c299b6e9d8
Migrate the web client's OAuth storage from BrowserOAuthStorage (sessionStorage) to RemoteOAuthStorage, which POSTs through the backend's /api/storage/oauth route to ~/.mcp-inspector/storage/oauth.json (mode 0600). A credential obtained in the browser is now the same blob the TUI/CLI read on the same host, giving web ⇄ TUI ⇄ CLI parity (Wave 1 of #1579). Core (shared with TUI/CLI): - OAuthStorageBase now drives a single async hydration (`ready()`, `getHydrationError()`); every post-redirect read (getClientInformation, getTokens, getCodeVerifier, getServerMetadata, getIdpSession) and every save awaits it so a late hydration merge cannot clobber a fresh write. getCodeVerifier/getServerMetadata become async; the store is created with skipHydration:true so there is no auto-hydration to race the explicit one. - store.ts adds normalizeServerUrl so a token saved under https://Example.com/mcp is found when the CLI asks for https://example.com/mcp/; getServerState falls back to the raw key. - remote-storage adapter POSTs with keepalive so the write survives the OAuth authorize redirect, surfaces swallowed persist failures, and gives richer read/write error messages. - generateOAuthState throws instead of silently degrading to Math.random. - NodeOAuthStorage honors MCP_INSPECTOR_OAUTH_STATE_PATH for isolated fixtures. Provider codeVerifier()/getServerMetadata() + the EMA idpOidc and connection-state readers await the now-async storage. Web: - environmentFactory + a new shared lib/remoteOAuthStorage accessor (memoized per {baseUrl, authToken}) wire RemoteOAuthStorage into the connection path, the EMA IdP hook, and the per-server "clear OAuth" action so all three share one in-memory view of oauth.json. Tests: async-hydration + normalizeServerUrl suite, keepalive/error-path coverage, and the sync→async migration across existing storage/provider/EMA tests. Web validate + coverage gate + integration suite green; CLI/TUI/ launcher validate green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX
69 lines
2.3 KiB
TypeScript
69 lines
2.3 KiB
TypeScript
import { OAuthStorageBase } from "../oauth-storage.js";
|
|
import { createOAuthStore } from "../store.js";
|
|
import { createFileStorageAdapter } from "../../storage/adapters/file-storage.js";
|
|
import {
|
|
getDefaultStorageDir,
|
|
getStoreFilePath,
|
|
} from "../../storage/store-io.js";
|
|
|
|
/** Default path: ~/.mcp-inspector/storage/oauth.json */
|
|
const DEFAULT_STATE_PATH = getStoreFilePath(getDefaultStorageDir(), "oauth");
|
|
|
|
/**
|
|
* Get path to OAuth state file. Resolution order: explicit `customPath`, then
|
|
* the `MCP_INSPECTOR_OAUTH_STATE_PATH` environment variable (so tests and
|
|
* scripted runs can point at an isolated fixture without touching
|
|
* `~/.mcp-inspector`), then the default `~/.mcp-inspector/storage/oauth.json`.
|
|
*/
|
|
export function getStateFilePath(customPath?: string): string {
|
|
return (
|
|
customPath ??
|
|
process.env.MCP_INSPECTOR_OAUTH_STATE_PATH ??
|
|
DEFAULT_STATE_PATH
|
|
);
|
|
}
|
|
|
|
const storeCache = new Map<string, ReturnType<typeof createOAuthStore>>();
|
|
|
|
/**
|
|
* Get or create the OAuth store instance for the given path.
|
|
* @param stateFilePath - Optional custom path to state file. Default: ~/.mcp-inspector/storage/oauth.json
|
|
*/
|
|
export function getOAuthStore(stateFilePath?: string) {
|
|
const key = getStateFilePath(stateFilePath);
|
|
let store = storeCache.get(key);
|
|
if (!store) {
|
|
const filePath = getStateFilePath(stateFilePath);
|
|
const storage = createFileStorageAdapter({ filePath });
|
|
store = createOAuthStore(storage);
|
|
storeCache.set(key, store);
|
|
}
|
|
return store;
|
|
}
|
|
|
|
/**
|
|
* Clear all OAuth client state (all servers) in the default store.
|
|
* Useful for test isolation in E2E OAuth tests.
|
|
* Use a custom-path store and clear per serverUrl if you need to clear non-default storage.
|
|
*/
|
|
export function clearAllOAuthClientState(): void {
|
|
const store = getOAuthStore();
|
|
const state = store.getState();
|
|
const urls = Object.keys(state.servers ?? {});
|
|
for (const url of urls) {
|
|
state.clearServerState(url);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Node.js storage implementation using Zustand with file-based persistence.
|
|
* For InspectorClient, CLI, and TUI.
|
|
*/
|
|
export class NodeOAuthStorage extends OAuthStorageBase {
|
|
/**
|
|
* @param storagePath - Optional path to state file. Default: ~/.mcp-inspector/oauth/state.json
|
|
*/
|
|
constructor(storagePath?: string) {
|
|
super(getOAuthStore(storagePath));
|
|
}
|
|
}
|