All of the mid-session and step-up auth work
This commit is contained in:
Bob Dickinson
parent
1f31e0f1f8
commit
562bdd00f1
8 changed files with 11437 additions and 1212 deletions
|
|
@ -45,7 +45,10 @@ import {
|
|||
CallbackNavigation,
|
||||
MutableRedirectUrlProvider,
|
||||
isUnauthorizedError,
|
||||
AuthRecoveryRequiredError,
|
||||
} from "@inspector/core/auth/index.js";
|
||||
import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
|
||||
import type { TypedEvent } from "@inspector/core/mcp/inspectorClientEventTarget.js";
|
||||
import { isEmaClientNotConfiguredError } from "@inspector/core/auth/ema/clientConfigError.js";
|
||||
import type { ClientConfig } from "@inspector/core/client/types.js";
|
||||
import {
|
||||
|
|
@ -57,9 +60,15 @@ import {
|
|||
createOAuthCallbackServer,
|
||||
type OAuthCallbackServer,
|
||||
NodeOAuthStorage,
|
||||
runRunnerInteractiveOAuth,
|
||||
} from "@inspector/core/auth/node/index.js";
|
||||
import { getTuiLogger } from "./logger.js";
|
||||
import { openUrl } from "./utils/openUrl.js";
|
||||
import {
|
||||
isStepUpConfirmation,
|
||||
stepUpInsufficientScopeMessage,
|
||||
} from "./utils/tuiOAuth.js";
|
||||
import { emaStepUpFailureMessage } from "@inspector/core/auth/oauthUx.js";
|
||||
import { Tabs } from "./components/Tabs.js";
|
||||
import { type TabType, tabs as tabList } from "./components/tabsConfig.js";
|
||||
import { InfoTab } from "./components/InfoTab.js";
|
||||
|
|
@ -141,14 +150,6 @@ function App({
|
|||
callbackUrlConfig,
|
||||
}: AppProps) {
|
||||
const { exit } = useApp();
|
||||
const callbackServerBaseOptions = useMemo(
|
||||
() => ({
|
||||
port: callbackUrlConfig.port,
|
||||
hostname: callbackUrlConfig.hostname,
|
||||
path: callbackUrlConfig.pathname,
|
||||
}),
|
||||
[callbackUrlConfig],
|
||||
);
|
||||
|
||||
useEffect(() => {
|
||||
getTuiLogger().info(
|
||||
|
|
@ -174,9 +175,22 @@ function App({
|
|||
>("idle");
|
||||
const [oauthMessage, setOauthMessage] = useState<string | null>(null);
|
||||
const [oauthRevision, setOauthRevision] = useState(0);
|
||||
const [pendingStepUp, setPendingStepUp] = useState<{
|
||||
serverName: string;
|
||||
challenge: AuthChallenge;
|
||||
authorizationUrl: URL;
|
||||
enterpriseManaged?: boolean;
|
||||
} | null>(null);
|
||||
const pendingStepUpRef = useRef(pendingStepUp);
|
||||
useEffect(() => {
|
||||
pendingStepUpRef.current = pendingStepUp;
|
||||
}, [pendingStepUp]);
|
||||
const [connectError, setConnectError] = useState<string | null>(null);
|
||||
const oauthInProgressRef = useRef(false);
|
||||
const callbackServerRef = useRef<OAuthCallbackServer | null>(null);
|
||||
const selectedServerRef = useRef<string | null>(null);
|
||||
const mcpServersRef = useRef(mcpServers);
|
||||
const inspectorClientsRef = useRef<Record<string, InspectorClient>>({});
|
||||
|
||||
// Tool test modal state
|
||||
const [toolTestModal, setToolTestModal] = useState<{
|
||||
|
|
@ -419,12 +433,22 @@ function App({
|
|||
// eslint-disable-next-line react-hooks/exhaustive-deps
|
||||
}, []);
|
||||
|
||||
// Clear OAuth status when switching servers
|
||||
// Clear OAuth status when switching servers; drop step-up for other servers.
|
||||
useEffect(() => {
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(null);
|
||||
const stepUp = pendingStepUpRef.current;
|
||||
if (stepUp && selectedServer && stepUp.serverName !== selectedServer) {
|
||||
setPendingStepUp(null);
|
||||
}
|
||||
}, [selectedServer]);
|
||||
|
||||
useEffect(() => {
|
||||
selectedServerRef.current = selectedServer;
|
||||
mcpServersRef.current = mcpServers;
|
||||
inspectorClientsRef.current = inspectorClients;
|
||||
}, [selectedServer, mcpServers, inspectorClients]);
|
||||
|
||||
// Switch away from Auth tab when server is not OAuth-capable
|
||||
useEffect(() => {
|
||||
if (
|
||||
|
|
@ -534,79 +558,184 @@ function App({
|
|||
selectedManagedPromptsState,
|
||||
);
|
||||
|
||||
// Shared ref for OAuth callback server; stop before starting new (avoids EADDRINUSE when prior auth failed without redirect)
|
||||
// Connect — on 401 or mid-session auth recovery, run OAuth then retry.
|
||||
const runOAuthAuthentication = useCallback(
|
||||
async (options?: {
|
||||
challenge?: AuthChallenge;
|
||||
authorizationUrl?: URL;
|
||||
/** When set, run OAuth for this server (may differ from the selected server). */
|
||||
serverName?: string;
|
||||
}) => {
|
||||
const serverName = options?.serverName ?? selectedServer;
|
||||
if (!serverName) {
|
||||
return;
|
||||
}
|
||||
const client = inspectorClientsRef.current[serverName];
|
||||
const serverEntry = mcpServersRef.current[serverName];
|
||||
const serverConfig = serverEntry?.config;
|
||||
if (
|
||||
!client ||
|
||||
!serverConfig ||
|
||||
!isOAuthCapableServerConfig(serverConfig)
|
||||
) {
|
||||
return;
|
||||
}
|
||||
if (oauthInProgressRef.current) return;
|
||||
oauthInProgressRef.current = true;
|
||||
getTuiLogger().info(
|
||||
{ server: serverName },
|
||||
"OAuth authentication started",
|
||||
);
|
||||
const existing = callbackServerRef.current;
|
||||
if (existing) {
|
||||
await existing.stop();
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
const redirectUrlProvider = redirectUrlProvidersRef.current[serverName];
|
||||
if (!redirectUrlProvider) {
|
||||
oauthInProgressRef.current = false;
|
||||
return;
|
||||
}
|
||||
try {
|
||||
const result = await runRunnerInteractiveOAuth({
|
||||
client,
|
||||
redirectUrlProvider,
|
||||
callbackListen: callbackUrlConfig,
|
||||
createCallbackServer: createOAuthCallbackServer,
|
||||
onCallbackServer: (server) => {
|
||||
callbackServerRef.current = server;
|
||||
},
|
||||
authorizationUrl: options?.authorizationUrl,
|
||||
authChallenge: options?.challenge,
|
||||
});
|
||||
|
||||
// Connect — on 401, run OAuth then retry (same pattern as web App.tsx).
|
||||
const runOAuthAuthentication = useCallback(async () => {
|
||||
if (
|
||||
!selectedServer ||
|
||||
!selectedInspectorClient ||
|
||||
!selectedServerConfig ||
|
||||
!isOAuthCapableServerConfig(selectedServerConfig)
|
||||
) {
|
||||
return;
|
||||
}
|
||||
if (oauthInProgressRef.current) return;
|
||||
oauthInProgressRef.current = true;
|
||||
getTuiLogger().info(
|
||||
{ server: selectedServer },
|
||||
"OAuth authentication started",
|
||||
);
|
||||
const existing = callbackServerRef.current;
|
||||
if (existing) {
|
||||
await existing.stop();
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
const callbackServer = createOAuthCallbackServer();
|
||||
callbackServerRef.current = callbackServer;
|
||||
let flowResolve: () => void;
|
||||
let flowReject: (err: Error) => void;
|
||||
const flowDone = new Promise<void>((resolve, reject) => {
|
||||
flowResolve = resolve;
|
||||
flowReject = reject;
|
||||
});
|
||||
try {
|
||||
const { redirectUrl } = await callbackServer.start({
|
||||
...callbackServerBaseOptions,
|
||||
onCallback: async (params) => {
|
||||
try {
|
||||
await selectedInspectorClient!.completeOAuthFlow(params.code);
|
||||
flowResolve!();
|
||||
} catch (err) {
|
||||
flowReject!(err instanceof Error ? err : new Error(String(err)));
|
||||
} finally {
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
},
|
||||
onError: (params) => {
|
||||
flowReject!(
|
||||
new Error(
|
||||
params.error_description ?? params.error ?? "OAuth error",
|
||||
),
|
||||
);
|
||||
void callbackServer.stop();
|
||||
callbackServerRef.current = null;
|
||||
},
|
||||
if (result.kind === "insufficient_scope") {
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(stepUpInsufficientScopeMessage(result.challenge));
|
||||
return;
|
||||
}
|
||||
if (result.kind === "success" || result.kind === "already_authorized") {
|
||||
setOauthRevision((n) => n + 1);
|
||||
}
|
||||
} finally {
|
||||
oauthInProgressRef.current = false;
|
||||
callbackServerRef.current = null;
|
||||
}
|
||||
},
|
||||
[selectedServer, callbackUrlConfig],
|
||||
);
|
||||
|
||||
const presentStepUpForServer = useCallback(
|
||||
(
|
||||
serverName: string,
|
||||
challenge: AuthChallenge,
|
||||
authorizationUrl: URL,
|
||||
enterpriseManaged?: boolean,
|
||||
) => {
|
||||
const pending = pendingStepUpRef.current;
|
||||
if (pending && pending.serverName !== serverName) {
|
||||
setOauthMessage(
|
||||
"A step-up prompt is already open. Complete or decline it before continuing.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (pending?.serverName === serverName) {
|
||||
setOauthMessage(
|
||||
"Updated step-up request — review the scopes on the Auth tab.",
|
||||
);
|
||||
} else {
|
||||
setOauthMessage(null);
|
||||
}
|
||||
setSelectedServer(serverName);
|
||||
setPendingStepUp({
|
||||
serverName,
|
||||
challenge,
|
||||
authorizationUrl,
|
||||
enterpriseManaged,
|
||||
});
|
||||
const redirectUrlProvider =
|
||||
redirectUrlProvidersRef.current[selectedServer];
|
||||
if (redirectUrlProvider) {
|
||||
redirectUrlProvider.redirectUrl = redirectUrl;
|
||||
setActiveTab("auth");
|
||||
setOauthStatus("idle");
|
||||
setFocus("tabContentList");
|
||||
},
|
||||
[],
|
||||
);
|
||||
|
||||
const handleAuthRecoveryRequired = useCallback(
|
||||
(serverName: string, error: AuthRecoveryRequiredError) => {
|
||||
const serverEntry = mcpServersRef.current[serverName];
|
||||
const settings = serverEntry?.settings;
|
||||
const client = inspectorClientsRef.current[serverName];
|
||||
const needsStepUpConfirm =
|
||||
error.emaStepUpConfirm ||
|
||||
isStepUpConfirmation(error.authChallenge, settings);
|
||||
if (needsStepUpConfirm) {
|
||||
void (async () => {
|
||||
if (
|
||||
client &&
|
||||
(await client.checkAuthChallengeSatisfied(error.authChallenge))
|
||||
) {
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Authorization updated. Retry your action.");
|
||||
setOauthRevision((n) => n + 1);
|
||||
return;
|
||||
}
|
||||
presentStepUpForServer(
|
||||
serverName,
|
||||
error.authChallenge,
|
||||
error.authorizationUrl,
|
||||
settings?.enterpriseManaged,
|
||||
);
|
||||
})();
|
||||
return;
|
||||
}
|
||||
const authUrl = await selectedInspectorClient.authenticate();
|
||||
if (authUrl !== undefined) {
|
||||
await flowDone;
|
||||
void (async () => {
|
||||
if (
|
||||
client &&
|
||||
(await client.checkAuthChallengeSatisfied(error.authChallenge))
|
||||
) {
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Authorization updated. Retry your action.");
|
||||
setOauthRevision((n) => n + 1);
|
||||
return;
|
||||
}
|
||||
const needsSwitch = selectedServerRef.current !== serverName;
|
||||
if (needsSwitch) {
|
||||
setSelectedServer(serverName);
|
||||
setActiveTab("auth");
|
||||
setOauthMessage(
|
||||
`Authentication required for "${serverName}". Re-authenticating…`,
|
||||
);
|
||||
} else {
|
||||
setOauthMessage(null);
|
||||
}
|
||||
setOauthStatus("authenticating");
|
||||
try {
|
||||
await runOAuthAuthentication({
|
||||
challenge: error.authChallenge,
|
||||
authorizationUrl: error.authorizationUrl,
|
||||
serverName,
|
||||
});
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Authorization updated. Retry your action.");
|
||||
} catch (authErr) {
|
||||
const authMsg =
|
||||
authErr instanceof Error ? authErr.message : String(authErr);
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(authMsg);
|
||||
}
|
||||
})();
|
||||
},
|
||||
[presentStepUpForServer, runOAuthAuthentication],
|
||||
);
|
||||
|
||||
const onAuthRecoveryRequired = useCallback(
|
||||
(error: AuthRecoveryRequiredError) => {
|
||||
if (selectedServer) {
|
||||
handleAuthRecoveryRequired(selectedServer, error);
|
||||
}
|
||||
setOauthRevision((n) => n + 1);
|
||||
} finally {
|
||||
oauthInProgressRef.current = false;
|
||||
}
|
||||
}, [
|
||||
selectedServer,
|
||||
selectedInspectorClient,
|
||||
selectedServerConfig,
|
||||
callbackServerBaseOptions,
|
||||
]);
|
||||
},
|
||||
[selectedServer, handleAuthRecoveryRequired],
|
||||
);
|
||||
|
||||
const handleConnect = useCallback(async () => {
|
||||
if (!selectedServer || !selectedInspectorClient || !selectedServerConfig) {
|
||||
|
|
@ -618,6 +747,7 @@ function App({
|
|||
setConnectError(null);
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(null);
|
||||
setOauthRevision((n) => n + 1);
|
||||
};
|
||||
|
||||
try {
|
||||
|
|
@ -639,13 +769,14 @@ function App({
|
|||
try {
|
||||
setOauthStatus("authenticating");
|
||||
setOauthMessage(null);
|
||||
// Tear down the failed handshake transport so the post-OAuth connect
|
||||
// creates a fresh transport with tokens from storage (same as web,
|
||||
// which reloads the client after redirect).
|
||||
await disconnectInspector();
|
||||
await runOAuthAuthentication();
|
||||
await finishConnect();
|
||||
} catch (authErr) {
|
||||
if (authErr instanceof AuthRecoveryRequiredError) {
|
||||
handleAuthRecoveryRequired(selectedServer, authErr);
|
||||
return;
|
||||
}
|
||||
const authMsg =
|
||||
authErr instanceof Error ? authErr.message : String(authErr);
|
||||
setConnectError(authMsg);
|
||||
|
|
@ -659,6 +790,11 @@ function App({
|
|||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (err instanceof AuthRecoveryRequiredError && selectedServer) {
|
||||
handleAuthRecoveryRequired(selectedServer, err);
|
||||
return;
|
||||
}
|
||||
}
|
||||
}, [
|
||||
selectedServer,
|
||||
|
|
@ -667,8 +803,63 @@ function App({
|
|||
connectInspector,
|
||||
disconnectInspector,
|
||||
runOAuthAuthentication,
|
||||
handleAuthRecoveryRequired,
|
||||
]);
|
||||
|
||||
useEffect(() => {
|
||||
const cleanups: Array<() => void> = [];
|
||||
|
||||
for (const [serverName, client] of Object.entries(inspectorClients)) {
|
||||
const onAmbient = (): void => {
|
||||
if (selectedServerRef.current !== serverName) return;
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage("Refreshing authorization…");
|
||||
};
|
||||
const onRecovered = (): void => {
|
||||
if (selectedServerRef.current !== serverName) return;
|
||||
setOauthMessage(null);
|
||||
setOauthRevision((n) => n + 1);
|
||||
};
|
||||
const onInteractive = (
|
||||
event: TypedEvent<"authChallengeInteractive">,
|
||||
): void => {
|
||||
handleAuthRecoveryRequired(
|
||||
serverName,
|
||||
new AuthRecoveryRequiredError(
|
||||
event.detail.authorizationUrl,
|
||||
event.detail.challenge,
|
||||
),
|
||||
);
|
||||
};
|
||||
const onOAuthError = (event: TypedEvent<"oauthError">): void => {
|
||||
if (selectedServerRef.current !== serverName) return;
|
||||
const message =
|
||||
event.detail.error instanceof Error
|
||||
? event.detail.error.message
|
||||
: String(event.detail.error);
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(message);
|
||||
};
|
||||
|
||||
client.addEventListener("authChallengeAmbient", onAmbient);
|
||||
client.addEventListener("authChallengeRecovered", onRecovered);
|
||||
client.addEventListener("authChallengeInteractive", onInteractive);
|
||||
client.addEventListener("oauthError", onOAuthError);
|
||||
cleanups.push(() => {
|
||||
client.removeEventListener("authChallengeAmbient", onAmbient);
|
||||
client.removeEventListener("authChallengeRecovered", onRecovered);
|
||||
client.removeEventListener("authChallengeInteractive", onInteractive);
|
||||
client.removeEventListener("oauthError", onOAuthError);
|
||||
});
|
||||
}
|
||||
|
||||
return () => {
|
||||
for (const cleanup of cleanups) {
|
||||
cleanup();
|
||||
}
|
||||
};
|
||||
}, [inspectorClients, handleAuthRecoveryRequired]);
|
||||
|
||||
// Disconnect handler
|
||||
const handleDisconnect = useCallback(async () => {
|
||||
if (!selectedServer) return;
|
||||
|
|
@ -1110,13 +1301,6 @@ function App({
|
|||
const nextTab = tabAccelerators[input.toLowerCase()]!;
|
||||
setActiveTab(nextTab);
|
||||
setFocus(nextTab === "auth" ? "tabContentList" : "tabs");
|
||||
} else if (
|
||||
activeTab === "auth" &&
|
||||
showAuthTab &&
|
||||
input.toLowerCase() === "s"
|
||||
) {
|
||||
void handleClearOAuth();
|
||||
setFocus("tabContentList");
|
||||
} else if (key.tab && !key.shift) {
|
||||
// Flat focus order: servers -> tabs -> list -> details -> wrap to servers
|
||||
const focusOrder: FocusArea[] =
|
||||
|
|
@ -1470,6 +1654,86 @@ function App({
|
|||
oauthStatus={oauthStatus}
|
||||
oauthMessage={oauthMessage}
|
||||
oauthRevision={oauthRevision}
|
||||
pendingStepUp={
|
||||
pendingStepUp?.serverName === selectedServer
|
||||
? {
|
||||
challenge: pendingStepUp.challenge,
|
||||
authorizationScopes:
|
||||
pendingStepUp.challenge.authorizationScopes,
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
}
|
||||
: null
|
||||
}
|
||||
onAuthorizeStepUp={() => {
|
||||
if (!pendingStepUp || !selectedInspectorClient) return;
|
||||
const { challenge, authorizationUrl, enterpriseManaged } =
|
||||
pendingStepUp;
|
||||
setPendingStepUp(null);
|
||||
setOauthStatus("authenticating");
|
||||
void (async () => {
|
||||
try {
|
||||
if (enterpriseManaged) {
|
||||
const outcome =
|
||||
await selectedInspectorClient.handleAuthChallenge(
|
||||
challenge,
|
||||
{ confirmedStepUp: true },
|
||||
);
|
||||
if (outcome.kind === "satisfied") {
|
||||
await disconnectInspector().catch(() => {});
|
||||
await connectInspector();
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
setOauthRevision((n) => n + 1);
|
||||
return;
|
||||
}
|
||||
if (outcome.kind === "interactive") {
|
||||
await runOAuthAuthentication({
|
||||
challenge: outcome.challenge,
|
||||
authorizationUrl: outcome.authorizationUrl,
|
||||
});
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
if (outcome.kind === "failed") {
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(
|
||||
emaStepUpFailureMessage(outcome.error.message),
|
||||
);
|
||||
return;
|
||||
}
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
return;
|
||||
}
|
||||
await runOAuthAuthentication({
|
||||
challenge,
|
||||
authorizationUrl,
|
||||
});
|
||||
setOauthStatus("idle");
|
||||
setOauthMessage(
|
||||
"Step-up authorization succeeded. Retry your action.",
|
||||
);
|
||||
} catch (authErr) {
|
||||
const authMsg =
|
||||
authErr instanceof Error
|
||||
? authErr.message
|
||||
: String(authErr);
|
||||
setOauthStatus("error");
|
||||
setOauthMessage(authMsg);
|
||||
}
|
||||
})();
|
||||
}}
|
||||
onCancelStepUp={() => {
|
||||
setPendingStepUp(null);
|
||||
setOauthMessage("Authorization cancelled.");
|
||||
}}
|
||||
width={contentWidth}
|
||||
height={contentHeight}
|
||||
focused={
|
||||
|
|
@ -1517,8 +1781,14 @@ function App({
|
|||
inspectorClient: selectedInspectorClient,
|
||||
});
|
||||
}}
|
||||
onAuthRecoveryRequired={onAuthRecoveryRequired}
|
||||
modalOpen={
|
||||
!!(toolTestModal || resourceTestModal || detailsModal)
|
||||
!!(
|
||||
toolTestModal ||
|
||||
resourceTestModal ||
|
||||
promptTestModal ||
|
||||
detailsModal
|
||||
)
|
||||
}
|
||||
/>
|
||||
) : activeTab === "prompts" &&
|
||||
|
|
@ -1552,6 +1822,7 @@ function App({
|
|||
inspectorClient: selectedInspectorClient,
|
||||
});
|
||||
}}
|
||||
onAuthRecoveryRequired={onAuthRecoveryRequired}
|
||||
modalOpen={
|
||||
!!(
|
||||
toolTestModal ||
|
||||
|
|
@ -1680,6 +1951,10 @@ function App({
|
|||
width={dimensions.width}
|
||||
height={dimensions.height}
|
||||
onClose={() => setToolTestModal(null)}
|
||||
onAuthRecoveryRequired={(error) => {
|
||||
onAuthRecoveryRequired(error);
|
||||
setToolTestModal(null);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
|
|
@ -1691,6 +1966,10 @@ function App({
|
|||
width={dimensions.width}
|
||||
height={dimensions.height}
|
||||
onClose={() => setResourceTestModal(null)}
|
||||
onAuthRecoveryRequired={(error) => {
|
||||
onAuthRecoveryRequired(error);
|
||||
setResourceTestModal(null);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
|
|
@ -1701,6 +1980,10 @@ function App({
|
|||
width={dimensions.width}
|
||||
height={dimensions.height}
|
||||
onClose={() => setPromptTestModal(null)}
|
||||
onAuthRecoveryRequired={(error) => {
|
||||
onAuthRecoveryRequired(error);
|
||||
setPromptTestModal(null);
|
||||
}}
|
||||
/>
|
||||
)}
|
||||
|
||||
|
|
|
|||
|
|
@ -8,12 +8,19 @@ import type {
|
|||
ConnectionStatus,
|
||||
} from "@inspector/core/mcp/index.js";
|
||||
import type { OAuthConnectionState } from "@inspector/core/auth/types.js";
|
||||
import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
|
||||
import {
|
||||
formatAuthProtocol,
|
||||
formatClientRegistrationKind,
|
||||
formatIdpSession,
|
||||
formatScopes,
|
||||
} from "../utils/oauthDisplay.js";
|
||||
import {
|
||||
stepUpAuthorizeActionLabel,
|
||||
stepUpConfirmMessage,
|
||||
stepUpFollowUpMessage,
|
||||
stepUpModalTitle,
|
||||
} from "../utils/tuiOAuth.js";
|
||||
|
||||
interface AuthTabProps {
|
||||
serverName: string | null;
|
||||
|
|
@ -22,6 +29,13 @@ interface AuthTabProps {
|
|||
oauthStatus: "idle" | "authenticating" | "error";
|
||||
oauthMessage: string | null;
|
||||
oauthRevision: number;
|
||||
pendingStepUp?: {
|
||||
challenge: AuthChallenge;
|
||||
authorizationScopes?: string[];
|
||||
enterpriseManaged?: boolean;
|
||||
} | null;
|
||||
onAuthorizeStepUp?: () => void;
|
||||
onCancelStepUp?: () => void;
|
||||
width: number;
|
||||
height: number;
|
||||
focused?: boolean;
|
||||
|
|
@ -44,6 +58,9 @@ export function AuthTab({
|
|||
oauthStatus,
|
||||
oauthMessage,
|
||||
oauthRevision,
|
||||
pendingStepUp,
|
||||
onAuthorizeStepUp,
|
||||
onCancelStepUp,
|
||||
width,
|
||||
height,
|
||||
focused = false,
|
||||
|
|
@ -58,6 +75,7 @@ export function AuthTab({
|
|||
>(undefined);
|
||||
const [clearedConfirmation, setClearedConfirmation] = useState(false);
|
||||
const [lastClearDisconnected, setLastClearDisconnected] = useState(false);
|
||||
const [stepUpChoiceIndex, setStepUpChoiceIndex] = useState(0);
|
||||
|
||||
const refreshOAuthState = useCallback(async () => {
|
||||
if (!inspectorClient) {
|
||||
|
|
@ -70,13 +88,17 @@ export function AuthTab({
|
|||
|
||||
useEffect(() => {
|
||||
void refreshOAuthState();
|
||||
}, [refreshOAuthState, oauthRevision]);
|
||||
}, [refreshOAuthState, oauthRevision, connectionStatus]);
|
||||
|
||||
useEffect(() => {
|
||||
setClearedConfirmation(false);
|
||||
setLastClearDisconnected(false);
|
||||
}, [oauthRevision]);
|
||||
|
||||
useEffect(() => {
|
||||
setStepUpChoiceIndex(0);
|
||||
}, [pendingStepUp]);
|
||||
|
||||
useEffect(() => {
|
||||
if (!inspectorClient) return;
|
||||
|
||||
|
|
@ -93,6 +115,34 @@ export function AuthTab({
|
|||
(input: string, key: Key) => {
|
||||
if (!focused) return;
|
||||
|
||||
if (pendingStepUp) {
|
||||
if (key.upArrow) {
|
||||
setStepUpChoiceIndex((i) => Math.max(0, i - 1));
|
||||
return;
|
||||
}
|
||||
if (key.downArrow) {
|
||||
setStepUpChoiceIndex((i) => Math.min(1, i + 1));
|
||||
return;
|
||||
}
|
||||
if (key.return) {
|
||||
if (stepUpChoiceIndex === 0) {
|
||||
onAuthorizeStepUp?.();
|
||||
} else {
|
||||
onCancelStepUp?.();
|
||||
}
|
||||
return;
|
||||
}
|
||||
if (input.toLowerCase() === "a") {
|
||||
onAuthorizeStepUp?.();
|
||||
return;
|
||||
}
|
||||
if (input.toLowerCase() === "c") {
|
||||
onCancelStepUp?.();
|
||||
return;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (key.upArrow && scrollViewRef.current) {
|
||||
scrollViewRef.current.scrollBy(-1);
|
||||
} else if (key.downArrow && scrollViewRef.current) {
|
||||
|
|
@ -139,6 +189,66 @@ export function AuthTab({
|
|||
{oauthStatus === "error" && oauthMessage && (
|
||||
<Text color="red">{oauthMessage}</Text>
|
||||
)}
|
||||
{oauthStatus === "idle" && oauthMessage && (
|
||||
<Text color="cyan">{oauthMessage}</Text>
|
||||
)}
|
||||
|
||||
{pendingStepUp ? (
|
||||
<Box marginTop={1} flexDirection="column" gap={0}>
|
||||
<Text bold color="yellow">
|
||||
{stepUpModalTitle({
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
})}
|
||||
</Text>
|
||||
<Text>
|
||||
{stepUpConfirmMessage(pendingStepUp.challenge, {
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
})}{" "}
|
||||
{stepUpFollowUpMessage({
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
})}
|
||||
</Text>
|
||||
{(() => {
|
||||
const scopes =
|
||||
pendingStepUp.authorizationScopes ??
|
||||
pendingStepUp.challenge.requiredScopes;
|
||||
if (!scopes?.length) return null;
|
||||
return (
|
||||
<Box marginTop={1} flexDirection="column">
|
||||
<Text dimColor>
|
||||
{pendingStepUp.enterpriseManaged
|
||||
? "Permissions requested:"
|
||||
: "Scopes requested:"}
|
||||
</Text>
|
||||
{scopes.map((scope) => (
|
||||
<Text key={scope} dimColor>
|
||||
{" "}
|
||||
• {scope}
|
||||
</Text>
|
||||
))}
|
||||
</Box>
|
||||
);
|
||||
})()}
|
||||
<Box marginTop={1} flexDirection="column">
|
||||
<SelectableItem isSelected={stepUpChoiceIndex === 0} bold>
|
||||
{(() => {
|
||||
const label = stepUpAuthorizeActionLabel({
|
||||
enterpriseManaged: pendingStepUp.enterpriseManaged,
|
||||
});
|
||||
return (
|
||||
<>
|
||||
<Text underline>{label[0]}</Text>
|
||||
{label.slice(1)}
|
||||
</>
|
||||
);
|
||||
})()}
|
||||
</SelectableItem>
|
||||
<SelectableItem isSelected={stepUpChoiceIndex === 1}>
|
||||
<Text underline>C</Text>ancel
|
||||
</SelectableItem>
|
||||
</Box>
|
||||
</Box>
|
||||
) : null}
|
||||
|
||||
{oauthState ? (
|
||||
<Box flexDirection="column" marginTop={1} gap={0}>
|
||||
|
|
@ -229,7 +339,9 @@ export function AuthTab({
|
|||
backgroundColor="gray"
|
||||
>
|
||||
<Text bold color="white">
|
||||
S {isLiveConnection ? "clear+disconnect" : "clear"}, ↑/↓ scroll
|
||||
{pendingStepUp
|
||||
? "↑/↓ select, Enter confirm, A authorize, C cancel"
|
||||
: `S ${isLiveConnection ? "clear+disconnect" : "clear"}, ↑/↓ scroll`}
|
||||
</Text>
|
||||
</Box>
|
||||
)}
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { Form } from "ink-form";
|
||||
import { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type {
|
||||
Prompt,
|
||||
GetPromptResult,
|
||||
|
|
@ -29,6 +30,7 @@ interface PromptTestModalProps {
|
|||
width: number;
|
||||
height: number;
|
||||
onClose: () => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
}
|
||||
|
||||
type ModalState = "form" | "loading" | "results";
|
||||
|
|
@ -47,6 +49,7 @@ export function PromptTestModal({
|
|||
width,
|
||||
height,
|
||||
onClose,
|
||||
onAuthRecoveryRequired,
|
||||
}: PromptTestModalProps) {
|
||||
const [state, setState] = useState<ModalState>("form");
|
||||
const [result, setResult] = useState<PromptResult | null>(null);
|
||||
|
|
@ -144,6 +147,11 @@ export function PromptTestModal({
|
|||
});
|
||||
setState("results");
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
const duration = Date.now() - startTime;
|
||||
const errorMessage = getErrorMessage(error);
|
||||
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState, useEffect, useRef } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
|
||||
import type { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type {
|
||||
Prompt,
|
||||
PromptArgument,
|
||||
|
|
@ -18,6 +19,7 @@ interface PromptsTabProps {
|
|||
focusedPane?: "list" | "details" | null;
|
||||
onViewDetails?: (prompt: Prompt & { result?: GetPromptResult }) => void;
|
||||
onFetchPrompt?: (prompt: Prompt) => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
modalOpen?: boolean;
|
||||
}
|
||||
|
||||
|
|
@ -29,6 +31,7 @@ export function PromptsTab({
|
|||
focusedPane = null,
|
||||
onViewDetails,
|
||||
onFetchPrompt,
|
||||
onAuthRecoveryRequired,
|
||||
modalOpen = false,
|
||||
}: PromptsTabProps) {
|
||||
const visibleCount = Math.max(1, height - 7);
|
||||
|
|
@ -64,6 +67,10 @@ export function PromptsTab({
|
|||
});
|
||||
}
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
return;
|
||||
}
|
||||
setError(
|
||||
error instanceof Error ? error.message : "Failed to get prompt",
|
||||
);
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { Form } from "ink-form";
|
||||
import { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type { ReadResourceResult } from "@modelcontextprotocol/sdk/types.js";
|
||||
import { uriTemplateToForm } from "../utils/uriTemplateToForm.js";
|
||||
import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
|
||||
|
|
@ -30,6 +31,7 @@ interface ResourceTestModalProps {
|
|||
width: number;
|
||||
height: number;
|
||||
onClose: () => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
}
|
||||
|
||||
type ModalState = "form" | "loading" | "results";
|
||||
|
|
@ -49,6 +51,7 @@ export function ResourceTestModal({
|
|||
width,
|
||||
height,
|
||||
onClose,
|
||||
onAuthRecoveryRequired,
|
||||
}: ResourceTestModalProps) {
|
||||
const [state, setState] = useState<ModalState>("form");
|
||||
const [result, setResult] = useState<ResourceResult | null>(null);
|
||||
|
|
@ -150,6 +153,11 @@ export function ResourceTestModal({
|
|||
});
|
||||
setState("results");
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
const duration = Date.now() - startTime;
|
||||
const errorMessage = getErrorMessage(error);
|
||||
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState, useEffect, useRef, useMemo } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { ScrollView, type ScrollViewRef } from "ink-scroll-view";
|
||||
import type { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type {
|
||||
Resource,
|
||||
ReadResourceResult,
|
||||
|
|
@ -27,6 +28,7 @@ interface ResourcesTabProps {
|
|||
) => void;
|
||||
onFetchResource?: (resource: Resource) => void;
|
||||
onFetchTemplate?: (template: ResourceTemplate) => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
modalOpen?: boolean;
|
||||
}
|
||||
|
||||
|
|
@ -41,6 +43,7 @@ export function ResourcesTab({
|
|||
onViewDetails,
|
||||
onFetchResource,
|
||||
onFetchTemplate,
|
||||
onAuthRecoveryRequired,
|
||||
modalOpen = false,
|
||||
}: ResourcesTabProps) {
|
||||
const [error, setError] = useState<string | null>(null);
|
||||
|
|
@ -169,6 +172,10 @@ export function ResourcesTab({
|
|||
await inspectorClient.readResource(shouldFetchResource);
|
||||
setResourceContent(invocation.result);
|
||||
} catch (err) {
|
||||
if (err instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(err);
|
||||
return;
|
||||
}
|
||||
setError(
|
||||
err instanceof Error ? err.message : "Failed to read resource",
|
||||
);
|
||||
|
|
@ -180,7 +187,7 @@ export function ResourcesTab({
|
|||
};
|
||||
|
||||
fetchContent();
|
||||
}, [shouldFetchResource, inspectorClient]);
|
||||
}, [shouldFetchResource, inspectorClient, onAuthRecoveryRequired]);
|
||||
|
||||
const listWidth = Math.floor(width * 0.4);
|
||||
const detailWidth = width - listWidth;
|
||||
|
|
|
|||
|
|
@ -2,6 +2,7 @@ import React, { useState } from "react";
|
|||
import { Box, Text, useInput, type Key } from "ink";
|
||||
import { Form } from "ink-form";
|
||||
import { InspectorClient } from "@inspector/core/mcp/index.js";
|
||||
import { AuthRecoveryRequiredError } from "@inspector/core/auth/challenge.js";
|
||||
import type { Tool, CallToolResult } from "@modelcontextprotocol/sdk/types.js";
|
||||
import type { JsonValue } from "@inspector/core/mcp/index.js";
|
||||
import { schemaToForm } from "../utils/schemaToForm.js";
|
||||
|
|
@ -13,6 +14,7 @@ interface ToolTestModalProps {
|
|||
width: number;
|
||||
height: number;
|
||||
onClose: () => void;
|
||||
onAuthRecoveryRequired?: (error: AuthRecoveryRequiredError) => void;
|
||||
}
|
||||
|
||||
type ModalState = "form" | "loading" | "results";
|
||||
|
|
@ -31,6 +33,7 @@ export function ToolTestModal({
|
|||
width,
|
||||
height,
|
||||
onClose,
|
||||
onAuthRecoveryRequired,
|
||||
}: ToolTestModalProps) {
|
||||
const [state, setState] = useState<ModalState>("form");
|
||||
const [result, setResult] = useState<ToolResult | null>(null);
|
||||
|
|
@ -150,6 +153,11 @@ export function ToolTestModal({
|
|||
}
|
||||
setState("results");
|
||||
} catch (error) {
|
||||
if (error instanceof AuthRecoveryRequiredError) {
|
||||
onAuthRecoveryRequired?.(error);
|
||||
onClose();
|
||||
return;
|
||||
}
|
||||
const duration = Date.now() - startTime;
|
||||
const errorObj =
|
||||
error instanceof Error
|
||||
|
|
|
|||
36
clients/tui/src/utils/tuiOAuth.ts
Normal file
36
clients/tui/src/utils/tuiOAuth.ts
Normal file
|
|
@ -0,0 +1,36 @@
|
|||
import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
|
||||
import {
|
||||
isStandardOAuthStepUp as isCoreStandardOAuthStepUp,
|
||||
isStepUpConfirmation as isCoreStepUpConfirmation,
|
||||
stepUpConfirmMessage,
|
||||
stepUpInsufficientScopeMessage,
|
||||
} from "@inspector/core/auth/oauthUx.js";
|
||||
import type { InspectorServerSettings } from "@inspector/core/mcp/types.js";
|
||||
|
||||
export { stepUpConfirmMessage, stepUpInsufficientScopeMessage };
|
||||
|
||||
export {
|
||||
stepUpAuthorizeActionLabel,
|
||||
stepUpFollowUpMessage,
|
||||
stepUpModalTitle,
|
||||
} from "@inspector/core/auth/oauthUx.js";
|
||||
|
||||
/** Standard-OAuth step-up (not EMA silent re-mint). */
|
||||
export function isStandardOAuthStepUp(
|
||||
challenge: AuthChallenge,
|
||||
settings?: InspectorServerSettings,
|
||||
): boolean {
|
||||
return isCoreStandardOAuthStepUp(challenge, {
|
||||
enterpriseManaged: settings?.enterpriseManaged,
|
||||
});
|
||||
}
|
||||
|
||||
/** Standard or EMA step-up that requires in-app confirmation before OAuth. */
|
||||
export function isStepUpConfirmation(
|
||||
challenge: AuthChallenge,
|
||||
settings?: InspectorServerSettings,
|
||||
): boolean {
|
||||
return isCoreStepUpConfirmation(challenge, {
|
||||
enterpriseManaged: settings?.enterpriseManaged,
|
||||
});
|
||||
}
|
||||
Loading…
Reference in a new issue