Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)
* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Bob Dickinson
GitHub
parent
4a927d3978
commit
13dafe457b
1 changed files with 5702 additions and 4444 deletions
116
core/client/runner.ts
Normal file
116
core/client/runner.ts
Normal file
|
|
@ -0,0 +1,116 @@
|
|||
/**
|
||||
* Install-level client config loading and InspectorClient auth option wiring
|
||||
* for Node runners (TUI, CLI).
|
||||
*/
|
||||
|
||||
import { KeyringSecretStore } from "../auth/node/secret-store.js";
|
||||
import type { InspectorClientOptions, InspectorServerSettings } from "../mcp/types.js";
|
||||
import { loadClientConfig } from "./config.js";
|
||||
import type { ClientConfig } from "./types.js";
|
||||
import {
|
||||
getActiveCimdClientMetadataUrl,
|
||||
getActiveEnterpriseManagedAuthIdp,
|
||||
} from "./types.js";
|
||||
|
||||
export interface LoadRunnerClientConfigOptions {
|
||||
/** Explicit path from `--client-config` (or MCP_CLIENT_CONFIG_PATH when unset). */
|
||||
clientConfigPath?: string;
|
||||
}
|
||||
|
||||
/** Load install-level client.json with keychain-backed IdP secrets. */
|
||||
export async function loadRunnerClientConfig(
|
||||
options?: LoadRunnerClientConfigOptions,
|
||||
): Promise<ClientConfig> {
|
||||
const customPath =
|
||||
options?.clientConfigPath?.trim() ||
|
||||
process.env.MCP_CLIENT_CONFIG_PATH?.trim() ||
|
||||
undefined;
|
||||
const secretStore = new KeyringSecretStore();
|
||||
return loadClientConfig({ filePath: customPath, secretStore });
|
||||
}
|
||||
|
||||
export interface RunnerClientConfigOverrides {
|
||||
clientId?: string;
|
||||
clientSecret?: string;
|
||||
clientMetadataUrl?: string;
|
||||
}
|
||||
|
||||
/** HTTP transports (SSE, streamable-http) can use OAuth. */
|
||||
export function isOAuthCapableServerConfig(
|
||||
config: { type?: string } | null | undefined,
|
||||
): boolean {
|
||||
if (!config) return false;
|
||||
return config.type === "sse" || config.type === "streamable-http";
|
||||
}
|
||||
|
||||
/**
|
||||
* Derive OAuth / EMA / CIMD InspectorClient options from install client.json,
|
||||
* per-server settings, and CLI flag overrides (flags win over client.json).
|
||||
*/
|
||||
export function buildRunnerClientAuthOptions(
|
||||
clientConfig: ClientConfig,
|
||||
savedSettings?: InspectorServerSettings,
|
||||
cliOverrides?: RunnerClientConfigOverrides,
|
||||
): Pick<
|
||||
InspectorClientOptions,
|
||||
"oauth" | "enterpriseManagedAuth" | "installEnterpriseManagedAuth"
|
||||
> {
|
||||
const activeIdp = getActiveEnterpriseManagedAuthIdp(clientConfig);
|
||||
const activeCimdUrl = getActiveCimdClientMetadataUrl(clientConfig);
|
||||
|
||||
const oauthFromServer =
|
||||
savedSettings &&
|
||||
(savedSettings.oauthClientId ||
|
||||
savedSettings.oauthClientSecret ||
|
||||
savedSettings.oauthScopes ||
|
||||
savedSettings.enterpriseManaged)
|
||||
? {
|
||||
...(savedSettings.oauthClientId && {
|
||||
clientId: savedSettings.oauthClientId,
|
||||
}),
|
||||
...(savedSettings.oauthClientSecret && {
|
||||
clientSecret: savedSettings.oauthClientSecret,
|
||||
}),
|
||||
...(savedSettings.oauthScopes && {
|
||||
scope: savedSettings.oauthScopes,
|
||||
}),
|
||||
...(savedSettings.enterpriseManaged && {
|
||||
enterpriseManaged: true,
|
||||
}),
|
||||
}
|
||||
: undefined;
|
||||
|
||||
const clientMetadataUrl =
|
||||
cliOverrides?.clientMetadataUrl?.trim() || activeCimdUrl;
|
||||
|
||||
const oauthFromCli =
|
||||
cliOverrides?.clientId ||
|
||||
cliOverrides?.clientSecret ||
|
||||
clientMetadataUrl
|
||||
? {
|
||||
...(cliOverrides?.clientId && { clientId: cliOverrides.clientId }),
|
||||
...(cliOverrides?.clientSecret && {
|
||||
clientSecret: cliOverrides.clientSecret,
|
||||
}),
|
||||
...(clientMetadataUrl && { clientMetadataUrl }),
|
||||
}
|
||||
: undefined;
|
||||
|
||||
const oauth =
|
||||
oauthFromServer || oauthFromCli
|
||||
? {
|
||||
...(oauthFromServer ?? {}),
|
||||
...(oauthFromCli ?? {}),
|
||||
}
|
||||
: undefined;
|
||||
|
||||
return {
|
||||
...(oauth && { oauth }),
|
||||
...(activeIdp && {
|
||||
enterpriseManagedAuth: { idp: activeIdp },
|
||||
}),
|
||||
...(clientConfig.enterpriseManagedAuth && {
|
||||
installEnterpriseManagedAuth: clientConfig.enterpriseManagedAuth,
|
||||
}),
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue