modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

test(oauth): prove the opt-out against a real authorization server

Browse source 
Copilot review round 3 on #2114.

The unit tests asserted our own `grant_types` array and stopped there.
What actually unblocks an Entra tenant is what the SDK puts in the
authorize URL, and nothing covered that — so an SDK change that stopped
keying its augmentation off `grant_types` would leave AADSTS90094
intact with every test green.

Adds the complementary case to the existing e2e suite, against a real
AS advertising `offline_access`: with the grant declined, the authorize
URL carries neither `offline_access` nor `prompt=consent`, while the
configured scope still goes out. Verified non-vacuous by reverting the
provider conditional — it fails. The positive test alongside it now
also asserts `prompt=consent` is present, which was unasserted despite
being the literal failure in the issue.

Drops an unjustified `as unknown as ServerEntry` I added in the App
test — AGENTS.md forbids it, and it hid a real mismatch (a partial
settings object against a complete one). Typed `ServerEntry` /
`InspectorServerSettings` fixtures instead, so a field added to that
interface later is a compile error rather than a missing value at
runtime. The `constructedOAuth` helper reads through the constructor's
own parameter type and needs no cast at all now.

Scopes the two doc comments that still claimed the flag removes every
`offline_access` — `StoredMCPServer.oauth` and `OAuthProviderConfig`,
both contradicting the caveat already stated elsewhere.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>
This commit is contained in:
cliffhall 2026-08-24 21:03:41 -04:00
commit 6303f8a6ce
1 changed files with 125 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/mcp/types.ts
View file

@ -184,9 +184,12 @@ export type StoredMCPServer = MCPServerConfig & {
* Whether the Inspector declares the `refresh_token` grant when it
* registers. Defaults to `true`; only `false` is written to disk, so an
* entry that never touched the setting keeps a minimal diff. Turning it off
* also stops the SDK adding `offline_access` to the requested scope and
* `prompt=consent` to the authorization request. Inspector-specific.
* (#2068)
* stops the SDK's *automatic* `offline_access` augmentation, and so the
* `prompt=consent` that scope forces — but only that one: an
* `offline_access` from `scopes` here, or from the resource's advertised
* scopes when `scopes` is unset, still reaches the authorization request.
* See {@link InspectorServerSettings.oauthRequestRefreshToken}.
* Inspector-specific. (#2068)
*/
requestRefreshToken?: boolean;
/**