13dafe457b* refactor(web): update OAuth E2E tests to use new authentication method - Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration. - Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs. - Ensured that the tests continue to validate the expected authorization URL after the change. Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process. * Guided-auth removal, OAuth smoke testing, and TUI/CLI support * Added CLI OAuth runner flags tests * Added clarifying comment on port 0 binding * README notes on TUI oauth callback port, prettier fixes for CLI tests * CIMD validation uses inline like EMA IdP * Fixed TUI test failures from merge * test: bring 5 OAuth files over the 90 per-file coverage gate The guided-auth-removal work added/touched several files that fell below the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run the gate (it's local-only), so validate + test:integration passed while these gaps slipped through. Bring them all back over the line: - core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the provably-dead guards (empty host, out-of-range port, String(err) fallback, pathname "/" fallback) -- all rejected by new URL() upstream -- with justified v8 ignore comments instead of lowering the gate. - core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return. - core/react/useClientSettingsDraft.ts: test the functional-updater path, the stale-onChange-after-close prev===null guard, and the timer-fires-after-close value===null guard. - ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear. - clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration kinds, the expired IdP session, and the configured-scope/empty-scope branches of formatScopes. npm run coverage now passes (exit 0) across web, cli, tui, launcher. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: cliffhall <cliff@futurescale.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
62 lines
2.2 KiB
TypeScript
62 lines
2.2 KiB
TypeScript
import { discoverAuthorizationServerMetadata } from "@modelcontextprotocol/sdk/client/auth.js";
|
|
import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/sdk/shared/auth.js";
|
|
import { parseHttpUrl } from "./utils.js";
|
|
|
|
/**
|
|
* Returns the URL to use for OAuth authorization server metadata discovery.
|
|
* Uses resource metadata's authorization_servers[0] when present, otherwise the MCP server URL.
|
|
*/
|
|
export function getAuthorizationServerUrl(
|
|
serverUrl: string,
|
|
resourceMetadata?: OAuthProtectedResourceMetadata | null,
|
|
): URL {
|
|
const first = resourceMetadata?.authorization_servers?.[0];
|
|
// Empty string falls back to serverUrl
|
|
if (first) {
|
|
return parseHttpUrl(first, "protected resource authorization_servers[0]");
|
|
}
|
|
try {
|
|
return new URL("/", serverUrl);
|
|
} catch (err) {
|
|
const detail = err instanceof Error ? err.message : String(err);
|
|
throw new Error(`Invalid MCP server URL: "${serverUrl}" (${detail})`);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Discovers OAuth scopes from server metadata, with preference for resource metadata scopes
|
|
* @param serverUrl - The MCP server URL
|
|
* @param resourceMetadata - Optional resource metadata containing preferred scopes
|
|
* @param fetchFn - Optional fetch function for HTTP requests (e.g. proxy fetch in browser)
|
|
* @returns Promise resolving to space-separated scope string or undefined
|
|
*/
|
|
export const discoverScopes = async (
|
|
serverUrl: string,
|
|
resourceMetadata?: OAuthProtectedResourceMetadata,
|
|
fetchFn?: typeof fetch,
|
|
): Promise<string | undefined> => {
|
|
try {
|
|
const authServerUrl = getAuthorizationServerUrl(
|
|
serverUrl,
|
|
resourceMetadata,
|
|
);
|
|
const metadata = await discoverAuthorizationServerMetadata(authServerUrl, {
|
|
fetchFn,
|
|
});
|
|
|
|
// Prefer resource metadata scopes, but fall back to OAuth metadata if empty
|
|
const resourceScopes = resourceMetadata?.scopes_supported;
|
|
const oauthScopes = metadata?.scopes_supported;
|
|
|
|
const scopesSupported =
|
|
resourceScopes && resourceScopes.length > 0
|
|
? resourceScopes
|
|
: oauthScopes;
|
|
|
|
return scopesSupported && scopesSupported.length > 0
|
|
? scopesSupported.join(" ")
|
|
: undefined;
|
|
} catch {
|
|
return undefined;
|
|
}
|
|
};
|