@aexol/spectral 0.9.254 → 0.9.255

package/dist/server/handlers/mcp-auth.js

@@ -2,46 +2,19 @@
  * Handler for `POST /api/mcp-auth`.
  *
  * Starts the OAuth flow for a locally configured MCP server managed by
- * `spectral serve`. Runs headless: `startAuth` captures the authorization
- * URL through the provider's `onRedirect` hook (no browser is opened
- * here — the caller renders `authUrl`), and the flow is completed in the
- * background once the local callback server receives the code.
+ * `spectral serve`. Delegates to the shared non-blocking helper
+ * (`startMcpAuthFlow`) used by the agent `mcp` tool: `startAuth` captures
+ * the authorization URL through the provider's `onRedirect` hook, and the
+ * flow is completed in the background once the local callback server
+ * receives the code. `openBrowser: true` in the body launches the system
+ * browser (default: headless — the caller renders `authUrl`).
  *
  * Pure handler pattern — no framework, no side effects on the wire. The
  * caller (the relay dispatcher) injects `McpExtensionState`; validation
  * failures throw `BadRequestError` which `relay/rest.ts` maps to 400.
  */
-import { waitForCallback } from "../../mcp/mcp-callback-server.js";
-import { completeAuth, startAuth, supportsOAuth, } from "../../mcp/mcp-auth-flow.js";
-import { clearOAuthState } from "../../mcp/mcp-auth.js";
-import { reloadMcpConfig } from "../../mcp/init.js";
+import { McpAuthStartError, startMcpAuthFlow, } from "../../mcp/mcp-auth-start.js";
 import { BadRequestError } from "./errors.js";
-/**
- * Per-server in-flight guard. `startAuth` keys its pending transports and
- * persisted OAuth state by server name, so two concurrent flows for the same
- * server would clobber each other (the headless handler bypasses the
- * `authenticate()` dedupe). Reject the second POST until the first
- * flow's background chain finishes.
- */
-const inFlightMcpAuths = new Set();
-/**
- * An authorization URL is about to be opened in the user's browser, so it
- * must never be a `javascript:` / `data:` / malformed URL coming from a
- * malicious MCP server's OAuth metadata. Defense in depth: the landing UI
- * applies the same check before `window.open`.
- */
-function assertSafeAuthorizationUrl(authUrl) {
-    let parsed;
-    try {
-        parsed = new URL(authUrl);
-    }
-    catch {
-        throw new BadRequestError("Invalid authorization URL");
-    }
-    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
-        throw new BadRequestError("Invalid authorization URL");
-    }
-}
 export async function handleStartMcpAuth(state, body) {
     if (!state) {
         throw new BadRequestError("MCP adapter not loaded");
@@ -50,57 +23,19 @@ export async function handleStartMcpAuth(state, body) {
     if (typeof name !== "string" || name.length === 0) {
         throw new BadRequestError("name is required");
     }
-    const definition = state.config.mcpServers[name];
-    if (!definition) {
-        throw new BadRequestError(`Unknown MCP server: ${name}`);
-    }
-    if (!definition.url || !supportsOAuth(definition)) {
-        throw new BadRequestError(`MCP server "${name}" does not support OAuth`);
-    }
-    if (inFlightMcpAuths.has(name)) {
-        throw new BadRequestError("OAuth authentication already in progress for this server");
-    }
-    inFlightMcpAuths.add(name);
-    let authorizationUrl;
-    let oauthState;
     try {
-        ({ authorizationUrl, oauthState } = await startAuth(name, definition.url, definition));
-        if (authorizationUrl === "") {
-            inFlightMcpAuths.delete(name);
+        const result = await startMcpAuthFlow(state, name, {
+            openBrowser: body?.openBrowser === true,
+        });
+        if (result.status === "already-authenticated") {
             return { status: "already-authenticated" };
         }
-        // Fail loudly instead of skipping background completion — a flow without
-        // its persisted state could never be completed nor cleanly aborted.
-        if (!oauthState) {
-            throw new BadRequestError("OAuth state missing after authorization start");
-        }
-        assertSafeAuthorizationUrl(authorizationUrl);
+        return { status: "auth_url_ready", authUrl: result.authUrl };
     }
     catch (error) {
-        // Release the guard so a failed start does not wedge the server.
-        inFlightMcpAuths.delete(name);
+        if (error instanceof McpAuthStartError) {
+            throw new BadRequestError(error.message);
+        }
         throw error;
     }
-    // Complete the flow in the background from the local callback server:
-    // waitForCallback resolves with the authorization code, completeAuth
-    // exchanges it for tokens, and the MCP config is reloaded so the server
-    // comes up authenticated. Fire-and-forget — the response already carries
-    // the authUrl and auth progress is observable via GET /api/mcp-status,
-    // so failures are swallowed. The finally block releases the per-server
-    // in-flight guard and clears the now-stale OAuth state (idempotent) on
-    // every path.
-    waitForCallback(oauthState)
-        .then((code) => completeAuth(name, code))
-        .then(() => reloadMcpConfig(state))
-        .catch(() => { })
-        .finally(() => {
-        inFlightMcpAuths.delete(name);
-        try {
-            clearOAuthState(name);
-        }
-        catch {
-            // Storage errors must not surface as unhandled rejections.
-        }
-    });
-    return { status: "auth_url_ready", authUrl: authorizationUrl };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexol/spectral",
-  "version": "0.9.254",
+  "version": "0.9.255",
   "description": "AI coding agent for Aexol with relay-based browser access.",
   "type": "module",
   "private": false,