All of the mid-session and step-up auth work
This commit is contained in:
Bob Dickinson
parent
1f31e0f1f8
commit
562bdd00f1
13 changed files with 11437 additions and 1212 deletions
|
|
@ -55,6 +55,9 @@ const h = vi.hoisted(() => {
|
|||
clearOAuthTokens: vi.fn(),
|
||||
completeOAuthFlow: vi.fn(async (): Promise<void> => {}),
|
||||
getOAuthState: vi.fn(async () => undefined),
|
||||
callTool: vi.fn(),
|
||||
checkAuthChallengeSatisfied: vi.fn(async () => false),
|
||||
handleAuthChallenge: vi.fn(async () => ({ kind: "satisfied" as const })),
|
||||
};
|
||||
// Captured options from the most recent callbackServer.start(), so a test can
|
||||
// drive the onCallback / onError handlers the OAuth flows register.
|
||||
|
|
@ -95,6 +98,11 @@ const h = vi.hoisted(() => {
|
|||
completeOAuthFlow = (...a: unknown[]) =>
|
||||
clientSpies.completeOAuthFlow(...a);
|
||||
getOAuthState = (...a: unknown[]) => clientSpies.getOAuthState(...a);
|
||||
callTool = (...a: unknown[]) => clientSpies.callTool(...a);
|
||||
checkAuthChallengeSatisfied = (...a: unknown[]) =>
|
||||
clientSpies.checkAuthChallengeSatisfied(...a);
|
||||
handleAuthChallenge = (...a: unknown[]) =>
|
||||
clientSpies.handleAuthChallenge(...a);
|
||||
readResource = vi.fn(async () => ({
|
||||
result: { contents: [{ uri: "file://x", text: "hello" }] },
|
||||
}));
|
||||
|
|
@ -185,16 +193,25 @@ vi.mock("@inspector/core/auth/index.js", async (importOriginal) => {
|
|||
},
|
||||
};
|
||||
});
|
||||
vi.mock("@inspector/core/auth/node/index.js", () => ({
|
||||
createOAuthCallbackServer: h.createOAuthCallbackServer,
|
||||
NodeOAuthStorage: class {},
|
||||
}));
|
||||
vi.mock("@inspector/core/auth/node/index.js", async (importOriginal) => {
|
||||
const actual =
|
||||
await importOriginal<typeof import("@inspector/core/auth/node/index.js")>();
|
||||
return {
|
||||
...actual,
|
||||
createOAuthCallbackServer: h.createOAuthCallbackServer,
|
||||
NodeOAuthStorage: class {},
|
||||
};
|
||||
});
|
||||
vi.mock("../src/utils/openUrl.js", () => ({
|
||||
openUrl: h.openUrl,
|
||||
}));
|
||||
|
||||
import App from "../src/App.js";
|
||||
import type { TuiServer } from "../src/tui-servers.js";
|
||||
import {
|
||||
AuthRecoveryRequiredError,
|
||||
EMA_STEP_UP_PENDING_URL,
|
||||
} from "@inspector/core/auth/challenge.js";
|
||||
|
||||
const tick = () => new Promise((r) => setTimeout(r, 25));
|
||||
const callbackUrlConfig = { hostname: "127.0.0.1", port: 0, pathname: "/cb" };
|
||||
|
|
@ -234,6 +251,27 @@ function oneHttp(): Record<string, TuiServer> {
|
|||
};
|
||||
}
|
||||
|
||||
function oneEmaHttp(): Record<string, TuiServer> {
|
||||
return {
|
||||
ema: {
|
||||
config: { type: "streamable-http", url: "http://localhost:8080/mcp" },
|
||||
settings: {
|
||||
requestTimeout: 0,
|
||||
metadata: [],
|
||||
headers: [],
|
||||
env: [],
|
||||
roots: [],
|
||||
maxFetchRequests: 1000,
|
||||
taskTtl: 0,
|
||||
connectionTimeout: 0,
|
||||
oauthClientId: "client_ema_test",
|
||||
oauthScopes: "tools:read",
|
||||
enterpriseManaged: true,
|
||||
},
|
||||
} as never,
|
||||
};
|
||||
}
|
||||
|
||||
// Mixed catalog: an OAuth-capable http server first (auto-selected) followed by
|
||||
// a stdio server <20> drives per-server tab gating + the tab-switch-away effects.
|
||||
function httpThenStdio(): Record<string, TuiServer> {
|
||||
|
|
@ -466,6 +504,11 @@ beforeEach(() => {
|
|||
h.clientSpies.completeOAuthFlow.mockResolvedValue(undefined);
|
||||
h.clientSpies.getOAuthState.mockReset();
|
||||
h.clientSpies.getOAuthState.mockResolvedValue(undefined);
|
||||
h.clientSpies.callTool.mockReset();
|
||||
h.clientSpies.checkAuthChallengeSatisfied.mockReset();
|
||||
h.clientSpies.checkAuthChallengeSatisfied.mockResolvedValue(false);
|
||||
h.clientSpies.handleAuthChallenge.mockReset();
|
||||
h.clientSpies.handleAuthChallenge.mockResolvedValue({ kind: "satisfied" });
|
||||
});
|
||||
|
||||
afterEach(() => {
|
||||
|
|
@ -936,4 +979,65 @@ describe("App (OAuth flows)", () => {
|
|||
await h.cb.opts!.onCallback({ code: "x" });
|
||||
await expectFrame(r, "cb-string");
|
||||
});
|
||||
|
||||
it("shows EMA step-up confirmation on tool auth recovery instead of auto OAuth", async () => {
|
||||
const challenge = {
|
||||
reason: "insufficient_scope" as const,
|
||||
requiredScopes: ["env:read"],
|
||||
authorizationScopes: ["tools:read", "env:read"],
|
||||
context: { toolName: "get-env" },
|
||||
};
|
||||
h.clientSpies.callTool.mockRejectedValue(
|
||||
new AuthRecoveryRequiredError(EMA_STEP_UP_PENDING_URL, challenge, {
|
||||
emaStepUpConfirm: true,
|
||||
}),
|
||||
);
|
||||
h.clientSpies.checkAuthChallengeSatisfied.mockResolvedValue(false);
|
||||
h.ctrl.status = "connected";
|
||||
h.ctrl.tools = [sampleTool];
|
||||
const r = await mount(oneEmaHttp());
|
||||
await press(r, ["t", TAB, ENTER]);
|
||||
await expectFrame(r, "MOCK_FORM");
|
||||
await press(r, [ENTER]);
|
||||
await waitUntil(() => h.clientSpies.callTool.mock.calls.length > 0);
|
||||
await expectFrame(r, "organization before it can continue");
|
||||
const frame = r.lastFrame() ?? "";
|
||||
expect(frame).toMatch(/organization|get-env/i);
|
||||
expect(frame).not.toMatch(/opens browser/i);
|
||||
expect(frame).not.toMatch(/OAuth: authenticating/i);
|
||||
expect(h.callbackStart).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("runs confirmed EMA step-up via handleAuthChallenge when user authorizes", async () => {
|
||||
const challenge = {
|
||||
reason: "insufficient_scope" as const,
|
||||
requiredScopes: ["env:read"],
|
||||
authorizationScopes: ["tools:read", "env:read"],
|
||||
context: { toolName: "get-env" },
|
||||
};
|
||||
h.clientSpies.callTool.mockRejectedValue(
|
||||
new AuthRecoveryRequiredError(EMA_STEP_UP_PENDING_URL, challenge, {
|
||||
emaStepUpConfirm: true,
|
||||
}),
|
||||
);
|
||||
h.clientSpies.checkAuthChallengeSatisfied.mockResolvedValue(false);
|
||||
h.clientSpies.handleAuthChallenge.mockResolvedValue({ kind: "satisfied" });
|
||||
h.ctrl.status = "connected";
|
||||
h.ctrl.tools = [sampleTool];
|
||||
const r = await mount(oneEmaHttp());
|
||||
await press(r, ["t", TAB, ENTER]);
|
||||
await expectFrame(r, "MOCK_FORM");
|
||||
await press(r, [ENTER]);
|
||||
await waitUntil(() => h.clientSpies.callTool.mock.calls.length > 0);
|
||||
await expectFrame(r, "organization before it can continue");
|
||||
await press(r, ["a"]);
|
||||
await waitUntil(
|
||||
() => h.clientSpies.handleAuthChallenge.mock.calls.length > 0,
|
||||
);
|
||||
expect(h.clientSpies.handleAuthChallenge).toHaveBeenCalledWith(challenge, {
|
||||
confirmedStepUp: true,
|
||||
});
|
||||
expect(h.callbackStart).not.toHaveBeenCalled();
|
||||
await expectFrame(r, "Step-up authorization succeeded");
|
||||
});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -71,6 +71,15 @@ const baseProps = {
|
|||
connectionStatus: "disconnected" as const,
|
||||
};
|
||||
|
||||
const pendingStepUp = {
|
||||
challenge: {
|
||||
reason: "insufficient_scope" as const,
|
||||
requiredScopes: ["env:read"],
|
||||
authorizationScopes: ["tools:read", "env:read"],
|
||||
},
|
||||
enterpriseManaged: true,
|
||||
};
|
||||
|
||||
describe("AuthTab", () => {
|
||||
it("renders the placeholder when there is no server", () => {
|
||||
const { lastFrame } = render(
|
||||
|
|
@ -220,6 +229,86 @@ describe("AuthTab", () => {
|
|||
expect(lastFrame() ?? "").toContain("OAuth Details");
|
||||
});
|
||||
|
||||
it("navigates step-up choices with arrows and activates with Enter", async () => {
|
||||
const onAuthorizeStepUp = vi.fn();
|
||||
const onCancelStepUp = vi.fn();
|
||||
const { client } = makeClient(sampleOAuthState);
|
||||
const { stdin } = render(
|
||||
<AuthTab
|
||||
{...baseProps}
|
||||
focused
|
||||
inspectorClient={client}
|
||||
oauthStatus="idle"
|
||||
oauthMessage={null}
|
||||
pendingStepUp={pendingStepUp}
|
||||
onAuthorizeStepUp={onAuthorizeStepUp}
|
||||
onCancelStepUp={onCancelStepUp}
|
||||
/>,
|
||||
);
|
||||
await tick();
|
||||
stdin.write("\r");
|
||||
await tick();
|
||||
expect(onAuthorizeStepUp).toHaveBeenCalledTimes(1);
|
||||
expect(onCancelStepUp).not.toHaveBeenCalled();
|
||||
|
||||
onAuthorizeStepUp.mockClear();
|
||||
stdin.write(DOWN);
|
||||
await tick();
|
||||
stdin.write("\r");
|
||||
await tick();
|
||||
expect(onCancelStepUp).toHaveBeenCalledTimes(1);
|
||||
expect(onAuthorizeStepUp).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("shows step-up footer with selection hints when focused", async () => {
|
||||
const { client } = makeClient(sampleOAuthState);
|
||||
const { lastFrame } = render(
|
||||
<AuthTab
|
||||
{...baseProps}
|
||||
focused
|
||||
inspectorClient={client}
|
||||
oauthStatus="idle"
|
||||
oauthMessage={null}
|
||||
pendingStepUp={pendingStepUp}
|
||||
onAuthorizeStepUp={vi.fn()}
|
||||
onCancelStepUp={vi.fn()}
|
||||
/>,
|
||||
);
|
||||
await tick();
|
||||
expect(lastFrame() ?? "").toContain("↑/↓ select, Enter confirm");
|
||||
});
|
||||
|
||||
it("refreshes OAuth state when connection becomes connected", async () => {
|
||||
const { client, getOAuthState } = makeClient(undefined);
|
||||
const { lastFrame, rerender } = render(
|
||||
<AuthTab
|
||||
{...baseProps}
|
||||
inspectorClient={client}
|
||||
oauthStatus="idle"
|
||||
oauthMessage={null}
|
||||
connectionStatus="disconnected"
|
||||
/>,
|
||||
);
|
||||
await tick();
|
||||
expect(getOAuthState).toHaveBeenCalledTimes(1);
|
||||
expect(lastFrame() ?? "").toContain("No OAuth information yet");
|
||||
|
||||
getOAuthState.mockResolvedValue(sampleOAuthState);
|
||||
rerender(
|
||||
<AuthTab
|
||||
{...baseProps}
|
||||
inspectorClient={client}
|
||||
oauthStatus="idle"
|
||||
oauthMessage={null}
|
||||
connectionStatus="connected"
|
||||
/>,
|
||||
);
|
||||
await tick();
|
||||
expect(getOAuthState).toHaveBeenCalledTimes(2);
|
||||
expect(lastFrame() ?? "").toContain("Authorized");
|
||||
expect(lastFrame() ?? "").toContain("OAuth Details");
|
||||
});
|
||||
|
||||
it("refreshes OAuth state when oauthComplete fires", async () => {
|
||||
const { client, getOAuthState, fire, listeners } =
|
||||
makeClient(sampleOAuthState);
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React from "react";
|
|||
import { describe, it, expect, vi, afterEach } from "vitest";
|
||||
import { render } from "ink-testing-library";
|
||||
import type { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type { Prompt } from "@modelcontextprotocol/sdk/types.js";
|
||||
|
||||
// ScrollView: passthrough so the results JSX actually mounts (and is counted
|
||||
|
|
@ -341,4 +342,34 @@ describe("PromptTestModal", () => {
|
|||
await tick();
|
||||
expect(true).toBe(true);
|
||||
});
|
||||
|
||||
it("delegates AuthRecoveryRequiredError to onAuthRecoveryRequired and closes", async () => {
|
||||
const recovery = new AuthRecoveryRequiredError(
|
||||
new URL("https://auth.example.com/authorize"),
|
||||
{ reason: "insufficient_scope", requiredScopes: ["weather:read"] },
|
||||
);
|
||||
const getPrompt = vi.fn().mockRejectedValue(recovery);
|
||||
const onClose = vi.fn();
|
||||
const onAuthRecoveryRequired = vi.fn();
|
||||
setFormSubmitValue({ topic: "x" });
|
||||
|
||||
const { stdin } = render(
|
||||
<PromptTestModal
|
||||
prompt={makePrompt()}
|
||||
inspectorClient={{ getPrompt } as unknown as InspectorClient}
|
||||
width={120}
|
||||
height={30}
|
||||
onClose={onClose}
|
||||
onAuthRecoveryRequired={onAuthRecoveryRequired}
|
||||
/>,
|
||||
);
|
||||
|
||||
await tick();
|
||||
stdin.write(ENTER);
|
||||
await tick();
|
||||
await tick();
|
||||
|
||||
expect(onAuthRecoveryRequired).toHaveBeenCalledWith(recovery);
|
||||
expect(onClose).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React from "react";
|
|||
import { describe, it, expect, vi, afterEach } from "vitest";
|
||||
import { render } from "ink-testing-library";
|
||||
import type { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
|
||||
// ScrollView passthrough so the results JSX actually mounts (and is covered).
|
||||
vi.mock("ink-scroll-view", () => import("./helpers/inkScrollViewMock.js"));
|
||||
|
|
@ -264,4 +265,32 @@ describe("ResourceTestModal", () => {
|
|||
await tick();
|
||||
api.unmount();
|
||||
});
|
||||
|
||||
it("delegates AuthRecoveryRequiredError to onAuthRecoveryRequired and closes", async () => {
|
||||
const recovery = new AuthRecoveryRequiredError(
|
||||
new URL("https://auth.example.com/authorize"),
|
||||
{ reason: "insufficient_scope", requiredScopes: ["weather:read"] },
|
||||
);
|
||||
const read = vi.fn().mockRejectedValue(recovery);
|
||||
const onClose = vi.fn();
|
||||
const onAuthRecoveryRequired = vi.fn();
|
||||
const api = render(
|
||||
<ResourceTestModal
|
||||
template={makeTemplate()}
|
||||
inspectorClient={fakeClient(read)}
|
||||
width={80}
|
||||
height={24}
|
||||
onClose={onClose}
|
||||
onAuthRecoveryRequired={onAuthRecoveryRequired}
|
||||
/>,
|
||||
);
|
||||
await tick();
|
||||
setSubmitValue({ name: "world" });
|
||||
api.stdin.write("\r");
|
||||
await tick();
|
||||
await tick();
|
||||
expect(onAuthRecoveryRequired).toHaveBeenCalledWith(recovery);
|
||||
expect(onClose).toHaveBeenCalledTimes(1);
|
||||
api.unmount();
|
||||
});
|
||||
});
|
||||
|
|
|
|||
49
clients/tui/__tests__/tuiOAuth.test.ts
Normal file
49
clients/tui/__tests__/tuiOAuth.test.ts
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
import { describe, it, expect } from "vitest";
|
||||
import {
|
||||
isStandardOAuthStepUp,
|
||||
isStepUpConfirmation,
|
||||
stepUpConfirmMessage,
|
||||
stepUpInsufficientScopeMessage,
|
||||
} from "../src/utils/tuiOAuth.js";
|
||||
|
||||
describe("tuiOAuth", () => {
|
||||
it("detects standard OAuth step-up", () => {
|
||||
expect(
|
||||
isStandardOAuthStepUp(
|
||||
{ reason: "insufficient_scope", requiredScopes: ["weather:read"] },
|
||||
{ enterpriseManaged: false },
|
||||
),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isStandardOAuthStepUp(
|
||||
{ reason: "insufficient_scope", requiredScopes: ["weather:read"] },
|
||||
{ enterpriseManaged: true },
|
||||
),
|
||||
).toBe(false);
|
||||
});
|
||||
|
||||
it("detects EMA step-up confirmation", () => {
|
||||
expect(
|
||||
isStepUpConfirmation(
|
||||
{ reason: "insufficient_scope", requiredScopes: ["env:read"] },
|
||||
{ enterpriseManaged: true },
|
||||
),
|
||||
).toBe(true);
|
||||
expect(
|
||||
isStepUpConfirmation(
|
||||
{ reason: "insufficient_scope", requiredScopes: ["weather:read"] },
|
||||
{ enterpriseManaged: false },
|
||||
),
|
||||
).toBe(true);
|
||||
});
|
||||
|
||||
it("formats step-up messages", () => {
|
||||
const challenge = {
|
||||
reason: "insufficient_scope" as const,
|
||||
requiredScopes: ["weather:read"],
|
||||
context: { toolName: "get_temp" },
|
||||
};
|
||||
expect(stepUpConfirmMessage(challenge)).toMatch(/get_temp/);
|
||||
expect(stepUpInsufficientScopeMessage(challenge)).toMatch(/get_temp/);
|
||||
});
|
||||
});
|
||||
|
|
@ -45,7 +45,10 @@ import {
|
|||
CallbackNavigation,
|
||||
MutableRedirectUrlProvider,
|
||||
isUnauthorizedError,
|
||||
AuthRecoveryRequiredError,
|
||||
} from "@inspector/core/auth/index.js";
|
||||
import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
|
||||
import type { TypedEvent } from "@inspector/core/mcp/inspectorClientEventTarget.js";
|
||||
import { isEmaClientNotConfiguredError } from "@inspector/core/auth/ema/clientConfigError.js";
|
||||
import type { ClientConfig } from "@inspector/core/client/types.js";
|
||||
import {
|
||||
|
|
@ -57,9 +60,15 @@ import {
|
|||
createOAuthCallbackServer,
|
||||
type OAuthCallbackServer,
|
||||
NodeOAuthStorage,
|
||||
runRunnerInteractiveOAuth,
|
||||
} from "@inspector/core/auth/node/index.js";
|
||||
import { getTuiLogger } from "./logger.js";
|
||||
import { openUrl } from "./utils/openUrl.js";
|
||||
import {
|
||||
isStepUpConfirmation,
|
||||
stepUpInsufficientScopeMessage,
|
||||
} from "./utils/tuiOAuth.js";
|
||||
import { emaStepUpFailureMessage } from "@inspector/core/auth/oauthUx.js";
|
||||
import { Tabs } from "./components/Tabs.js";
|
||||
import { type TabType, tabs as tabList } from "./components/tabsConfig.js";
|
||||
import { InfoTab } from "./components/InfoTab.js";
|
||||
|
|
@ -141,14 +150,6 @@ function App({
|
|||
callbackUrlConfig,
|
||||
}: AppProps) {
|
||||
const { exit } = useApp();
|
||||
const callbackServerBaseOptions = useMemo(
|
||||
() => ({
|
||||
port: callbackUrlConfig.port,
|
||||
hostname: callbackUrlConfig.hostname,
|
||||
path: callbackUrlConfig.pathname,
|
||||
}),
|
||||
[callbackUrlConfig],
|
||||
);
|
||||
|
||||
useEffect(() => {
|
||||
getTuiLogger().info(
|
||||
|
|
@ -174,9 +175,22 @@ function App({
|
|||
>("idle");
|
||||
const [oauthMessage, setOauthMessage] = useState<string | null>(null);
|
||||
const [oauthRevision, setOauthRevision] = useState(0);
|
||||
const [pendingStepUp, setPendingStepUp] = useState<{
|
||||
serverName: string;
|
||||
challenge: AuthChallenge;
|
||||
authorizationUrl: URL;
|
||||
enterpriseManaged?: boolean;
|
||||
} | null>(null);
|
||||
const pendingStepUpRef = useRef(pendingStepUp);
|
||||
useEffect(() => {
|
||||
pendingStepUpRef.current = pendingStepUp;
|
||||
}, [pendingStepUp]);
|
||||
const [connectError, setConnectError] = useState<string | null>(null);
|
||||
const oauthInProgressRef = useRef(false);
|
||||
const callbackServerRef = useRef<OAuthCallbackServer | null>(null);
|
||||
const selectedServerRef = useRef<string | null>(null);
|
||||
const mcpServersRef = useRef(mcpServers);
|
||||
const inspectorClientsRef = useRef<Record<string, InspectorClient>>({});
|
||||
|
||||
// Tool test modal state
|
||||
const [toolTestModal, setToolTestModal] = useState<{
|
||||
|
|
@ -419,12 +433,22 @@ function App({
|
|||
// eslint-disable-next-line react-hooks/exhaustive-deps
|
||||
}, []);
|
||||
|
||||
// Clear OAuth status when switching servers
|
||||
// Clear OAuth status when switching servers; drop step-up for other servers.
|
||||
useEffect(() => {
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(null);
|
||||
const stepUp = pendingStepUpRef.current;
|
||||
if (stepUp && selectedServer && stepUp.serverName !== selectedServer) {
|
||||
setPendingStepUp(null);
|
||||
}
|
||||
}, [selectedServer]);
|
||||
|
||||
useEffect(() => {
|
||||
selectedServerRef.current = selectedServer;
|
||||
mcpServersRef.current = mcpServers;
|
||||
inspectorClientsRef.current = inspectorClients;
|
||||
}, [selectedServer, mcpServers, inspectorClients]);
|
||||
|
||||
// Switch away from Auth tab when server is not OAuth-capable
|
||||
useEffect(() => {
|
||||
if (
|
||||
|
|
@ -534,79 +558,184 @@ function App({
|
|||
selectedManagedPromptsState,
|
||||
);
|
||||
|
||||
// Shared ref for OAuth callback server; stop before starting new (avoids EADDRINUSE when prior auth failed without redirect)
|
||||
// Connect — on 401 or mid-session auth recovery, run OAuth then retry.
|
||||
const runOAuthAuthentication = useCallback(
|
||||
async (options?: {
|
||||
challenge?: AuthChallenge;
|
||||
authorizationUrl?: URL;
|
||||
/** When set, run OAuth for this server (may differ from the selected server). */
|
||||
serverName?: string;
|
||||
}) => {
|
||||
const serverName = options?.serverName ?? selectedServer;
|
||||
if (!serverName) {
|
||||
return;
|
||||
}
|
||||
const client = inspectorClientsRef.current[serverName];
|
||||
const serverEntry = mcpServersRef.current[serverName];
|
||||
const serverConfig = serverEntry?.config;
|
||||
if (
|
||||
!client ||
|
||||
!serverConfig ||
|
||||
!isOAuthCapableServerConfig(serverConfig)
|
||||
) {
|
||||
return;
|
||||
}
|
||||
if (oauthInProgressRef.current) return;
|
||||
oauthInProgressRef.current = true;
|
||||
getTuiLogger().info(
|
||||
{ server: serverName },
|
||||
"OAuth authentication started",
|
||||
);
|
||||
const existing = callbackServerRef.current;
|
||||
if (existing) {
|
||||
await existing.stop();
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
const redirectUrlProvider = redirectUrlProvidersRef.current[serverName];
|
||||
if (!redirectUrlProvider) {
|
||||
oauthInProgressRef.current = false;
|
||||
return;
|
||||
}
|
||||
try {
|
||||
const result = await runRunnerInteractiveOAuth({
|
||||
client,
|
||||
redirectUrlProvider,
|
||||
callbackListen: callbackUrlConfig,
|
||||
createCallbackServer: createOAuthCallbackServer,
|
||||
onCallbackServer: (server) => {
|
||||
callbackServerRef.current = server;
|
||||
},
|
||||
authorizationUrl: options?.authorizationUrl,
|
||||
authChallenge: options?.challenge,
|
||||
});
|
||||
|
||||
// Connect — on 401, run OAuth then retry (same pattern as web App.tsx).
|
||||
const runOAuthAuthentication = useCallback(async () => {
|
||||
if (
|
||||
!selectedServer ||
|
||||
!selectedInspectorClient ||
|
||||
!selectedServerConfig ||
|
||||
!isOAuthCapableServerConfig(selectedServerConfig)
|
||||
) {
|
||||
return;
|
||||
}
|
||||
if (oauthInProgressRef.current) return;
|
||||
oauthInProgressRef.current = true;
|
||||
getTuiLogger().info(
|
||||
{ server: selectedServer },
|
||||
"OAuth authentication started",
|
||||
);
|
||||
const existing = callbackServerRef.current;
|
||||
if (existing) {
|
||||
await existing.stop();
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
const callbackServer = createOAuthCallbackServer();
|
||||
callbackServerRef.current = callbackServer;
|
||||
let flowResolve: () => void;
|
||||
let flowReject: (err: Error) => void;
|
||||
const flowDone = new Promise<void>((resolve, reject) => {
|
||||
flowResolve = resolve;
|
||||
flowReject = reject;
|
||||
});
|
||||
try {
|
||||
const { redirectUrl } = await callbackServer.start({
|
||||
...callbackServerBaseOptions,
|
||||
onCallback: async (params) => {
|
||||
try {
|
||||
await selectedInspectorClient!.completeOAuthFlow(params.code);
|
||||
flowResolve!();
|
||||
} catch (err) {
|
||||
flowReject!(err instanceof Error ? err : new Error(String(err)));
|
||||
} finally {
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
},
|
||||
onError: (params) => {
|
||||
flowReject!(
|
||||
new Error(
|
||||
params.error_description ?? params.error ?? "OAuth error",
|
||||
),
|
||||
);
|
||||
void callbackServer.stop();
|
||||
callbackServerRef.current = null;
|
||||
},
|
||||
if (result.kind === "insufficient_scope") {
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(stepUpInsufficientScopeMessage(result.challenge));
|
||||
return;
|
||||
}
|
||||
if (result.kind === "success" || result.kind === "already_authorized") {
|
||||
setOauthRevision((n) => n + 1);
|
||||
}
|
||||
} finally {
|
||||
oauthInProgressRef.current = false;
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
},
|
||||
[selectedServer, callbackUrlConfig],
|
||||
);
|
||||
|
||||
const presentStepUpForServer = useCallback(
|
||||
(
|
||||
serverName: string,
|
||||
challenge: AuthChallenge,
|
||||
authorizationUrl: URL,
|
||||
enterpriseManaged?: boolean,
|
||||
) => {
|
||||
const pending = pendingStepUpRef.current;
|
||||
if (pending && pending.serverName !== serverName) {
|
||||
setOauthMessage(
|
||||
"A step-up prompt is already open. Complete or decline it before continuing.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (pending?.serverName === serverName) {
|
||||
setOauthMessage(
|
||||
"Updated step-up request — review the scopes on the Auth tab.",
|
||||
);
|
||||
} else {
|
||||
setOauthMessage(null);
|
||||
}
|
||||
setSelectedServer(serverName);
|
||||
setPendingStepUp({
|
||||
serverName,
|
||||
challenge,
|
||||
authorizationUrl,
|
||||
enterpriseManaged,
|
||||
});
|
||||
const redirectUrlProvider =
|
||||
redirectUrlProvidersRef.current[selectedServer];
|
||||
if (redirectUrlProvider) {
|
||||
redirectUrlProvider.redirectUrl = redirectUrl;
|
||||
setActiveTab("auth");
|
||||
setOauthStatus("idle");
|
||||
setFocus("tabContentList");
|
||||
},
|
||||
[],
|
||||
);
|
||||
|
||||
const handleAuthRecoveryRequired = useCallback(
|
||||
(serverName: string, error: AuthRecoveryRequiredError) => {
|
||||
const serverEntry = mcpServersRef.current[serverName];
|
||||
const settings = serverEntry?.settings;
|
||||
const client = inspectorClientsRef.current[serverName];
|
||||
const needsStepUpConfirm =
|
||||
error.emaStepUpConfirm ||
|
||||
isStepUpConfirmation(error.authChallenge, settings);
|
||||
if (needsStepUpConfirm) {
|
||||
void (async () => {
|
||||
if (
|
||||
client &&
|
||||
(await client.checkAuthChallengeSatisfied(error.authChallenge))
|
||||
) {
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Authorization updated. Retry your action.");
|
||||
setOauthRevision((n) => n + 1);
|
||||
return;
|
||||
}
|
||||
presentStepUpForServer(
|
||||
serverName,
|
||||
error.authChallenge,
|
||||
error.authorizationUrl,
|
||||
settings?.enterpriseManaged,
|
||||
);
|
||||
})();
|
||||
return;
|
||||
}
|
||||
const authUrl = await selectedInspectorClient.authenticate();
|
||||
if (authUrl !== undefined) {
|
||||
await flowDone;
|
||||
void (async () => {
|
||||
if (
|
||||
client &&
|
||||
(await client.checkAuthChallengeSatisfied(error.authChallenge))
|
||||
) {
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Authorization updated. Retry your action.");
|
||||
setOauthRevision((n) => n + 1);
|
||||
return;
|
||||
}
|
||||
const needsSwitch = selectedServerRef.current !== serverName;
|
||||
if (needsSwitch) {
|
||||
setSelectedServer(serverName);
|
||||
setActiveTab("auth");
|
||||
setOauthMessage(
|
||||
`Authentication required for "${serverName}". Re-authenticating…`,
|
||||
);
|
||||
} else {
|
||||
setOauthMessage(null);
|
||||
}
|
||||
setOauthStatus("authenticating");
|
||||
try {
|
||||
await runOAuthAuthentication({
|
||||
challenge: error.authChallenge,
|
||||
authorizationUrl: error.authorizationUrl,
|
||||
serverName,
|
||||
});
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Authorization updated. Retry your action.");
|
||||
} catch (authErr) {
|
||||
const authMsg =
|
||||
authErr instanceof Error ? authErr.message : String(authErr);
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(authMsg);
|
||||
}
|
||||
})();
|
||||
},
|
||||
[presentStepUpForServer, runOAuthAuthentication],
|
||||
);
|
||||
|
||||
const onAuthRecoveryRequired = useCallback(
|
||||
(error: AuthRecoveryRequiredError) => {
|
||||
if (selectedServer) {
|
||||
handleAuthRecoveryRequired(selectedServer, error);
|
||||
}
|
||||
setOauthRevision((n) => n + 1);
|
||||
} finally {
|
||||
oauthInProgressRef.current = false;
|
||||
}
|
||||
}, [
|
||||
selectedServer,
|
||||
selectedInspectorClient,
|
||||
selectedServerConfig,
|
||||
callbackServerBaseOptions,
|
||||
]);
|
||||
},
|
||||
[selectedServer, handleAuthRecoveryRequired],
|
||||
);
|
||||
|
||||
const handleConnect = useCallback(async () => {
|
||||
if (!selectedServer || !selectedInspectorClient || !selectedServerConfig) {
|
||||
|
|
@ -618,6 +747,7 @@ function App({
|
|||
setConnectError(null);
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(null);
|
||||
setOauthRevision((n) => n + 1);
|
||||
};
|
||||
|
||||
try {
|
||||
|
|
@ -639,13 +769,14 @@ function App({
|
|||
try {
|
||||
setOauthStatus("authenticating");
|
||||
setOauthMessage(null);
|
||||
// Tear down the failed handshake transport so the post-OAuth connect
|
||||
// creates a fresh transport with tokens from storage (same as web,
|
||||
// which reloads the client after redirect).
|
||||
await disconnectInspector();
|
||||
await runOAuthAuthentication();
|
||||
await finishConnect();
|
||||
} catch (authErr) {
|
||||
if (authErr instanceof AuthRecoveryRequiredError) {
|
||||
handleAuthRecoveryRequired(selectedServer, authErr);
|
||||
return;
|
||||
}
|
||||
const authMsg =
|
||||
authErr instanceof Error ? authErr.message : String(authErr);
|
||||
setConnectError(authMsg);
|
||||
|
|
@ -659,6 +790,11 @@ function App({
|
|||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (err instanceof AuthRecoveryRequiredError && selectedServer) {
|
||||
handleAuthRecoveryRequired(selectedServer, err);
|
||||
return;
|
||||
}
|
||||
}
|
||||
}, [
|
||||
selectedServer,
|
||||
|
|
@ -667,8 +803,63 @@ function App({
|
|||
connectInspector,
|
||||
disconnectInspector,
|
||||
runOAuthAuthentication,
|
||||
handleAuthRecoveryRequired,
|
||||
]);
|
||||
|
||||
useEffect(() => {
|
||||
const cleanups: Array<() => void> = [];
|
||||
|
||||
for (const [serverName, client] of Object.entries(inspectorClients)) {
|
||||
const onAmbient = (): void => {
|
||||
if (selectedServerRef.current !== serverName) return;
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Refreshing authorization…");
|
||||
};
|
||||
const onRecovered = (): void => {
|
||||
if (selectedServerRef.current !== serverName) return;
|
||||
setOauthMessage(null);
|
||||
setOauthRevision((n) => n + 1);
|
||||
};
|
||||
const onInteractive = (
|
||||
event: TypedEvent<"authChallengeInteractive">,
|
||||
): void => {
|
||||
handleAuthRecoveryRequired(
|
||||
serverName,
|
||||
new AuthRecoveryRequiredError(
|
||||
event.detail.authorizationUrl,
|
||||
event.detail.challenge,
|
||||
),
|
||||
);
|
||||
};
|
||||
const onOAuthError = (event: TypedEvent<"oauthError">): void => {
|
||||
if (selectedServerRef.current !== serverName) return;
|
||||
const message =
|
||||
event.detail.error instanceof Error
|
||||
? event.detail.error.message
|
||||
: String(event.detail.error);
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(message);
|
||||
};
|
||||
|
||||
client.addEventListener("authChallengeAmbient", onAmbient);
|
||||
client.addEventListener("authChallengeRecovered", onRecovered);
|
||||
client.addEventListener("authChallengeInteractive", onInteractive);
|
||||
client.addEventListener("oauthError", onOAuthError);
|
||||
cleanups.push(() => {
|
||||
client.removeEventListener("authChallengeAmbient", onAmbient);
|
||||
client.removeEventListener("authChallengeRecovered", onRecovered);
|
||||
client.removeEventListener("authChallengeInteractive", onInteractive);
|
||||
client.removeEventListener("oauthError", onOAuthError);
|
||||
});
|
||||
}
|
||||
|
||||
return () => {
|
||||
for (const cleanup of cleanups) {
|
||||
cleanup();
|
||||
}
|
||||
};
|
||||
}, [inspectorClients, handleAuthRecoveryRequired]);
|
||||
|
||||
// Disconnect handler
|
||||
const handleDisconnect = useCallback(async () => {
|
||||
if (!selectedServer) return;
|
||||
|
|
@ -1110,13 +1301,6 @@ function App({
|
|||
const nextTab = tabAccelerators[input.toLowerCase()]!;
|
||||
setActiveTab(nextTab);
|
||||
setFocus(nextTab === "auth" ? "tabContentList" : "tabs");
|
||||
} else if (
|
||||
activeTab === "auth" &&
|
||||
showAuthTab &&
|
||||
input.toLowerCase() === "s"
|
||||
) {
|
||||
void handleClearOAuth();
|
||||
setFocus("tabContentList");
|
||||
} else if (key.tab && !key.shift) {
|
||||
// Flat focus order: servers -> tabs -> list -> details -> wrap to servers
|
||||
const focusOrder: FocusArea[] =
|
||||
|
|
@ -1470,6 +1654,86 @@ function App({
|
|||
oauthStatus={oauthStatus}
|
||||
oauthMessage={oauthMessage}
|
||||
oauthRevision={oauthRevision}
|
||||
pendingStepUp={
|
||||
pendingStepUp?.serverName === selectedServer
|
||||
? {
|
||||
challenge: pendingStepUp.challenge,
|
||||
authorizationScopes:
|
||||
pendingStepUp.challenge.authorizationScopes,
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
}
|
||||
: null
|
||||
}
|
||||
onAuthorizeStepUp={() => {
|
||||
if (!pendingStepUp || !selectedInspectorClient) return;
|
||||
const { challenge, authorizationUrl, enterpriseManaged } =
|
||||
pendingStepUp;
|
||||
setPendingStepUp(null);
|
||||
setOauthStatus("authenticating");
|
||||
void (async () => {
|
||||
try {
|
||||
if (enterpriseManaged) {
|
||||
const outcome =
|
||||
await selectedInspectorClient.handleAuthChallenge(
|
||||
challenge,
|
||||
{ confirmedStepUp: true },
|
||||
);
|
||||
if (outcome.kind === "satisfied") {
|
||||
await disconnectInspector().catch(() => {});
|
||||
await connectInspector();
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
setOauthRevision((n) => n + 1);
|
||||
return;
|
||||
}
|
||||
if (outcome.kind === "interactive") {
|
||||
await runOAuthAuthentication({
|
||||
challenge: outcome.challenge,
|
||||
authorizationUrl: outcome.authorizationUrl,
|
||||
});
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (outcome.kind === "failed") {
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(
|
||||
emaStepUpFailureMessage(outcome.error.message),
|
||||
);
|
||||
return;
|
||||
}
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
await runOAuthAuthentication({
|
||||
challenge,
|
||||
authorizationUrl,
|
||||
});
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
} catch (authErr) {
|
||||
const authMsg =
|
||||
authErr instanceof Error
|
||||
? authErr.message
|
||||
: String(authErr);
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(authMsg);
|
||||
}
|
||||
})();
|
||||
}}
|
||||
onCancelStepUp={() => {
|
||||
setPendingStepUp(null);
|
||||
setOauthMessage("Authorization cancelled.");
|
||||
}}
|
||||
width={contentWidth}
|
||||
height={contentHeight}
|
||||
focused={
|
||||
|
|
@ -1517,8 +1781,14 @@ function App({
|
|||
inspectorClient: selectedInspectorClient,
|
||||
});
|
||||
}}
|
||||
onAuthRecoveryRequired={onAuthRecoveryRequired}
|
||||
modalOpen={
|
||||
!!(toolTestModal || resourceTestModal || detailsModal)
|
||||
!!(
|
||||
toolTestModal ||
|
||||
resourceTestModal ||
|
||||
promptTestModal ||
|
||||
detailsModal
|
||||
)
|
||||
}
|
||||
/>
|
||||
) : activeTab === "prompts" &&
|
||||
|
|
@ -1552,6 +1822,7 @@ function App({
|
|||
inspectorClient: selectedInspectorClient,
|
||||
});
|
||||
}}
|
||||
onAuthRecoveryRequired={onAuthRecoveryRequired}
|
||||
modalOpen={
|
||||
!!(
|
||||
toolTestModal ||
|
||||
|
|
@ -1680,6 +1951,10 @@ function App({
|
|||
width={dimensions.width}
|
||||
height={dimensions.height}
|
||||
onClose={() => setToolTestModal(null)}
|
||||
onAuthRecoveryRequired={(error) => {
|
||||
onAuthRecoveryRequired(error);
|
||||
setToolTestModal(null);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
|
|
@ -1691,6 +1966,10 @@ function App({
|
|||
width={dimensions.width}
|
||||
height={dimensions.height}
|
||||
onClose={() => setResourceTestModal(null)}
|
||||
onAuthRecoveryRequired={(error) => {
|
||||
onAuthRecoveryRequired(error);
|
||||
setResourceTestModal(null);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
|
|
@ -1701,6 +1980,10 @@ function App({
|
|||
width={dimensions.width}
|
||||
height={dimensions.height}
|
||||
onClose={() => setPromptTestModal(null)}
|
||||
onAuthRecoveryRequired={(error) => {
|
||||
onAuthRecoveryRequired(error);
|
||||
setPromptTestModal(null);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
|
|
|
|||
|
|
@ -8,12 +8,19 @@ import type {
|
|||
ConnectionStatus,
|
||||
} from "@inspector/core/mcp/index.js";
|
||||
import type { OAuthConnectionState } from "@inspector/core/auth/types.js";
|
||||
import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
|
||||
import {
|
||||
formatAuthProtocol,
|
||||
formatClientRegistrationKind,
|
||||
formatIdpSession,
|
||||
formatScopes,
|
||||
} from "../utils/oauthDisplay.js";
|
||||
import {
|
||||
stepUpAuthorizeActionLabel,
|
||||
stepUpConfirmMessage,
|
||||
stepUpFollowUpMessage,
|
||||
stepUpModalTitle,
|
||||
} from "../utils/tuiOAuth.js";
|
||||
|
||||
interface AuthTabProps {
|
||||
serverName: string | null;
|
||||
|
|
@ -22,6 +29,13 @@ interface AuthTabProps {
|
|||
oauthStatus: "idle" | "authenticating" | "error";
|
||||
oauthMessage: string | null;
|
||||
oauthRevision: number;
|
||||
pendingStepUp?: {
|
||||
challenge: AuthChallenge;
|
||||
authorizationScopes?: string[];
|
||||
enterpriseManaged?: boolean;
|
||||
} | null;
|
||||
onAuthorizeStepUp?: () => void;
|
||||
onCancelStepUp?: () => void;
|
||||
width: number;
|
||||
height: number;
|
||||
focused?: boolean;
|
||||
|
|
@ -44,6 +58,9 @@ export function AuthTab({
|
|||
oauthStatus,
|
||||
oauthMessage,
|
||||
oauthRevision,
|
||||
pendingStepUp,
|
||||
onAuthorizeStepUp,
|
||||
onCancelStepUp,
|
||||
width,
|
||||
height,
|
||||
focused = false,
|
||||
|
|
@ -58,6 +75,7 @@ export function AuthTab({
|
|||
>(undefined);
|
||||
const [clearedConfirmation, setClearedConfirmation] = useState(false);
|
||||
const [lastClearDisconnected, setLastClearDisconnected] = useState(false);
|
||||
const [stepUpChoiceIndex, setStepUpChoiceIndex] = useState(0);
|
||||
|
||||
const refreshOAuthState = useCallback(async () => {
|
||||
if (!inspectorClient) {
|
||||
|
|
@ -70,13 +88,17 @@ export function AuthTab({
|
|||
|
||||
useEffect(() => {
|
||||
void refreshOAuthState();
|
||||
}, [refreshOAuthState, oauthRevision]);
|
||||
}, [refreshOAuthState, oauthRevision, connectionStatus]);
|
||||
|
||||
useEffect(() => {
|
||||
setClearedConfirmation(false);
|
||||
setLastClearDisconnected(false);
|
||||
}, [oauthRevision]);
|
||||
|
||||
useEffect(() => {
|
||||
setStepUpChoiceIndex(0);
|
||||
}, [pendingStepUp]);
|
||||
|
||||
useEffect(() => {
|
||||
if (!inspectorClient) return;
|
||||
|
||||
|
|
@ -93,6 +115,34 @@ export function AuthTab({
|
|||
(input: string, key: Key) => {
|
||||
if (!focused) return;
|
||||
|
||||
if (pendingStepUp) {
|
||||
if (key.upArrow) {
|
||||
setStepUpChoiceIndex((i) => Math.max(0, i - 1));
|
||||
return;
|
||||
}
|
||||
if (key.downArrow) {
|
||||
setStepUpChoiceIndex((i) => Math.min(1, i + 1));
|
||||
return;
|
||||
}
|
||||
if (key.return) {
|
||||
if (stepUpChoiceIndex === 0) {
|
||||
onAuthorizeStepUp?.();
|
||||
} else {
|
||||
onCancelStepUp?.();
|
||||
}
|
||||
return;
|
||||
}
|
||||
if (input.toLowerCase() === "a") {
|
||||
onAuthorizeStepUp?.();
|
||||
return;
|
||||
}
|
||||
if (input.toLowerCase() === "c") {
|
||||
onCancelStepUp?.();
|
||||
return;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (key.upArrow && scrollViewRef.current) {
|
||||
scrollViewRef.current.scrollBy(-1);
|
||||
} else if (key.downArrow && scrollViewRef.current) {
|
||||
|
|
@ -139,6 +189,66 @@ export function AuthTab({
|
|||
{oauthStatus === "error" && oauthMessage && (
|
||||
<Text color="red">{oauthMessage}</Text>
|
||||
)}
|
||||
{oauthStatus === "idle" && oauthMessage && (
|
||||
<Text color="cyan">{oauthMessage}</Text>
|
||||
)}
|
||||
|
||||
{pendingStepUp ? (
|
||||
<Box marginTop={1} flexDirection="column" gap={0}>
|
||||
<Text bold color="yellow">
|
||||
{stepUpModalTitle({
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
})}
|
||||
</Text>
|
||||
<Text>
|
||||
{stepUpConfirmMessage(pendingStepUp.challenge, {
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
})}{" "}
|
||||
{stepUpFollowUpMessage({
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
})}
|
||||
</Text>
|
||||
{(() => {
|
||||
const scopes =
|
||||
pendingStepUp.authorizationScopes ??
|
||||
pendingStepUp.challenge.requiredScopes;
|
||||
if (!scopes?.length) return null;
|
||||
return (
|
||||
<Box marginTop={1} flexDirection="column">
|
||||
<Text dimColor>
|
||||
{pendingStepUp.enterpriseManaged
|
||||
? "Permissions requested:"
|
||||
: "Scopes requested:"}
|
||||
</Text>
|
||||
{scopes.map((scope) => (
|
||||
<Text key={scope} dimColor>
|
||||
{" "}
|
||||
• {scope}
|
||||
</Text>
|
||||
))}
|
||||
</Box>
|
||||
);
|
||||
})()}
|
||||
<Box marginTop={1} flexDirection="column">
|
||||
<SelectableItem isSelected={stepUpChoiceIndex === 0} bold>
|
||||
{(() => {
|
||||
const label = stepUpAuthorizeActionLabel({
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
});
|
||||
return (
|
||||
<>
|
||||
<Text underline>{label[0]}</Text>
|
||||
{label.slice(1)}
|
||||
</>
|
||||
);
|
||||
})()}
|
||||
</SelectableItem>
|
||||
<SelectableItem isSelected={stepUpChoiceIndex === 1}>
|
||||
<Text underline>C</Text>ancel
|
||||
</SelectableItem>
|
||||
</Box>
|
||||
</Box>
|
||||
) : null}
|
||||
|
||||
{oauthState ? (
|
||||
<Box flexDirection="column" marginTop={1} gap={0}>
|
||||
|
|
@ -229,7 +339,9 @@ export function AuthTab({
|
|||
backgroundColor="gray"
|
||||
>
|
||||
<Text bold color="white">
|
||||
S {isLiveConnection ? "clear+disconnect" : "clear"}, ↑/↓ scroll
|
||||
{pendingStepUp
|
||||
? "↑/↓ select, Enter confirm, A authorize, C cancel"
|
||||
: `S ${isLiveConnection ? "clear+disconnect" : "clear"}, ↑/↓ scroll`}
|
||||
</Text>
|
||||
</Box>
|
||||
)}
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { Form } from "ink-form";
|
||||
import { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type {
|
||||
Prompt,
|
||||
GetPromptResult,
|
||||
|
|
@ -29,6 +30,7 @@ interface PromptTestModalProps {
|
|||
width: number;
|
||||
height: number;
|
||||
onClose: () => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
}
|
||||
|
||||
type ModalState = "form" | "loading" | "results";
|
||||
|
|
@ -47,6 +49,7 @@ export function PromptTestModal({
|
|||
width,
|
||||
height,
|
||||
onClose,
|
||||
onAuthRecoveryRequired,
|
||||
}: PromptTestModalProps) {
|
||||
const [state, setState] = useState<ModalState>("form");
|
||||
const [result, setResult] = useState<PromptResult | null>(null);
|
||||
|
|
@ -144,6 +147,11 @@ export function PromptTestModal({
|
|||
});
|
||||
setState("results");
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
const duration = Date.now() - startTime;
|
||||
const errorMessage = getErrorMessage(error);
|
||||
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState, useEffect, useRef } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
|
||||
import type { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type {
|
||||
Prompt,
|
||||
PromptArgument,
|
||||
|
|
@ -18,6 +19,7 @@ interface PromptsTabProps {
|
|||
focusedPane?: "list" | "details" | null;
|
||||
onViewDetails?: (prompt: Prompt & { result?: GetPromptResult }) => void;
|
||||
onFetchPrompt?: (prompt: Prompt) => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
modalOpen?: boolean;
|
||||
}
|
||||
|
||||
|
|
@ -29,6 +31,7 @@ export function PromptsTab({
|
|||
focusedPane = null,
|
||||
onViewDetails,
|
||||
onFetchPrompt,
|
||||
onAuthRecoveryRequired,
|
||||
modalOpen = false,
|
||||
}: PromptsTabProps) {
|
||||
const visibleCount = Math.max(1, height - 7);
|
||||
|
|
@ -64,6 +67,10 @@ export function PromptsTab({
|
|||
});
|
||||
}
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
return;
|
||||
}
|
||||
setError(
|
||||
error instanceof Error ? error.message : "Failed to get prompt",
|
||||
);
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { Form } from "ink-form";
|
||||
import { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type { ReadResourceResult } from "@modelcontextprotocol/sdk/types.js";
|
||||
import { uriTemplateToForm } from "../utils/uriTemplateToForm.js";
|
||||
import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
|
||||
|
|
@ -30,6 +31,7 @@ interface ResourceTestModalProps {
|
|||
width: number;
|
||||
height: number;
|
||||
onClose: () => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
}
|
||||
|
||||
type ModalState = "form" | "loading" | "results";
|
||||
|
|
@ -49,6 +51,7 @@ export function ResourceTestModal({
|
|||
width,
|
||||
height,
|
||||
onClose,
|
||||
onAuthRecoveryRequired,
|
||||
}: ResourceTestModalProps) {
|
||||
const [state, setState] = useState<ModalState>("form");
|
||||
const [result, setResult] = useState<ResourceResult | null>(null);
|
||||
|
|
@ -150,6 +153,11 @@ export function ResourceTestModal({
|
|||
});
|
||||
setState("results");
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
const duration = Date.now() - startTime;
|
||||
const errorMessage = getErrorMessage(error);
|
||||
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState, useEffect, useRef, useMemo } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
|
||||
import type { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type {
|
||||
Resource,
|
||||
ReadResourceResult,
|
||||
|
|
@ -27,6 +28,7 @@ interface ResourcesTabProps {
|
|||
) => void;
|
||||
onFetchResource?: (resource: Resource) => void;
|
||||
onFetchTemplate?: (template: ResourceTemplate) => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
modalOpen?: boolean;
|
||||
}
|
||||
|
||||
|
|
@ -41,6 +43,7 @@ export function ResourcesTab({
|
|||
onViewDetails,
|
||||
onFetchResource,
|
||||
onFetchTemplate,
|
||||
onAuthRecoveryRequired,
|
||||
modalOpen = false,
|
||||
}: ResourcesTabProps) {
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
|
|
@ -169,6 +172,10 @@ export function ResourcesTab({
|
|||
await inspectorClient.readResource(shouldFetchResource);
|
||||
setResourceContent(invocation.result);
|
||||
} catch (err) {
|
||||
if (err instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(err);
|
||||
return;
|
||||
}
|
||||
setError(
|
||||
err instanceof Error ? err.message : "Failed to read resource",
|
||||
);
|
||||
|
|
@ -180,7 +187,7 @@ export function ResourcesTab({
|
|||
};
|
||||
|
||||
fetchContent();
|
||||
}, [shouldFetchResource, inspectorClient]);
|
||||
}, [shouldFetchResource, inspectorClient, onAuthRecoveryRequired]);
|
||||
|
||||
const listWidth = Math.floor(width * 0.4);
|
||||
const detailWidth = width - listWidth;
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { Form } from "ink-form";
|
||||
import { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type { Tool, CallToolResult } from "@modelcontextprotocol/sdk/types.js";
|
||||
import type { JsonValue } from "@inspector/core/mcp/index.js";
|
||||
import { schemaToForm } from "../utils/schemaToForm.js";
|
||||
|
|
@ -13,6 +14,7 @@ interface ToolTestModalProps {
|
|||
width: number;
|
||||
height: number;
|
||||
onClose: () => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
}
|
||||
|
||||
type ModalState = "form" | "loading" | "results";
|
||||
|
|
@ -31,6 +33,7 @@ export function ToolTestModal({
|
|||
width,
|
||||
height,
|
||||
onClose,
|
||||
onAuthRecoveryRequired,
|
||||
}: ToolTestModalProps) {
|
||||
const [state, setState] = useState<ModalState>("form");
|
||||
const [result, setResult] = useState<ToolResult | null>(null);
|
||||
|
|
@ -150,6 +153,11 @@ export function ToolTestModal({
|
|||
}
|
||||
setState("results");
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
const duration = Date.now() - startTime;
|
||||
const errorObj =
|
||||
error instanceof Error
|
||||
|
|
|
|||
36
clients/tui/src/utils/tuiOAuth.ts
Normal file
36
clients/tui/src/utils/tuiOAuth.ts
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
|
||||
import {
|
||||
isStandardOAuthStepUp as isCoreStandardOAuthStepUp,
|
||||
isStepUpConfirmation as isCoreStepUpConfirmation,
|
||||
stepUpConfirmMessage,
|
||||
stepUpInsufficientScopeMessage,
|
||||
} from "@inspector/core/auth/oauthUx.js";
|
||||
import type { InspectorServerSettings } from "@inspector/core/mcp/types.js";
|
||||
|
||||
export { stepUpConfirmMessage, stepUpInsufficientScopeMessage };
|
||||
|
||||
export {
|
||||
stepUpAuthorizeActionLabel,
|
||||
stepUpFollowUpMessage,
|
||||
stepUpModalTitle,
|
||||
} from "@inspector/core/auth/oauthUx.js";
|
||||
|
||||
/** Standard-OAuth step-up (not EMA silent re-mint). */
|
||||
export function isStandardOAuthStepUp(
|
||||
challenge: AuthChallenge,
|
||||
settings?: InspectorServerSettings,
|
||||
): boolean {
|
||||
return isCoreStandardOAuthStepUp(challenge, {
|
||||
enterpriseManaged: settings?.enterpriseManaged,
|
||||
});
|
||||
}
|
||||
|
||||
/** Standard or EMA step-up that requires in-app confirmation before OAuth. */
|
||||
export function isStepUpConfirmation(
|
||||
challenge: AuthChallenge,
|
||||
settings?: InspectorServerSettings,
|
||||
): boolean {
|
||||
return isCoreStepUpConfirmation(challenge, {
|
||||
enterpriseManaged: settings?.enterpriseManaged,
|
||||
});
|
||||
}
|
||||
Loading…
Reference in a new issue