Closes #1950 Before this, a box with no reachable OS keychain — the published container (no D-Bus session, #1848), Android/Termux (no platform binary, #1905), a minimal Linux install without libsecret — could not persist an OAuth client secret or a stdio `env:` value at all. `KeyringSecretStore` degraded into a store that silently holds nothing: `get` returned null, `delete` no-opped, and `set` hard-failed with a 503. That is the correct failure behavior, but it left the documented, supported way to run the Inspector with no secret persistence whatsoever. Adds the two missing implementations and, more importantly, the policy that picks one and the surfaces that say which was picked. - `FileSecretStore` — one `0600` JSON document at `~/.mcp-inspector/secrets.json`, encrypted with AES-256-GCM whenever `MCP_INSPECTOR_SECRET_KEY` is set (scrypt, per-file random salt). The whole map is encrypted as a unit rather than value-by-value so the account names — `${serverId}:${field}` — are hidden too; a per-value scheme would leave a readable index of which servers you hold a client secret for. A file that can no longer be decrypted reads as empty (matching the interface's read tolerance) but *refuses to be written*, because replacing a file of still-valid secrets to satisfy an additive request destroys data. - `secret-store-selection.ts` — the policy. `MCP_INSPECTOR_SECRET_STORE=keyring|file|memory` wins outright; otherwise probe the keychain and, if unreachable, fall back loudly. The fallback is `memory` in a container whose secrets directory is not on a mount, and `file` otherwise — so mounting the volume the README already recommends for the catalog flips the same run to durable storage with no configuration, and an unmounted container gets the honest answer rather than a file `--rm` will discard. Cached per process so the banner, `/api/config`, and the store doing the writing cannot disagree. - Automatic, but never silent. The downgrade prints at startup, rides `GET /api/config`, and is named in a permanent 32px footer at the bottom of both dialogs that accept a secret. A startup banner is seen once by whoever started the process; a toast is seen once; a dismissible banner is the thing a user dismisses before doing the work it describes. The plaintext and memory cases render their caveat inline in a warning tone — a warning you must hover to discover is not one. - `SecretStoreUnavailableError` is now the base every store's `set` throws, so the routes translate one condition into a 503 instead of matching `KeychainUnavailableError` by name. Docs: the container section of the root README gains a table of which store you get and how to make secrets survive, plus the `MCP_INSPECTOR_SECRET_KEY` upgrade/mismatch rules. Tests: the existing interface contract block is extracted to `secretStoreContract.ts` and run against all three implementations, so none can drift on the availability contract. `FileSecretStore` is tested against a real temp filesystem — mode, cross-instance round-trip, that the ciphertext does not contain the plaintext, the read-modify-write race, and every refusal path. Full `npm run ci` passes, per-file gate included. Signed-off-by: cliffhall <cliff@futurescale.com>
126 lines
4.3 KiB
TypeScript
126 lines
4.3 KiB
TypeScript
import { useState } from "react";
|
|
import { CloseButton, Group, Modal, ScrollArea } from "@mantine/core";
|
|
import { ListToggle } from "../../elements/ListToggle/ListToggle";
|
|
import { SecretStorageFooter } from "../../elements/SecretStorageFooter/SecretStorageFooter";
|
|
import type { SecretStorageInfo } from "@inspector/core/auth/secret-storage-info.js";
|
|
import {
|
|
ClientSettingsForm,
|
|
type ClientSettingsSection,
|
|
} from "../ClientSettingsForm/ClientSettingsForm";
|
|
import type { EmaIdpLoginState } from "@inspector/core/auth/ema/idpSession.js";
|
|
import {
|
|
validateClientSettings,
|
|
type ClientSettingsFormValues,
|
|
} from "../ClientSettingsForm/clientSettingsValues.js";
|
|
|
|
const ALL_SECTIONS: ClientSettingsSection[] = ["ema", "cimd"];
|
|
|
|
const AppModalLg = Modal.Root.withProps({
|
|
size: "lg",
|
|
centered: true,
|
|
scrollAreaComponent: ScrollArea.Autosize,
|
|
});
|
|
|
|
const ModalHeaderRow = Group.withProps({
|
|
justify: "space-between",
|
|
wrap: "nowrap",
|
|
w: "100%",
|
|
});
|
|
|
|
const CenteredModalTitle = Modal.Title.withProps({
|
|
ta: "center",
|
|
flex: 1,
|
|
});
|
|
|
|
export interface ClientSettingsModalProps {
|
|
opened: boolean;
|
|
settings: ClientSettingsFormValues;
|
|
onClose: () => void;
|
|
onSettingsChange: (
|
|
settings:
|
|
| ClientSettingsFormValues
|
|
| ((prev: ClientSettingsFormValues) => ClientSettingsFormValues),
|
|
) => void;
|
|
emaIdpLoginState?: EmaIdpLoginState;
|
|
onEmaIdpLogout?: () => void;
|
|
/**
|
|
* Where secrets typed here end up (#1950). This dialog holds the
|
|
* enterprise IdP client secret, so the footer is not decoration — it is
|
|
* the answer to the question the field raises. Absent on a backend that
|
|
* doesn't report a store; the footer then renders nothing.
|
|
*/
|
|
secretStorage?: SecretStorageInfo;
|
|
}
|
|
|
|
export function ClientSettingsModal({
|
|
opened,
|
|
settings,
|
|
onClose,
|
|
onSettingsChange,
|
|
emaIdpLoginState,
|
|
onEmaIdpLogout,
|
|
secretStorage,
|
|
}: ClientSettingsModalProps) {
|
|
const [expandedSections, setExpandedSections] = useState<
|
|
ClientSettingsSection[]
|
|
>(["ema"]);
|
|
const [revealErrors, setRevealErrors] = useState(false);
|
|
|
|
const allExpanded = expandedSections.length === ALL_SECTIONS.length;
|
|
|
|
function handleToggleAll() {
|
|
setExpandedSections(allExpanded ? [] : ALL_SECTIONS);
|
|
}
|
|
|
|
// modal — the parent flushes the debounced persist on close. A client config
|
|
// that's incomplete (blank required field) or invalid (bad issuer / CIMD URL)
|
|
// would be silently dropped by the persist gate, so instead of closing we
|
|
// reveal the field errors (overriding the form's on-blur gating) and keep the
|
|
// modal open. The user fixes the fields, or disables the feature, then closes.
|
|
// Resets via the parent's open/close remount key.
|
|
function handleClose() {
|
|
const errors = validateClientSettings(settings, { requireComplete: true });
|
|
if (Object.keys(errors).length > 0) {
|
|
setRevealErrors(true);
|
|
return;
|
|
}
|
|
onClose();
|
|
}
|
|
|
|
return (
|
|
// Compound Modal so the header lives in `Modal.Header` (sticky by design)
|
|
// while `scrollAreaComponent` confines overflow to `Modal.Body` (#1698 —
|
|
// kept consistent with ServerSettingsModal for when this grows enough to
|
|
// scroll). The fade-down transition `<Modal>` defaults to (but `Modal.Root`
|
|
// doesn't inherit) is supplied app-wide by `ThemeModalRoot`.
|
|
<AppModalLg opened={opened} onClose={handleClose}>
|
|
<Modal.Overlay />
|
|
<Modal.Content>
|
|
<Modal.Header>
|
|
<ModalHeaderRow>
|
|
<ListToggle
|
|
compact={!allExpanded}
|
|
variant="subtle"
|
|
onToggle={handleToggleAll}
|
|
/>
|
|
{/* `Modal.Title` names the dialog (wires `aria-labelledby`). */}
|
|
<CenteredModalTitle>Client Settings</CenteredModalTitle>
|
|
<CloseButton aria-label="Close" onClick={handleClose} />
|
|
</ModalHeaderRow>
|
|
</Modal.Header>
|
|
<Modal.Body>
|
|
<ClientSettingsForm
|
|
settings={settings}
|
|
expandedSections={expandedSections}
|
|
onExpandedSectionsChange={setExpandedSections}
|
|
onSettingsChange={onSettingsChange}
|
|
emaIdpLoginState={emaIdpLoginState}
|
|
onEmaIdpLogout={onEmaIdpLogout}
|
|
revealErrors={revealErrors}
|
|
/>
|
|
</Modal.Body>
|
|
<SecretStorageFooter info={secretStorage} />
|
|
</Modal.Content>
|
|
</AppModalLg>
|
|
);
|
|
}
|