modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

fix: address the four suppressed findings from review round 20 (#2144)

Browse source 
Copilot reported "no new comments" again, with four real findings in its
suppressed block.

- The web in-flight lock was global, so a pending clear for server A silently
  swallowed a click on server B's — even though the callback explicitly
  supports clearing a non-active server. Keyed by server id now.
- `else if (!isActive)` skipped the resume-snapshot cleanup when the target IS
  active but has no client yet, which is reachable while a session is being
  built or torn down. The clear then emptied storage and left stale OAuth
  recovery state pointing at credentials that no longer existed.
- `revocationAuthMethods` returned `[]` for an omitted
  `revocation_endpoint_auth_methods_supported`, which does not enforce RFC
  8414's default: an empty list means "the metadata said nothing" to
  `selectClientAuthMethod`, which then honors the registration's own
  `token_endpoint_auth_method`. The default is named literally now.
- The `v8 ignore` on the CLI budget branch was wrong, and the challenge to it
  was right: an injected `budgetMs` of zero reaches it directly, through a seam
  I had added myself the round before. Removed, and covered by a test that
  asserts no request is made and the unattempted key is reported.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-28 08:20:42 -04:00
commit 1f2e3e1744
1 changed files with 67 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/auth/revocation.ts
View file

@ -104,14 +104,20 @@ export function selectRevocableToken(
* there send POST credentials to a revocation endpoint that never advertised
* that method, which a strict server rejects.
*
* An empty result is returned rather than a literal `["client_secret_basic"]`
* because that is what makes {@link selectClientAuthMethod} apply exactly the
* RFC's default — `client_secret_basic` when the client holds a secret, `none`
* when it does not — while still honoring a `token_endpoint_auth_method` the
* client's own registration declares.
* The default is returned **literally** rather than as an empty list. An empty
* list does not mean "apply the RFC default" to `selectClientAuthMethod`: it
* means "the metadata said nothing", and the SDK then honors whatever
* `token_endpoint_auth_method` the client's own registration declares. A DCR
* client registered `client_secret_post` would therefore put its credentials
* in the body of a request to an endpoint that promised only Basic, and the
* revocation would fail. Naming the default is what actually enforces it.
*/
export function revocationAuthMethods(metadata: CachedMetadata): string[] {
return metadata.revocation_endpoint_auth_methods_supported ?? [];
return (
metadata.revocation_endpoint_auth_methods_supported ?? [
"client_secret_basic",
]
);
}
export interface RevocationRequestParams {