All of the mid-session and step-up auth work

clients/web/src/test/integration/mcp/remote/remote-session.test.ts

@@ -10,6 +10,7 @@ import { describe, it, expect, vi } from "vitest";
 import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
 import { RemoteSession } from "@inspector/core/mcp/remote/node/remote-session.js";
 import type { FetchRequestEntryBase } from "@inspector/core/mcp/types.js";
+import { AuthChallengeError } from "@inspector/core/auth/challenge.js";
 
 function makeFetchEntry(
   overrides: Partial<FetchRequestEntryBase> = {},
@@ -173,4 +174,113 @@ describe("RemoteSession", () => {
       "2026-01-01T00:00:00.000Z",
     );
   });
+
+  it("waitForRequestResponse resolves when a matching JSON-RPC response arrives", async () => {
+    const session = new RemoteSession("s-wait");
+    const wait = session.waitForRequestResponse(42);
+    session.onMessage({ jsonrpc: "2.0", id: 42, result: { tools: [] } });
+    await expect(wait).resolves.toBeUndefined();
+  });
+
+  it("handleTransportAuthError rejects active request waits during send", async () => {
+    const session = new RemoteSession("s-auth");
+    session.beginSend();
+    const wait = session.waitForRequestResponse(1);
+    const err = new AuthChallengeError({ reason: "token_expired" }, 401);
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    await expect(wait).rejects.toBe(err);
+    session.endSend();
+  });
+
+  it("handleTransportAuthError pushes ambient auth when no send is active", () => {
+    const session = new RemoteSession("s-ambient");
+    const received: unknown[] = [];
+    session.setEventConsumer((event) => {
+      if (event.type === "auth_challenge") received.push(event.data);
+    });
+    const err = new AuthChallengeError({ reason: "token_expired" }, 401);
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(1);
+  });
+
+  it("does not push SSE auth while a send is active (command path owns delivery)", () => {
+    const session = new RemoteSession("s-active");
+    const received: unknown[] = [];
+    session.setEventConsumer((event) => {
+      if (event.type === "auth_challenge") received.push(event.data);
+    });
+    const err = new AuthChallengeError({ reason: "token_expired" }, 401);
+    session.beginSend();
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(0);
+    session.endSend();
+  });
+
+  it("does not duplicate on SSE until the HTTP echo suppress window expires", () => {
+    vi.useFakeTimers();
+    const session = new RemoteSession("s-echo");
+    const received: unknown[] = [];
+    session.setEventConsumer((event) => {
+      if (event.type === "auth_challenge") received.push(event.data);
+    });
+    const err = new AuthChallengeError({ reason: "token_expired" }, 401);
+    session.beginSend();
+    session.noteAuthChallengeDeliveredViaHttp();
+    session.endSend();
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(0);
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(0);
+    session.beginSend();
+    session.endSend();
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(0);
+    vi.advanceTimersByTime(RemoteSession.AUTH_HTTP_ECHO_SUPPRESS_MS + 1);
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(1);
+    vi.useRealTimers();
+  });
+
+  it("does not clear HTTP auth suppression when a concurrent send starts", () => {
+    const session = new RemoteSession("s-concurrent");
+    const received: unknown[] = [];
+    session.setEventConsumer((event) => {
+      if (event.type === "auth_challenge") received.push(event.data);
+    });
+    const err = new AuthChallengeError({ reason: "token_expired" }, 401);
+    session.beginSend();
+    session.noteAuthChallengeDeliveredViaHttp();
+    session.endSend();
+    session.beginSend();
+    expect(session.handleTransportAuthError(err)).toBe(true);
+    expect(received).toHaveLength(0);
+    session.endSend();
+  });
+
+  it("waitForRequestResponse rejects after timeout", async () => {
+    vi.useFakeTimers();
+    const session = new RemoteSession("s-timeout");
+    const wait = session.waitForRequestResponse(99, 1000);
+    const rejection = expect(wait).rejects.toThrow(/timed out/);
+    await vi.advanceTimersByTimeAsync(1000);
+    await rejection;
+    vi.useRealTimers();
+  });
+
+  it("setAuthState updates the session auth provider", async () => {
+    const { createRemoteAuthProvider } =
+      await import("@inspector/core/mcp/remote/node/tokenAuthProvider.js");
+    const handle = createRemoteAuthProvider({
+      oauthTokens: { access_token: "old", token_type: "Bearer" },
+    })!;
+    const session = new RemoteSession("auth-state");
+    session.setAuthProviderHandle(handle);
+    session.setAuthState({
+      oauthTokens: { access_token: "new", token_type: "Bearer" },
+    });
+    await expect(handle.provider.tokens()).resolves.toEqual({
+      access_token: "new",
+      token_type: "Bearer",
+    });
+  });
 });

clients/web/src/test/integration/mcp/remote/remoteClientTransport-unit.test.ts

@@ -53,10 +53,22 @@ function sseFrame(event: RemoteEvent): string {
 }
 
 interface MockFetchPlan {
-  connect?: () => Response | Promise<Response>;
-  events?: () => Response | Promise<Response>;
-  send?: () => Response | Promise<Response>;
-  disconnect?: () => Response | Promise<Response>;
+  connect?: (
+    input: RequestInfo | URL,
+    init?: RequestInit,
+  ) => Response | Promise<Response>;
+  events?: (
+    input: RequestInfo | URL,
+    init?: RequestInit,
+  ) => Response | Promise<Response>;
+  send?: (
+    input: RequestInfo | URL,
+    init?: RequestInit,
+  ) => Response | Promise<Response>;
+  disconnect?: (
+    input: RequestInfo | URL,
+    init?: RequestInit,
+  ) => Response | Promise<Response>;
 }
 
 /**
@@ -64,24 +76,28 @@ interface MockFetchPlan {
  * handlers, defaulting to sensible success responses when a handler is omitted.
  */
 function mockFetch(plan: MockFetchPlan): typeof fetch {
-  const fn = vi.fn(async (input: RequestInfo | URL): Promise<Response> => {
-    const url = typeof input === "string" ? input : input.toString();
-    if (url.includes("/api/mcp/connect")) {
-      return plan.connect
-        ? plan.connect()
-        : jsonResponse({ sessionId: "sess-1" });
-    }
-    if (url.includes("/api/mcp/events")) {
-      return plan.events ? plan.events() : sseResponse([]);
-    }
-    if (url.includes("/api/mcp/send")) {
-      return plan.send ? plan.send() : jsonResponse({ ok: true });
-    }
-    if (url.includes("/api/mcp/disconnect")) {
-      return plan.disconnect ? plan.disconnect() : jsonResponse({ ok: true });
-    }
-    throw new Error(`unexpected fetch to ${url}`);
-  });
+  const fn = vi.fn(
+    async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
+      const url = typeof input === "string" ? input : input.toString();
+      if (url.includes("/api/mcp/connect")) {
+        return plan.connect
+          ? plan.connect(input, init)
+          : jsonResponse({ sessionId: "sess-1" });
+      }
+      if (url.includes("/api/mcp/events")) {
+        return plan.events ? plan.events(input, init) : sseResponse([]);
+      }
+      if (url.includes("/api/mcp/send")) {
+        return plan.send ? plan.send(input, init) : jsonResponse({ ok: true });
+      }
+      if (url.includes("/api/mcp/disconnect")) {
+        return plan.disconnect
+          ? plan.disconnect(input, init)
+          : jsonResponse({ ok: true });
+      }
+      throw new Error(`unexpected fetch to ${url}`);
+    },
+  );
   return fn as unknown as typeof fetch;
 }
 
@@ -172,7 +188,9 @@ describe("RemoteClientTransport (focused branch coverage)", () => {
       );
       await t.start();
       expect(connectBody).toMatchObject({
-        oauthTokens: { access_token: "AT", refresh_token: "RT" },
+        authState: {
+          oauthTokens: { access_token: "AT", refresh_token: "RT" },
+        },
       });
       await t.close();
     });
@@ -497,17 +515,38 @@ describe("RemoteClientTransport (focused branch coverage)", () => {
 
     it("posts a message including relatedRequestId and succeeds", async () => {
       let sentBody: { relatedRequestId?: unknown } | undefined;
+      const encoder = new TextEncoder();
+      let sseController: ReadableStreamDefaultController<Uint8Array> | null =
+        null;
+      const pushSseMessage = (message: JSONRPCMessage) => {
+        const payload = JSON.stringify({ type: "message", data: message });
+        sseController?.enqueue(encoder.encode(`data: ${payload}\n\n`));
+      };
       const fetchFn = vi.fn(
         async (input: RequestInfo | URL, init?: RequestInit) => {
           const url = typeof input === "string" ? input : input.toString();
           if (url.includes("/connect")) return jsonResponse({ sessionId: "s" });
-          if (url.includes("/events"))
+          if (url.includes("/events")) {
             return new Response(
-              new ReadableStream<Uint8Array>({ start() {} }),
+              new ReadableStream<Uint8Array>({
+                start(controller) {
+                  sseController = controller;
+                  controller.enqueue(encoder.encode(": keepalive\n\n"));
+                },
+              }),
               { status: 200 },
             );
+          }
           if (url.includes("/send")) {
             sentBody = JSON.parse(init!.body as string);
+            const requestId = (
+              sentBody as { message: { id?: string | number } }
+            ).message.id;
+            pushSseMessage({
+              jsonrpc: "2.0",
+              id: requestId!,
+              result: {},
+            });
             return jsonResponse({ ok: true });
           }
           return jsonResponse({ ok: true });
@@ -517,6 +556,7 @@ describe("RemoteClientTransport (focused branch coverage)", () => {
         {
           baseUrl: "http://remote.test",
           fetchFn: fetchFn as unknown as typeof fetch,
+          sseResponseTimeoutMs: 2000,
         },
         CONFIG,
       );
@@ -577,6 +617,22 @@ describe("RemoteClientTransport (focused branch coverage)", () => {
     });
   });
 
+  describe("attachToSession", () => {
+    it("opens SSE for an existing session without POST /connect", async () => {
+      const connect = vi.fn(() => jsonResponse({ sessionId: "new" }));
+      const events = vi.fn(() => sseResponse([]));
+      const t = makeTransport({ connect, events });
+      await t.attachToSession("existing-sess");
+      expect(connect).not.toHaveBeenCalled();
+      expect(events).toHaveBeenCalledWith(
+        expect.stringContaining("sessionId=existing-sess"),
+        expect.anything(),
+      );
+      expect(t.getRemoteBackendSessionId()).toBe("existing-sess");
+      await t.close();
+    });
+  });
+
   describe("sessionId getter", () => {
     it("always returns undefined (intentional)", () => {
       const t = makeTransport({});

clients/web/src/test/integration/mcp/remote/transport.test.ts

@@ -1340,7 +1340,7 @@ describe("Remote transport e2e", () => {
       expect((await res.json()).error).toMatch(/Failed to create transport:/);
     });
 
-    it("/api/mcp/send returns 500 when transport is dead", async () => {
+    it("/api/mcp/send returns transport_error when transport is dead", async () => {
       mcpHttpServer = createTestServerHttp({
         serverInfo: createTestServerInfo(),
         tools: [createEchoTool()],
@@ -1387,9 +1387,11 @@ describe("Remote transport e2e", () => {
           message: { jsonrpc: "2.0", id: 99, method: "ping" },
         }),
       });
-      // Either the dead-transport short-circuit (500) or a downstream send
-      // failure (500) — either way, the path is covered.
-      expect(sendRes.status).toBeGreaterThanOrEqual(500);
+      expect(sendRes.status).toBe(200);
+      expect(await sendRes.json()).toMatchObject({
+        ok: false,
+        kind: "transport_error",
+      });
     });
 
     it("/api/log accepts non-JSON body silently via the catch fallback", async () => {