inspector/core/auth
Repository files (latest commit first)
Filename Latest commit message Latest commit date
cliffhall 93965936ba docs: describe the shipped timeout architecture (#2319 round 14)
Three comments still said transport-internal discovery has no
client-side wrapper, or that the wrapper must never be applied to the
transport fetch. Round 11 made both false, and the second actively
tells a caller to do the opposite of what InspectorClient does — while
hiding that isExempt is the safety-critical part.

- createRemoteFetch's marker comment now gives the real reason the
  reconstruction matters: both ends run the same budget, so this path
  is the backend winning the race, most plausibly a backgrounded tab
  throttling setTimeout while the server's fires on schedule. Which
  deadline fired must not decide whether the error names its endpoint.
- The body-buffering comment now says buffering is the second reason
  isExempt is not optional on a mixed chain, since an exempt request
  skips it and an SSE body stays open rather than being drained.
- The matching test comment is reframed as testing the proxy boundary
  independently of which deadline wins.

The PR description is rewritten around what is actually shipped: both
chains bounded and differing only in the exemption, the per-request
envelope that replaced the fetchTimeoutMs option, and the three
mutation-verified tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YFnM6RqB4nXqNysgUYmjmq
Signed-off-by: cliffhall <cliff@futurescale.com>
2026-09-11 05:42:00 -04:00
..
browser Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage. 2026-07-04 21:56:45 -07:00
ema fix: delegate issuer context and discovery state through the EMA wrapper 2026-09-07 02:38:13 -04:00
node fix(auth): make the stuck-lock guidance conditional, not an instruction (#2082) 2026-08-23 12:49:06 -04:00
remote Removed Zustand storage, cleanup up auth storage IO interfaces, implementations, and usage. 2026-07-04 21:56:45 -07:00
authorizationParams.ts feat: per-server custom OAuth authorization-request parameters (#2018) 2026-08-15 19:31:41 -04:00
challenge.ts fix(auth): pass the challenge's resource_metadata URL to SDK auth() 2026-08-24 19:48:40 -04:00
cimd.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
connection-state.ts fix(auth): require JWT shape before trusting exp as proof of validity 2026-08-24 07:46:10 -04:00
discovery.ts fix(oauth): walk the candidates in the CLI refresh path too 2026-08-26 00:34:27 -04:00
endpointOverrides.ts perf(auth): gate the override wrapper on the discovery request, and guard disk values 2026-08-16 22:11:16 -04:00
index.ts fix: make the proxy deadline per-request, not unconditional (#2319 round 13) 2026-09-11 05:24:24 -04:00
insecureTokenEndpoint.ts fix: the classifier does not survive structuredClone, and the test now proves it 2026-09-07 11:16:51 -04:00
issuerBinding.ts fix(auth): explicit re-authorize when the OAuth callback state was lost (#1808) (#1810) 2026-07-27 18:08:31 -04:00
mcpAuth.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
oauth-persist.ts fix(auth): keep oauth-persist browser-safe (move Node file backend out) 2026-07-08 16:20:31 -04:00
oauth-storage.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
oauthUx.ts fix: usable IPv6 spelling, and drop a SEP label that means something else here (round 2) 2026-09-07 09:54:17 -04:00
oidcDiscoveryCompat.ts fix: enforce the OAuth deadline across the proxy hop (#2319 round 5) 2026-09-11 03:23:26 -04:00
providers.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
requestTimeout.ts docs: describe the shipped timeout architecture (#2319 round 14) 2026-09-11 05:42:00 -04:00
revocation.ts fix: cancel the discarded proxy stream, refresh revocation docs (#2319 round 8) 2026-09-11 04:00:44 -04:00
scopes.ts fix(oauth): filter the step-up scope union too, not just the provider 2026-08-24 23:05:14 -04:00
secret-fields.ts feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512) 2026-06-24 22:15:12 -04:00
secret-storage-info.ts fix(auth): stop a config-only PUT deleting stored secrets (#2084) 2026-08-22 23:30:17 -04:00
storage.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
store.ts fix: read the SDK's own discovery state instead of a marker of our own 2026-09-07 02:03:12 -04:00
types.ts OAuth: re-key store to (server, issuer) + SEP-837/2350/2352 auth UX (#1694) 2026-07-16 16:52:53 -04:00
utils.ts chore(deps): migrate to eslint 10 to clear the brace-expansion DoS advisory (#1900) 2026-08-01 20:13:30 -04:00