* fix(auth): offer explicit re-authorize when callback state is lost (#1808) A `/oauth/callback` that arrives with no recorded SEP-2352 discovery state made the SDK throw `AuthorizationServerMismatchError` and the Inspector dead-ended, surfacing the raw SDK text with no path forward. The SDK folds two very different failures into that one error class, so `core/auth/issuerBinding.ts` classifies them structurally: a recoverable "lost authorization state" (the SDK puts prose, not an issuer URL, in the `recordedIssuer` slot) versus a genuine cross-AS `issuer_mismatch`. Only the first gets a recovery affordance. Web: the callback failure now raises a dedicated banner ("Authorization state was lost" / "Authorize again") whose action clears the stale OAuth state for that server and starts a fresh authorization. A genuine mismatch stays a red, non-dismissible security notification with both issuers named and no one-click retry. Node runners (CLI/TUI): the same classification rewrites the callback rejection into the shared actionable copy instead of the SDK text. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016S7h83UKNQ7kvSiFDNksCt * fix(auth): detect the SDK mismatch error via isInstance (#1808) The callback-leg classifier gated on `err.mcpBrand`, but the SDK declares that brand in a `static {}` block, so it lives on the constructor and is never reachable from an instance. The predicate always returned false, so `findIssuerBindingFailure()` never matched and the #1808 recovery banner was inert in production — the callback dead-ended exactly as before. Use the SDK's own `AuthorizationServerMismatchError.isInstance()`, which is cross-copy safe by construction (it consults a `Symbol.for()`-keyed brand set), with a `name` fallback for a serialization boundary. Correct the module doc, which cited cross-bundle safety as the reason to avoid `instanceof` — the very thing the SDK's branded `hasInstance` provides. Every fixture now constructs a real `AuthorizationServerMismatchError` instead of a hand-rolled object with an own `mcpBrand`, which is why a green `npm run ci` hid this. Adds a test pinning the brand's placement so the feature cannot silently go inert again. Review follow-ups: drop the unused `isLostAuthorizationStateError`, remove the duplicated banner title default, resolve the banner title/action label where the banner is raised, keep the clear-failure notification open, and bound remote-supplied issuers in user-facing copy. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016S7h83UKNQ7kvSiFDNksCt --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
119 lines
2.8 KiB
TypeScript
119 lines
2.8 KiB
TypeScript
// Types
|
|
export type {
|
|
OAuthStep,
|
|
AuthProtocol,
|
|
OAuthClientRegistrationKind,
|
|
MessageType,
|
|
StatusMessage,
|
|
OAuthFlowState,
|
|
OAuthConnectionState,
|
|
CallbackParams,
|
|
} from "./types.js";
|
|
export {
|
|
EMPTY_OAUTH_FLOW_STATE,
|
|
authProtocolFromEnterpriseManaged,
|
|
} from "./types.js";
|
|
|
|
export {
|
|
buildOAuthConnectionState,
|
|
hasPersistedOAuthServerState,
|
|
isServerOAuthConfigured,
|
|
protocolFromOAuthConfig,
|
|
} from "./connection-state.js";
|
|
export type { BuildOAuthConnectionStateParams } from "./connection-state.js";
|
|
|
|
export { ensureCimdClientRegistration } from "./cimd.js";
|
|
|
|
export { mcpAuth, type McpAuthOptions, type McpAuthResult } from "./mcpAuth.js";
|
|
export { computeScopeUnion, isStrictScopeSuperset } from "./scopes.js";
|
|
|
|
// Storage
|
|
export type {
|
|
OAuthStorage,
|
|
IdpSessionState,
|
|
SaveClientInformationOptions,
|
|
} from "./storage.js";
|
|
export { getServerSpecificKey, OAUTH_STORAGE_KEYS } from "./storage.js";
|
|
|
|
// Providers
|
|
export type {
|
|
OAuthProviderConfig,
|
|
RedirectUrlProvider,
|
|
OAuthNavigation,
|
|
OAuthNavigationCallback,
|
|
} from "./providers.js";
|
|
export {
|
|
MutableRedirectUrlProvider,
|
|
ConsoleNavigation,
|
|
CallbackNavigation,
|
|
BaseOAuthClientProvider,
|
|
} from "./providers.js";
|
|
|
|
// Utilities
|
|
export {
|
|
parseHttpUrl,
|
|
parseOAuthCallbackParams,
|
|
generateOAuthState,
|
|
parseOAuthState,
|
|
generateOAuthErrorDescription,
|
|
formatOAuthFailureDetail,
|
|
isUnauthorizedError,
|
|
} from "./utils.js";
|
|
|
|
export type {
|
|
AuthChallenge,
|
|
AuthChallengeReason,
|
|
AuthChallengeOutcome,
|
|
HandleAuthChallengeOptions,
|
|
ParseAuthChallengeContext,
|
|
WwwAuthenticateBearerParams,
|
|
} from "./challenge.js";
|
|
export {
|
|
AuthChallengeError,
|
|
AuthRecoveryRequiredError,
|
|
parseAuthChallengeFromError,
|
|
parseAuthChallengeFromResponse,
|
|
parseScopeString,
|
|
parseWwwAuthenticateBearer,
|
|
unionAuthorizationScopes,
|
|
isAuthChallengeError,
|
|
isConnectAuthRecoveryError,
|
|
findNestedAuthError,
|
|
EMA_STEP_UP_PENDING_URL,
|
|
} from "./challenge.js";
|
|
|
|
export {
|
|
isStandardOAuthStepUp,
|
|
isEmaStepUp,
|
|
isStepUpConfirmation,
|
|
stepUpConfirmMessage,
|
|
stepUpFollowUpMessage,
|
|
stepUpModalTitle,
|
|
stepUpAuthorizeActionLabel,
|
|
emaStepUpInProgressMessage,
|
|
emaStepUpSuccessMessage,
|
|
emaStepUpFailureMessage,
|
|
stepUpAdditionalScopes,
|
|
stepUpInsufficientScopeMessage,
|
|
oauthPreRedirectToastCopy,
|
|
isReAuthBannerReason,
|
|
reAuthBannerMessage,
|
|
lostAuthorizationStateTitle,
|
|
lostAuthorizationStateMessage,
|
|
lostAuthorizationStateActionLabel,
|
|
issuerMismatchTitle,
|
|
issuerMismatchMessage,
|
|
issuerBindingFailureCopy,
|
|
type OAuthInteractiveAuthKind,
|
|
} from "./oauthUx.js";
|
|
|
|
export {
|
|
findIssuerBindingFailure,
|
|
type IssuerBindingFailure,
|
|
} from "./issuerBinding.js";
|
|
|
|
// Discovery
|
|
export { discoverScopes } from "./discovery.js";
|
|
|
|
// Logging (re-exported from core/logging)
|
|
export { silentLogger } from "../logging/index.js";
|