From 78d6583160e5c05ee01cd56b65a3fd0bf9d6c6cf Mon Sep 17 00:00:00 2001
From: Glen Maddern <glen@cloudflare.com>
Date: Tue, 6 May 2025 14:37:52 +1000
Subject: [PATCH] wip

---
 package.json         | 4 +---
 pnpm-lock.yaml       | 3 +--
 src/auth/callback.ts | 8 ++++----
 3 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/package.json b/package.json
index 0ae5423..e4e6a8d 100644
--- a/package.json
+++ b/package.json
@@ -24,10 +24,8 @@
     "build": "tsup",
     "check": "prettier --check . && tsc"
   },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.11.0"
-  },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.11.0",
     "@types/react": "^19.0.12",
     "prettier": "^3.5.3",
     "react": "^19.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f11d45d..35649c8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,11 +7,10 @@ settings:
 importers:
 
   .:
-    dependencies:
+    devDependencies:
       '@modelcontextprotocol/sdk':
         specifier: ^1.11.0
         version: 1.11.0
-    devDependencies:
       '@types/react':
         specifier: ^19.0.12
         version: 19.0.12
diff --git a/src/auth/callback.ts b/src/auth/callback.ts
index 8ffa702..54fe737 100644
--- a/src/auth/callback.ts
+++ b/src/auth/callback.ts
@@ -46,8 +46,6 @@ export async function onMcpAuthorization(
     // Retrieve the stored state using the state parameter from the query
     const stateKey = `${storageKeyPrefix}:state_${state}`;
     const storedStateJSON = localStorage.getItem(stateKey);
-    // Remove the state key immediately after retrieval (it's single-use)
-    localStorage.removeItem(stateKey);
 
     if (!storedStateJSON) {
       throw new Error(`Invalid or expired state parameter "${state}". No matching state found in storage.`);
@@ -76,8 +74,6 @@ export async function onMcpAuthorization(
 
     const clientInfoStr = localStorage.getItem(clientInfoKey);
     const codeVerifier = localStorage.getItem(codeVerifierKey);
-    // Remove the code verifier after retrieving it
-    localStorage.removeItem(codeVerifierKey);
 
     if (!clientInfoStr) {
       throw new Error(`Client information not found in storage (key: ${clientInfoKey}).`);
@@ -114,6 +110,10 @@ export async function onMcpAuthorization(
 
     // Clean up the persisted manual auth URL if it exists
     localStorage.removeItem(authUrlKey);
+    // Remove the state key immediately after retrieval (it's single-use)
+    localStorage.removeItem(stateKey);
+    // Remove the code verifier after retrieving it
+    localStorage.removeItem(codeVerifierKey);
 
     console.log(`${logPrefix} Tokens saved. Notifying opener window.`);