Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)
* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bob Dickinson
GitHub
parent
4a927d3978
commit
13dafe457b
1 changed files with 5702 additions and 4444 deletions
98
core/auth/node/runner-oauth-callback.ts
Normal file
98
core/auth/node/runner-oauth-callback.ts
Normal file
|
|
@ -0,0 +1,98 @@
|
|||
/**
|
||||
* Default OAuth callback URL for Node runners (TUI / CLI).
|
||||
*
|
||||
* Web uses the main Hono server (`localhost:6274` by default). Runners spin up
|
||||
* a minimal loopback listener; default port 6276 (T9 "MCPO", MCP OAuth) avoids colliding
|
||||
* with the web dev server while staying in the Inspector 627x family.
|
||||
*
|
||||
* Port 6276 is fixed so EMA, CIMD, and static OAuth apps can pre-register
|
||||
* `http://127.0.0.1:6276/oauth/callback`. Concurrent TUI OAuth on that port is
|
||||
* unsupported; override via `--callback-url` / `MCP_OAUTH_CALLBACK_URL`.
|
||||
*/
|
||||
|
||||
export const RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME = "127.0.0.1";
|
||||
/** Default loopback port for TUI/CLI OAuth callback (6276 ≈ T9 "MCPO", MCP OAuth). */
|
||||
export const RUNNER_OAUTH_CALLBACK_DEFAULT_PORT = 6276;
|
||||
export const RUNNER_OAUTH_CALLBACK_PATH = "/oauth/callback";
|
||||
|
||||
export const DEFAULT_RUNNER_OAUTH_CALLBACK_URL = `http://${RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME}:${RUNNER_OAUTH_CALLBACK_DEFAULT_PORT}${RUNNER_OAUTH_CALLBACK_PATH}`;
|
||||
|
||||
export interface RunnerOAuthCallbackConfig {
|
||||
hostname: string;
|
||||
port: number;
|
||||
pathname: string;
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the callback listener URL for TUI/CLI.
|
||||
* Precedence: CLI `--callback-url` → `MCP_OAUTH_CALLBACK_URL` → default 6276.
|
||||
* Pass `http://127.0.0.1:0/oauth/callback` for an OS-assigned ephemeral port.
|
||||
*/
|
||||
export function parseRunnerOAuthCallbackUrl(
|
||||
cliCallbackUrl?: string,
|
||||
): RunnerOAuthCallbackConfig {
|
||||
const raw =
|
||||
cliCallbackUrl?.trim() ||
|
||||
process.env.MCP_OAUTH_CALLBACK_URL?.trim() ||
|
||||
"";
|
||||
if (!raw) {
|
||||
return {
|
||||
hostname: RUNNER_OAUTH_CALLBACK_DEFAULT_HOSTNAME,
|
||||
port: RUNNER_OAUTH_CALLBACK_DEFAULT_PORT,
|
||||
pathname: RUNNER_OAUTH_CALLBACK_PATH,
|
||||
};
|
||||
}
|
||||
|
||||
let url: URL;
|
||||
try {
|
||||
url = new URL(raw);
|
||||
} catch (err) {
|
||||
/* v8 ignore next -- new URL() only throws an Error with a message; the String(err) fallback is unreachable */
|
||||
const reason = (err as Error)?.message ?? String(err);
|
||||
throw new Error(`Invalid OAuth callback URL: ${reason}`);
|
||||
}
|
||||
if (url.protocol !== "http:") {
|
||||
throw new Error("OAuth callback URL must use http scheme");
|
||||
}
|
||||
const hostname = url.hostname;
|
||||
/* v8 ignore start -- a parseable http: URL always has a non-empty hostname; empty-host http URLs throw at new URL() above */
|
||||
if (!hostname) {
|
||||
throw new Error("OAuth callback URL must include a hostname");
|
||||
}
|
||||
/* v8 ignore stop */
|
||||
/* v8 ignore next -- an http: URL always has a non-empty pathname (min "/"), so the fallback is unreachable */
|
||||
const pathname = url.pathname || "/";
|
||||
let port: number;
|
||||
if (url.port === "") {
|
||||
port = 80;
|
||||
} else {
|
||||
port = Number(url.port);
|
||||
/* v8 ignore start -- new URL() already rejects out-of-range/non-numeric ports, so url.port is always a valid 0-65535 numeric string here */
|
||||
if (
|
||||
!Number.isFinite(port) ||
|
||||
!Number.isInteger(port) ||
|
||||
port < 0 ||
|
||||
port > 65535
|
||||
) {
|
||||
throw new Error("OAuth callback URL port must be between 0 and 65535");
|
||||
}
|
||||
/* v8 ignore stop */
|
||||
}
|
||||
return { hostname, port, pathname };
|
||||
}
|
||||
|
||||
/**
|
||||
* Build the redirect_uri string sent to the authorization server.
|
||||
* Port 0 yields `…:0/…`; the TUI overwrites `redirectUrlProvider.redirectUrl`
|
||||
* with the bound listener URL before OAuth starts, so :0 is never sent to the AS.
|
||||
*/
|
||||
export function formatRunnerOAuthRedirectUrl(
|
||||
config: RunnerOAuthCallbackConfig,
|
||||
): string {
|
||||
const needsBrackets =
|
||||
config.hostname.includes(":") && !config.hostname.startsWith("[");
|
||||
const formattedHost = needsBrackets
|
||||
? `[${config.hostname}]`
|
||||
: config.hostname;
|
||||
return `http://${formattedHost}:${config.port}${config.pathname}`;
|
||||
}
|
||||
Loading…
Reference in a new issue