticate", "Bearer");
// Return a JSON-RPC error response format that the SDK will recognize
res.json({
jsonrpc: "2.0",
error: {
code: -32603,
message: "Unauthorized: Invalid or expired token (401)",
},
id: null,
});
return;
}
// Attach token info to request for use in handlers
(req as Request & { oauthToken?: string }).oauthToken = token;
next();
};
}
/**
* Set up OAuth metadata endpoints (RFC 8414)
*/
function setupMetadataEndpoints(
app: express.Application,
config: OAuthConfig,
): void {
const scopes = config.scopesSupported || ["mcp"];
// OAuth Authorization Server Metadata
app.get(
"/.well-known/oauth-authorization-server",
(req: Request, res: Response) => {
// Use request's host to get actual server URL (since port is assigned dynamically)
const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
const actualIssuerUrl = new URL(requestBaseUrl);
const metadata = {
issuer: actualIssuerUrl.href,
authorization_endpoint: new URL("/oauth/authorize", actualIssuerUrl)
.href,
token_endpoint: new URL("/oauth/token", actualIssuerUrl).href,
scopes_supported: scopes,
response_types_supported: ["code"],
grant_types_supported: ["authorization_code", "refresh_token"],
code_challenge_methods_supported: ["S256"], // PKCE support
token_endpoint_auth_methods_supported: ["client_secret_basic", "none"],
...(config.supportDCR && {
registration_endpoint: new URL("/oauth/register", actualIssuerUrl)
.href,
}),
...(config.supportCIMD && {
client_id_metadata_document_supported: true,
}),
};
res.json(metadata);
},
);
// OAuth Protected Resource Metadata
app.get(
"/.well-known/oauth-protected-resource",
(req: Request, res: Response) => {
// Use request's host so resource matches actual server URL (port 0 → assigned port)
const requestBaseUrl = `${req.protocol}://${req.get("host")}`;
const actualResourceUrl = new URL("/", requestBaseUrl).href;
const metadata = {
resource: actualResourceUrl,
authorization_servers: [actualResourceUrl],
scopes_supported: scopes,
};
res.json(metadata);
},
);
}
/**
* Set up OAuth authorization endpoint
* For test servers, this auto-approves requests and redirects with authorization code
*/
function setupAuthorizationEndpoint(
app: express.Application,
config: OAuthConfig,
): void {
app.get("/oauth/authorize", async (req: Request, res: Response) => {
const {
client_id,
redirect_uri,
response_type,
scope,
state,
code_challenge,
code_challenge_method,
} = req.query;
// Validate required parameters
if (!client_id || !redirect_uri || !response_type) {
res.status(400).json({
error: "invalid_request",
error_description: "Missing required parameters",
});
return;
}
if (response_type !== "code") {
res.status(400).json({ error: "unsupported_response_type" });
return;
}
// Validate client (check static clients, DCR, or CIMD)
const client = await findClient(client_id as string, config);
if (!client) {
res.status(400).json({ error: "invalid_client" });
return;
}
// Validate redirect_uri
if (
client.redirectUris &&
!client.redirectUris.includes(redirect_uri as string)
) {
res.status(400).json({
error: "invalid_request",
error_description: "Invalid redirect_uri",
});
return;
}
// Validate PKCE
if (code_challenge_method && code_challenge_method !== "S256") {
res.status(400).json({
error: "invalid_request",
error_description: "Unsupported code_challenge_method",
});
return;
}
// For test servers, auto-approve and generate authorization code
const authCode = generateAuthorizationCode();
// Store authorization code temporarily (in production, use proper storage)
storeAuthorizationCode(authCode, {
clientId: client_id as string,
redirectUri: redirect_uri as string,
codeChallenge: code_challenge as string | undefined,
scope: scope as string | undefined,
});
// Redirect with authorization code
const redirectUrl = new URL(redirect_uri as string);
redirectUrl.searchParams.set("code", authCode);
if (state) {
redirectUrl.searchParams.set("state", state as string);
}
res.redirect(redirectUrl.href);
});
}
/**
* Set up OAuth token endpoint
*/
function setupTokenEndpoint(
app: express.Application,
config: OAuthConfig,
): void {
app.post(
"/oauth/token",
express.urlencoded({ extended: true }),
async (req: Request, res: Response) => {
const {
grant_type,
code,
redirect_uri,
client_id: bodyClientId,
code_verifier,
refresh_token,
} = req.body;
// Extract client_id from either body (client_secret_post) or Authorization header (client_secret_basic)
let client_id = bodyClientId;
let client_secret: string | undefined;
// Check Authorization header for client_secret_basic
const authHeader = req.headers.authorization;
if (authHeader && authHeader.startsWith("Basic ")) {
const credentials = Buffer.from(authHeader.slice(6), "base64").toString(
"utf-8",
);
const [id, secret] = credentials.split(":", 2);
client_id = id;
client_secret = secret;
}
if (grant_type === "authorization_code") {
// Authorization code flow
if (!code || !redirect_uri || !client_id) {
res.status(400).json({
error: "invalid_request",
error_description: "Missing required parameters",
});
return;
}
const authCodeData = getAuthorizationCode(code);
if (!authCodeData) {
res.status(400).json({
error: "invalid_grant",
error_description: "Invalid or expired authorization code",
});
return;
}
// Verify client
const client = await findClient(client_id, config);
if (!client || client.clientId !== authCodeData.clientId) {
res.status(400).json({ error: "invalid_client" });
return;
}
// Verify client secret if provided (for client_secret_basic)
if (
client_secret &&
client.clientSecret &&
client.clientSecret !== client_secret
) {
res.status(400).json({ error: "invalid_client" });
return;
}
// Verify redirect_uri
if (authCodeData.redirectUri !== redirect_uri) {
res.status(400).json({
error: "invalid_grant",
error_description: "Redirect URI mismatch",
});
return;
}
// Verify PKCE code verifier
if (authCodeData.codeChallenge) {
if (!code_verifier) {
res.status(400).json({
error: "invalid_request",
error_description: "code_verifier required",
});
return;
}
// Proper PKCE verification: code_challenge should be base64url(SHA256(code_verifier))
const hash = crypto
.createHash("sha256")
.update(code_verifier)
.digest();
// Convert to base64url (replace + with -, / with _, remove padding)
const expectedChallenge = hash
.toString("base64")
.replace(/\+/g, "-")
.replace(/\//g, "_")
.replace(/=/g, "");
if (authCodeData.codeChallenge !== expectedChallenge) {
res.status(400).json({
error: "invalid_grant",
error_description: "Invalid code_verifier",
});
return;
}
}
// Generate access token
const accessToken = generateAccessToken();
const tokenExpiration = config.tokenExpirationSeconds || 3600;
const response: {
access_token: string;
token_type: string;
expires_in: number;
scope: string;
refresh_token?: string;
} = {
access_token: accessToken,
token_type: "Bearer",
expires_in: tokenExpiration,
scope: authCodeData.scope || config.scopesSupported?.[0] || "mcp",
};
// Add refresh token if supported
if (config.supportRefreshTokens !== false) {
const refreshToken = generateRefreshToken();
response.refresh_token = refreshToken;
storeRefreshToken(refreshToken, {
clientId: client_id,
scope: authCodeData.scope,
});
}
res.json(response);
} else if (grant_type === "refresh_token") {
// Refresh token flow
if (!refresh_token || !client_id) {
res.status(400).json({ error: "invalid_request" });
return;
}
const refreshTokenData = getRefreshToken(refresh_token);
if (!refreshTokenData || refreshTokenData.clientId !== client_id) {
res.status(400).json({ error: "invalid_grant" });
return;
}
const accessToken = generateAccessToken();
const tokenExpiration = config.tokenExpirationSeconds || 3600;
res.json({
access_token: accessToken,
token_type: "Bearer",
expires_in: tokenExpiration,
scope: refreshTokenData.scope || config.scopesSupported?.[0] || "mcp",
});
} else {
res.status(400).json({ error: "unsupported_grant_type" });
}
},
);
}
/**
* Set up Dynamic Client Registration endpoint
*/
function setupDCREndpoint(app: express.Application): void {
app.post("/oauth/register", express.json(), (req: Request, res: Response) => {
const { redirect_uris, client_name, scope } = req.body;
if (
!redirect_uris ||
!Array.isArray(redirect_uris) ||
redirect_uris.length === 0
) {
res.status(400).json({ error: "invalid_client_metadata" });
return;
}
dcrRequests.push({ redirect_uris: [...redirect_uris] });
// Generate client ID and secret
const clientId = generateClientId();
const clientSecret = generateClientSecret();
// Store registered client
registerClient(clientId, {
clientSecret,
redirectUris: redirect_uris,
clientName: client_name,
scope,
});
res.status(201).json({
client_id: clientId,
client_secret: clientSecret,
redirect_uris,
...(client_name && { client_name }),
...(scope && { scope }),
});
});
}
// In-memory storage for test server (simplified - not production-ready)
interface AuthorizationCodeData {
clientId: string;
redirectUri: string;
codeChallenge?: string;
scope?: string;
expiresAt: number;
}
interface RefreshTokenData {
clientId: string;
scope?: string;
}
interface RegisteredClient {
clientSecret?: string;
redirectUris: string[];
clientName?: string;
scope?: string;
}
const authorizationCodes = new Map<string, AuthorizationCodeData>();
const accessTokens = new Set<string>();
const refreshTokens = new Map<string, RefreshTokenData>();
const registeredClients = new Map<string, RegisteredClient>();
/** Recorded DCR request bodies (redirect_uris) for tests that verify both URLs are registered. */
const dcrRequests: Array<{ redirect_uris: string[] }> = [];
/**
* Check if a string is a valid URL
*/
function isUrl(str: string): boolean {
try {
new URL(str);
return true;
} catch {
return false;
}
}
/**
* Fetch client metadata document from URL (for CIMD)
*/
async function fetchClientMetadata(metadataUrl: string): Promise<{
redirect_uris: string[];
token_endpoint_auth_method?: string;
grant_types?: string[];
response_types?: string[];
client_name?: string;
client_uri?: string;
scope?: string;
} | null> {
try {
const response = await fetch(metadataUrl);
if (!response.ok) {
return null;
}
const metadata = await response.json();
return metadata;
} catch {
return null;
}
}
async function findClient(
clientId: string,
config: OAuthConfig,
): Promise<{
clientId: string;
clientSecret?: string;
redirectUris?: string[];
} | null> {
// Check static clients first
if (config.staticClients) {
const staticClient = config.staticClients.find(
(c) => c.clientId === clientId,
);
if (staticClient) {
return {
clientId: staticClient.clientId,
clientSecret: staticClient.clientSecret,
redirectUris: staticClient.redirectUris,
};
}
}
// Check registered clients (DCR)
if (registeredClients.has(clientId)) {
const client = registeredClients.get(clientId)!;
return {
clientId,
clientSecret: client.clientSecret,
redirectUris: client.redirectUris,
};
}
// Check CIMD: if client_id is a URL and CIMD is supported, fetch metadata
if (config.supportCIMD && isUrl(clientId)) {
const metadata = await fetchClientMetadata(clientId);
if (
metadata &&
metadata.redirect_uris &&
Array.isArray(metadata.redirect_uris)
) {
// For CIMD, the client_id is the URL itself, and there's no client_secret
// (CIMD uses token_endpoint_auth_method: "none" typically)
return {
clientId, // The URL is the client_id
clientSecret: undefined, // CIMD typically doesn't use secrets
redirectUris: metadata.redirect_uris,
};
}
}
return null;
}
function generateAuthorizationCode(): string {
return `test_auth_code_${Date.now()}_${Math.random().toString(36).substring(7)}`;
}
function storeAuthorizationCode(
code: string,
data: Omit<AuthorizationCodeData, "expiresAt">,
): void {
authorizationCodes.set(code, {
...data,
expiresAt: Date.now() + 60000, // 1 minute expiration
});
}
function getAuthorizationCode(code: string): AuthorizationCodeData | null {
const data = authorizationCodes.get(code);
if (!data) {
return null;
}
// Check expiration
if (Date.now() > data.expiresAt) {
authorizationCodes.delete(code);
return null;
}
// Delete after use (authorization codes are single-use)
authorizationCodes.delete(code);
return data;
}
function generateAccessToken(): string {
const token = `test_access_token_${Date.now()}_${Math.random().toString(36).substring(7)}`;
accessTokens.add(token);
return token;
}
function generateRefreshToken(): string {
return `test_refresh_token_${Date.now()}_${Math.random().toString(36).substring(7)}`;
}
function storeRefreshToken(token: string, data: RefreshTokenData): void {
refreshTokens.set(token, data);
}
function getRefreshToken(token: string): RefreshTokenData | null {
return refreshTokens.get(token) || null;
}
function generateClientId(): string {
return `test_client_${Date.now()}_${Math.random().toString(36).substring(7)}`;
}
function generateClientSecret(): string {
return `test_secret_${Math.random().toString(36).substring(2, 15)}`;
}
function registerClient(clientId: string, client: RegisteredClient): void {
registeredClients.set(clientId, client);
}
function isValidToken(token: string): boolean {
// Simplified token validation for test server
// In production, verify JWT signature, expiration, etc.
return accessTokens.has(token);
}
/**
* Clear all OAuth test data (useful for test cleanup)
*/
export function clearOAuthTestData(): void {
authorizationCodes.clear();
accessTokens.clear();
refreshTokens.clear();
registeredClients.clear();
dcrRequests.length = 0;
}
/**
* Returns recorded DCR request bodies (redirect_uris) for tests that verify
* both normal and guided redirect URLs are registered.
*/
export function getDCRRequests(): Array<{ redirect_uris: string[] }> {
return dcrRequests;
}
/**
* Invalidate a single access token (remove from valid set).
* Used by E2E tests to simulate expired/revoked access token while keeping
* refresh_token valid, so 401 → auth() → refresh → retry can be exercised.
*/
export function invalidateAccessToken(token: string): void {
accessTokens.delete(token);
}