13dafe457b* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
1.1 KiB
TypeScript
25 lines
1.1 KiB
TypeScript
/**
|
|
* Shared constants and predicates for the browser-side OAuth authorization-code
|
|
* flow wired into `App.tsx`. Extracted here so the pure logic is unit-testable
|
|
* independently of the React component that orchestrates it.
|
|
*/
|
|
|
|
export { isUnauthorizedError } from "@inspector/core/auth/utils.js";
|
|
|
|
/**
|
|
* The pathname the auth server redirects back to after the user authorizes.
|
|
* `App.tsx`'s `redirectUrlProvider` points OAuth flows at
|
|
* `${origin}${OAUTH_CALLBACK_PATH}`; the mount effect detects this pathname and
|
|
* finishes the token exchange.
|
|
*/
|
|
export const OAUTH_CALLBACK_PATH = "/oauth/callback";
|
|
|
|
/**
|
|
* sessionStorage key holding the id of the server whose OAuth flow is in
|
|
* flight. The OAuth `state` parameter carries the auth session id; the full
|
|
* configured server initiated the flow, and the full-page redirect to the auth
|
|
* server wipes all in-memory React state. The id is stashed here right before
|
|
* redirecting so the post-callback page load can rebuild the right
|
|
* `InspectorClient` and resume the connection.
|
|
*/
|
|
export const OAUTH_PENDING_SERVER_KEY = "mcp-inspector:oauth-pending-server-id";
|