From 87fe7b27ba4201c1ca37f66716fabd5f65a3948e Mon Sep 17 00:00:00 2001 From: cliffhall Date: Mon, 24 Aug 2026 22:16:54 -0400 Subject: [PATCH] refactor(web): extract the refresh-token change handler Copilot review round 7 on #2114 (suppressed comment). AGENTS.md forbids inline handler logic; the new checkbox had it. The eight OAuth controls beside it are inline in the same shape, so consistency was an argument for leaving it. Complying anyway: this repo holds new code to its gates even where neighbors predate them, the same way the coverage floor works. Extracting the siblings would be an unrelated refactor in a bug-fix PR. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev Signed-off-by: cliffhall --- .../ServerSettingsForm/ServerSettingsForm.tsx | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx index ae18471f..63083324 100644 --- a/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx +++ b/clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx @@ -15,6 +15,7 @@ import { } from "@mantine/core"; import { ClearButton } from "../../elements/ClearButton/ClearButton"; import { JsonObjectInput } from "../../elements/JsonObjectInput/JsonObjectInput"; +import type { ChangeEvent } from "react"; import type { ProtocolEra } from "@modelcontextprotocol/client"; import type { InspectorServerSettings, @@ -560,6 +561,15 @@ export function ServerSettingsForm({ onOAuthChange({ ...currentOAuth(), authorizationParams: params }); } + function handleRequestRefreshTokenChange( + event: ChangeEvent, + ): void { + onOAuthChange({ + ...currentOAuth(), + requestRefreshToken: event.currentTarget.checked, + }); + } + function handleAddAuthorizationParam(): void { changeAuthorizationParams([...authorizationParams, { key: "", value: "" }]); } @@ -905,12 +915,7 @@ export function ServerSettingsForm({ label="Request refresh token" description={`When checked, the Inspector registers with the refresh_token grant so it can renew access tokens without a new sign-in. Unchecking it stops the SDK adding offline_access to the requested scope, and so stops the prompt=consent it forces — on Microsoft Entra ID that prompt routes a non-admin user into the admin-consent workflow (AADSTS90094) even after a tenant admin has consented. It removes only that automatic scope: an offline_access you configure in Scopes still forces the prompt. Applies on the next connect, and does not revoke a refresh token already issued or reach a registration the authorization server already holds.${refreshTokenEmaNote}`} checked={settings.oauthRequestRefreshToken ?? true} - onChange={(e) => - onOAuthChange({ - ...currentOAuth(), - requestRefreshToken: e.currentTarget.checked, - }) - } + onChange={handleRequestRefreshTokenChange} /> {refreshTokenOptedOut && scopesIncludeOfflineAccess ? (