inspector/core/auth/index.ts
Cliff Hall 7784553674
fix(auth): explicit re-authorize when the OAuth callback state was lost (#1808) (#1810)
* fix(auth): offer explicit re-authorize when callback state is lost (#1808)

A `/oauth/callback` that arrives with no recorded SEP-2352 discovery state
made the SDK throw `AuthorizationServerMismatchError` and the Inspector
dead-ended, surfacing the raw SDK text with no path forward.

The SDK folds two very different failures into that one error class, so
`core/auth/issuerBinding.ts` classifies them structurally: a recoverable
"lost authorization state" (the SDK puts prose, not an issuer URL, in the
`recordedIssuer` slot) versus a genuine cross-AS `issuer_mismatch`. Only
the first gets a recovery affordance.

Web: the callback failure now raises a dedicated banner ("Authorization
state was lost" / "Authorize again") whose action clears the stale OAuth
state for that server and starts a fresh authorization. A genuine
mismatch stays a red, non-dismissible security notification with both
issuers named and no one-click retry.

Node runners (CLI/TUI): the same classification rewrites the callback
rejection into the shared actionable copy instead of the SDK text.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016S7h83UKNQ7kvSiFDNksCt

* fix(auth): detect the SDK mismatch error via isInstance (#1808)

The callback-leg classifier gated on `err.mcpBrand`, but the SDK declares
that brand in a `static {}` block, so it lives on the constructor and is
never reachable from an instance. The predicate always returned false, so
`findIssuerBindingFailure()` never matched and the #1808 recovery banner
was inert in production — the callback dead-ended exactly as before.

Use the SDK's own `AuthorizationServerMismatchError.isInstance()`, which is
cross-copy safe by construction (it consults a `Symbol.for()`-keyed brand
set), with a `name` fallback for a serialization boundary. Correct the
module doc, which cited cross-bundle safety as the reason to avoid
`instanceof` — the very thing the SDK's branded `hasInstance` provides.

Every fixture now constructs a real `AuthorizationServerMismatchError`
instead of a hand-rolled object with an own `mcpBrand`, which is why a
green `npm run ci` hid this. Adds a test pinning the brand's placement so
the feature cannot silently go inert again.

Review follow-ups: drop the unused `isLostAuthorizationStateError`, remove
the duplicated banner title default, resolve the banner title/action label
where the banner is raised, keep the clear-failure notification open, and
bound remote-supplied issuers in user-facing copy.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016S7h83UKNQ7kvSiFDNksCt

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-27 18:08:31 -04:00

119 lines
2.8 KiB
TypeScript

// Types
export type {
OAuthStep,
AuthProtocol,
OAuthClientRegistrationKind,
MessageType,
StatusMessage,
OAuthFlowState,
OAuthConnectionState,
CallbackParams,
} from "./types.js";
export {
EMPTY_OAUTH_FLOW_STATE,
authProtocolFromEnterpriseManaged,
} from "./types.js";
export {
buildOAuthConnectionState,
hasPersistedOAuthServerState,
isServerOAuthConfigured,
protocolFromOAuthConfig,
} from "./connection-state.js";
export type { BuildOAuthConnectionStateParams } from "./connection-state.js";
export { ensureCimdClientRegistration } from "./cimd.js";
export { mcpAuth, type McpAuthOptions, type McpAuthResult } from "./mcpAuth.js";
export { computeScopeUnion, isStrictScopeSuperset } from "./scopes.js";
// Storage
export type {
OAuthStorage,
IdpSessionState,
SaveClientInformationOptions,
} from "./storage.js";
export { getServerSpecificKey, OAUTH_STORAGE_KEYS } from "./storage.js";
// Providers
export type {
OAuthProviderConfig,
RedirectUrlProvider,
OAuthNavigation,
OAuthNavigationCallback,
} from "./providers.js";
export {
MutableRedirectUrlProvider,
ConsoleNavigation,
CallbackNavigation,
BaseOAuthClientProvider,
} from "./providers.js";
// Utilities
export {
parseHttpUrl,
parseOAuthCallbackParams,
generateOAuthState,
parseOAuthState,
generateOAuthErrorDescription,
formatOAuthFailureDetail,
isUnauthorizedError,
} from "./utils.js";
export type {
AuthChallenge,
AuthChallengeReason,
AuthChallengeOutcome,
HandleAuthChallengeOptions,
ParseAuthChallengeContext,
WwwAuthenticateBearerParams,
} from "./challenge.js";
export {
AuthChallengeError,
AuthRecoveryRequiredError,
parseAuthChallengeFromError,
parseAuthChallengeFromResponse,
parseScopeString,
parseWwwAuthenticateBearer,
unionAuthorizationScopes,
isAuthChallengeError,
isConnectAuthRecoveryError,
findNestedAuthError,
EMA_STEP_UP_PENDING_URL,
} from "./challenge.js";
export {
isStandardOAuthStepUp,
isEmaStepUp,
isStepUpConfirmation,
stepUpConfirmMessage,
stepUpFollowUpMessage,
stepUpModalTitle,
stepUpAuthorizeActionLabel,
emaStepUpInProgressMessage,
emaStepUpSuccessMessage,
emaStepUpFailureMessage,
stepUpAdditionalScopes,
stepUpInsufficientScopeMessage,
oauthPreRedirectToastCopy,
isReAuthBannerReason,
reAuthBannerMessage,
lostAuthorizationStateTitle,
lostAuthorizationStateMessage,
lostAuthorizationStateActionLabel,
issuerMismatchTitle,
issuerMismatchMessage,
issuerBindingFailureCopy,
type OAuthInteractiveAuthKind,
} from "./oauthUx.js";
export {
findIssuerBindingFailure,
type IssuerBindingFailure,
} from "./issuerBinding.js";
// Discovery
export { discoverScopes } from "./discovery.js";
// Logging (re-exported from core/logging)
export { silentLogger } from "../logging/index.js";