c299b6e9d8
Migrate the web client's OAuth storage from BrowserOAuthStorage (sessionStorage) to RemoteOAuthStorage, which POSTs through the backend's /api/storage/oauth route to ~/.mcp-inspector/storage/oauth.json (mode 0600). A credential obtained in the browser is now the same blob the TUI/CLI read on the same host, giving web ⇄ TUI ⇄ CLI parity (Wave 1 of #1579). Core (shared with TUI/CLI): - OAuthStorageBase now drives a single async hydration (`ready()`, `getHydrationError()`); every post-redirect read (getClientInformation, getTokens, getCodeVerifier, getServerMetadata, getIdpSession) and every save awaits it so a late hydration merge cannot clobber a fresh write. getCodeVerifier/getServerMetadata become async; the store is created with skipHydration:true so there is no auto-hydration to race the explicit one. - store.ts adds normalizeServerUrl so a token saved under https://Example.com/mcp is found when the CLI asks for https://example.com/mcp/; getServerState falls back to the raw key. - remote-storage adapter POSTs with keepalive so the write survives the OAuth authorize redirect, surfaces swallowed persist failures, and gives richer read/write error messages. - generateOAuthState throws instead of silently degrading to Math.random. - NodeOAuthStorage honors MCP_INSPECTOR_OAUTH_STATE_PATH for isolated fixtures. Provider codeVerifier()/getServerMetadata() + the EMA idpOidc and connection-state readers await the now-async storage. Web: - environmentFactory + a new shared lib/remoteOAuthStorage accessor (memoized per {baseUrl, authToken}) wire RemoteOAuthStorage into the connection path, the EMA IdP hook, and the per-server "clear OAuth" action so all three share one in-memory view of oauth.json. Tests: async-hydration + normalizeServerUrl suite, keepalive/error-path coverage, and the sync→async migration across existing storage/provider/EMA tests. Web validate + coverage gate + integration suite green; CLI/TUI/ launcher validate green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX
50 lines
1.6 KiB
TypeScript
50 lines
1.6 KiB
TypeScript
import { describe, it, expect, vi } from "vitest";
|
|
import { clearServerOAuthState } from "./clearServerOAuthState";
|
|
|
|
describe("clearServerOAuthState", () => {
|
|
it("clears storage by server URL when not the active connection", () => {
|
|
const oauthStorage = { clear: vi.fn() };
|
|
|
|
const cleared = clearServerOAuthState({
|
|
config: { type: "streamable-http", url: "https://mcp.example.com/mcp" },
|
|
isActiveConnection: false,
|
|
oauthStorage,
|
|
});
|
|
|
|
expect(cleared).toBe(true);
|
|
expect(oauthStorage.clear).toHaveBeenCalledWith(
|
|
"https://mcp.example.com/mcp",
|
|
);
|
|
});
|
|
|
|
it("uses the live client when clearing the active connection", () => {
|
|
const inspectorClient = {
|
|
clearOAuthTokens: vi.fn(),
|
|
};
|
|
const oauthStorage = { clear: vi.fn() };
|
|
|
|
const cleared = clearServerOAuthState({
|
|
config: { type: "streamable-http", url: "https://mcp.example.com/mcp" },
|
|
inspectorClient: inspectorClient as never,
|
|
isActiveConnection: true,
|
|
oauthStorage,
|
|
});
|
|
|
|
expect(cleared).toBe(true);
|
|
expect(inspectorClient.clearOAuthTokens).toHaveBeenCalledTimes(1);
|
|
// The backend-backed store is not touched directly when a live client is
|
|
// present — the client owns resetting both persisted and in-memory state.
|
|
expect(oauthStorage.clear).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it("returns false for stdio servers", () => {
|
|
const oauthStorage = { clear: vi.fn() };
|
|
expect(
|
|
clearServerOAuthState({
|
|
config: { type: "stdio", command: "node", args: [] },
|
|
isActiveConnection: false,
|
|
oauthStorage,
|
|
}),
|
|
).toBe(false);
|
|
});
|
|
});
|