inspector/core/auth
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall 234d0a9ac4 fix: preserve Response enumerability, refresh transport docs (#2319 round 12)
Copying url/redirected/type onto the rebuilt response as enumerable own
properties changed what a consumer sees: `Object.keys`, object spread
and `JSON.stringify` are all affected. Which answer is correct turns
out to be the host's business — under the Fetch standard these are
prototype getters with no own enumerable key, while happy-dom defines
them as own enumerable data properties — so the descriptor is copied
from the freshly built Response rather than either answer being
hardcoded. The test compares against a baseline built in the same
runtime for the same reason.

Three comments still described the transport fetch as unbounded, which
round 11 changed:

- the wrapper's own docblock said it must never wrap the transport,
  obscuring that isExempt is what makes doing so safe;
- the auth-chain comment in inspectorClient repeated it;
- buildEffectiveAuthFetch's docblock said transport-internal discovery
  is not covered by a deadline.

All three now state the real distinction — both chains are bounded, and
they differ only in that the transport chain exempts the MCP endpoint —
and the docblock says why reusing the transport chain here would be
wrong rather than merely different.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-11 05:07:31 -04:00
..
browser Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage. 2026-07-04 21:56:45 -07:00
ema fix: delegate issuer context and discovery state through the EMA wrapper 2026-09-07 02:38:13 -04:00
node fix(auth): make the stuck-lock guidance conditional, not an instruction (#2082) 2026-08-23 12:49:06 -04:00
remote Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage. 2026-07-04 21:56:45 -07:00
authorizationParams.ts feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
challenge.ts fix(auth): pass the challenge's resource_metadata URL to SDK auth() 2026-08-24 19:48:40 -04:00
cimd.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
connection-state.ts fix(auth): require JWT shape before trusting exp as proof of validity 2026-08-24 07:46:10 -04:00
discovery.ts fix(oauth): walk the candidates in the CLI refresh path too 2026-08-26 00:34:27 -04:00
endpointOverrides.ts perf(auth): gate the override wrapper on the discovery request, and guard disk values 2026-08-16 22:11:16 -04:00
index.ts feat: bound SDK-internal OAuth on the transport chain too (#2319 round 11) 2026-09-11 04:49:05 -04:00
insecureTokenEndpoint.ts fix: the classifier does not survive structuredClone, and the test now proves it 2026-09-07 11:16:51 -04:00
issuerBinding.ts fix(auth): explicit re-authorize when the OAuth callback state was lost (#1808) (#1810) 2026-07-27 18:08:31 -04:00
mcpAuth.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
oauth-persist.ts fix(auth): keep oauth-persist browser-safe (move Node file backend out) 2026-07-08 16:20:31 -04:00
oauth-storage.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
oauthUx.ts fix: usable IPv6 spelling, and drop a SEP label that means something else here (round 2) 2026-09-07 09:54:17 -04:00
oidcDiscoveryCompat.ts fix: enforce the OAuth deadline across the proxy hop (#2319 round 5) 2026-09-11 03:23:26 -04:00
providers.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
requestTimeout.ts fix: preserve Response enumerability, refresh transport docs (#2319 round 12) 2026-09-11 05:07:31 -04:00
revocation.ts fix: cancel the discarded proxy stream, refresh revocation docs (#2319 round 8) 2026-09-11 04:00:44 -04:00
scopes.ts fix(oauth): filter the step-up scope union too, not just the provider 2026-08-24 23:05:14 -04:00
secret-fields.ts feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512) 2026-06-24 22:15:12 -04:00
secret-storage-info.ts fix(auth): stop a config-only PUT deleting stored secrets (#2084) 2026-08-22 23:30:17 -04:00
storage.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
store.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
types.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
utils.ts chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory (#1900) 2026-08-01 20:13:30 -04:00