modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

refactor(core): apply v1.5-port cleanups deferred from #1306 (#1316)

Browse source 
* refactor(core): apply v1.5-port cleanups deferred from #1306

Addresses issue #1309 — five small, mechanical cleanups deferred from the
v1.5 runtime port:

1. Collapse BrowserOAuthStorage / NodeOAuthStorage / RemoteOAuthStorage
   onto a shared OAuthStorageBase. Three ~130-line duplicates become
   thin adapter wrappers; behavior + public API unchanged.
2. Re-enable erasableSyntaxOnly in tsconfig.app.json by rewriting the
   seven (plus two the issue missed in sampling/elicitation create-
   message) parameter-property constructors as explicit field + assign.
3. Route the lone console.error in inspectorClient.ts through this.logger.
4. Replace `${Date.now()}-${Math.random()}` with crypto.randomUUID() at
   the five local-only ID sites (message tracking + sampling/elicit).
5. Pin the remote-server hono app generic at new Hono<Env>() and drop
   the streamSSE cast. Root cause of the cast was an unresolved hono
   subpath: the tsconfig "hono/*" wildcard didn't honor the exports
   map, so hono/streaming leaked to the root-hoisted hono@4.12.12 while
   hono itself resolved to clients/web/hono@4.12.18. Replaced the
   wildcard with an explicit hono/streaming entry in both tsconfig.app
   and tsconfig.test, removing the package-identity mismatch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(core): address #1316 PR review feedback

- Drop the stranded no-op getServerState() read at the top of
  clearClientInformation in OAuthStorageBase (carried over verbatim
  from the three originals).
- Drop the crypto.randomUUID() guard at the task-ID site so all
  six in-scope sites are consistent; the fallback branch was dead
  code on every supported runtime.
- Remove the residual `c as Context` cast at the streamSSE call site
  in core/mcp/remote/node/server.ts — once both hono imports
  resolve to the same package the route-typed Context flows through
  to streamSSE with no cast at all.
- Move the new `options` / `config` field declarations in
  RemoteClientTransport up with the rest of the field block, matching
  the layout used by the other five rewritten classes in this PR.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-05-17 19:15:48 -04:00 • committed by GitHub
commit 82269e78cb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 236 additions and 449 deletions
Download patch file Download diff file Expand all files Collapse all files

153
core/auth/remote/storage-remote.ts
View file

@ -4,17 +4,8 @@
* For web clients that need to share state with Node apps.
*/
import type { OAuthStorage } from "../storage.js";
import type {
OAuthClientInformation,
OAuthTokens,
OAuthMetadata,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import {
OAuthClientInformationSchema,
OAuthTokensSchema,
} from "@modelcontextprotocol/sdk/shared/auth.js";
import { createOAuthStore, type ServerOAuthState } from "../store.js";
import { OAuthStorageBase } from "../oauth-storage.js";
import { createOAuthStore } from "../store.js";
import { createRemoteStorageAdapter } from "../../storage/adapters/remote-storage.js";
export interface RemoteOAuthStorageOptions {
@ -33,135 +24,17 @@ export interface RemoteOAuthStorageOptions {
* Stores OAuth state via HTTP API (GET/POST/DELETE /api/storage/:storeId).
* For web clients that need to share state with Node apps (TUI, CLI).
*/
export class RemoteOAuthStorage implements OAuthStorage {
private store: ReturnType<typeof createOAuthStore>;
export class RemoteOAuthStorage extends OAuthStorageBase {
constructor(options: RemoteOAuthStorageOptions) {
const storage = createRemoteStorageAdapter({
baseUrl: options.baseUrl,
storeId: options.storeId ?? "oauth",
authToken: options.authToken,
fetchFn: options.fetchFn,
});
this.store = createOAuthStore(storage);
}
async getClientInformation(
serverUrl: string,
isPreregistered?: boolean,
): Promise<OAuthClientInformation | undefined> {
const state = this.store.getState().getServerState(serverUrl);
const clientInfo = isPreregistered
? state.preregisteredClientInformation
: state.clientInformation;
if (!clientInfo) {
return undefined;
}
return await OAuthClientInformationSchema.parseAsync(clientInfo);
}
async saveClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
clientInformation,
});
}
async savePreregisteredClientInformation(
serverUrl: string,
clientInformation: OAuthClientInformation,
): Promise<void> {
this.store.getState().setServerState(serverUrl, {
preregisteredClientInformation: clientInformation,
});
}
clearClientInformation(serverUrl: string, isPreregistered?: boolean): void {
this.store.getState().getServerState(serverUrl);
const updates: Partial<ServerOAuthState> = {};
if (isPreregistered) {
updates.preregisteredClientInformation = undefined;
} else {
updates.clientInformation = undefined;
}
this.store.getState().setServerState(serverUrl, updates);
}
async getTokens(serverUrl: string): Promise<OAuthTokens | undefined> {
const state = this.store.getState().getServerState(serverUrl);
if (!state.tokens) {
return undefined;
}
return await OAuthTokensSchema.parseAsync(state.tokens);
}
async saveTokens(serverUrl: string, tokens: OAuthTokens): Promise<void> {
this.store.getState().setServerState(serverUrl, { tokens });
}
clearTokens(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { tokens: undefined });
}
getCodeVerifier(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.codeVerifier;
}
async saveCodeVerifier(
serverUrl: string,
codeVerifier: string,
): Promise<void> {
this.store.getState().setServerState(serverUrl, { codeVerifier });
}
clearCodeVerifier(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { codeVerifier: undefined });
}
getScope(serverUrl: string): string | undefined {
const state = this.store.getState().getServerState(serverUrl);
return state.scope;
}
async saveScope(serverUrl: string, scope: string | undefined): Promise<void> {
this.store.getState().setServerState(serverUrl, { scope });
}
clearScope(serverUrl: string): void {
this.store.getState().setServerState(serverUrl, { scope: undefined });
}
getServerMetadata(serverUrl: string): OAuthMetadata | null {
const state = this.store.getState().getServerState(serverUrl);
return state.serverMetadata || null;
}
async saveServerMetadata(
serverUrl: string,
metadata: OAuthMetadata,
): Promise<void> {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: metadata });
}
clearServerMetadata(serverUrl: string): void {
this.store
.getState()
.setServerState(serverUrl, { serverMetadata: undefined });
}
clear(serverUrl: string): void {
this.store.getState().clearServerState(serverUrl);
super(
createOAuthStore(
createRemoteStorageAdapter({
baseUrl: options.baseUrl,
storeId: options.storeId ?? "oauth",
authToken: options.authToken,
fetchFn: options.fetchFn,
}),
),
);
}
}