@cursor/july 0.1.33 → 0.1.34

package/src/internal/cli-mcp-oauth.ts

@@ -96,30 +96,77 @@ export async function cmdMcpOauth(
     return 1;
   }
 
-  out(
-    `${LOG_PREFIX} Authorizing "${options.connection}" (${transport.url})…\n`
-  );
+  const flow = await authorizeHostMcpOauth({
+    connection: options.connection,
+    url: transport.url,
+    type: transport.type === "sse" ? "sse" : "http",
+    headers: transport.headers,
+    out,
+    err,
+  });
+  if (!flow.ok) {
+    return 1;
+  }
+
+  if (options.store !== true) {
+    return 0;
+  }
+  return storeOauthSecrets({
+    connection: options.connection,
+    dir: options.dir,
+    slug: options.slug,
+    team: options.team,
+    apiKey: options.apiKey,
+    tokens: flow.tokens,
+    clientId: flow.clientId,
+    err,
+    out,
+  });
+}
+
+export interface HostMcpOauthArgs {
+  /** Connection name — the local token-store identifier. */
+  connection: string;
+  url: string;
+  type?: "http" | "sse";
+  headers?: Record<string, string>;
+  out: (text: string) => void;
+  err: (text: string) => void;
+}
+
+export type HostMcpOauthResult =
+  | { ok: true; tokens: OAuthTokens | undefined; clientId: string | undefined }
+  | { ok: false };
+
+/**
+ * The interactive host-OAuth browser flow against an MCP server URL. Takes
+ * the transport metadata directly so callers that already hold it never have
+ * to load the authored project to authorize.
+ */
+export async function authorizeHostMcpOauth(
+  args: HostMcpOauthArgs
+): Promise<HostMcpOauthResult> {
+  const { connection, out, err } = args;
+  out(`${LOG_PREFIX} Authorizing "${connection}" (${args.url})…\n`);
 
   let authorizationUrl: URL | undefined;
   const provider = await createHostMcpOAuthProvider({
-    identifier: options.connection,
-    resourceUrl: transport.url,
+    identifier: connection,
+    resourceUrl: args.url,
     onRedirect: (url) => {
       authorizationUrl = url;
     },
   });
 
   const client = new Client({ name: "agent-sdk-mcp-oauth", version: "0.1.0" });
-  const url = new URL(transport.url);
+  const url = new URL(args.url);
   const requestInit =
-    transport.headers === undefined
-      ? undefined
-      : { headers: transport.headers };
+    args.headers === undefined ? undefined : { headers: args.headers };
 
   const makeTransport = ():
     | StreamableHTTPClientTransport
     | SSEClientTransport => {
-    if (transport.type === "sse") {
+    if (args.type === "sse") {
       return new SSEClientTransport(url, {
         authProvider: provider,
         requestInit,
@@ -135,15 +182,15 @@ export async function cmdMcpOauth(
   let authorized = false;
   try {
     await client.connect(mcpTransport);
-    out(`${LOG_PREFIX} "${options.connection}" already authorized.\n`);
+    out(`${LOG_PREFIX} "${connection}" already authorized.\n`);
     await client.close().catch(() => undefined);
     authorized = true;
   } catch (error) {
     if (!(error instanceof UnauthorizedError)) {
       err(
-        `${LOG_PREFIX} Failed to connect to "${options.connection}": ${describe(error)}\n`
+        `${LOG_PREFIX} Failed to connect to "${connection}": ${describe(error)}\n`
       );
-      return 1;
+      return { ok: false };
     }
   }
 
@@ -153,7 +200,7 @@ export async function cmdMcpOauth(
       err(
         `${LOG_PREFIX} Auth required but no authorization URL was provided.\n`
       );
-      return 1;
+      return { ok: false };
     }
 
     out(`${LOG_PREFIX} Open if needed:\n  ${redirect.toString()}\n`);
@@ -165,14 +212,14 @@ export async function cmdMcpOauth(
       callback = await waitForMcpOAuthCallback();
     } catch (error) {
       err(`${LOG_PREFIX} OAuth callback failed: ${describe(error)}\n`);
-      return 1;
+      return { ok: false };
     }
 
     try {
       await mcpTransport.finishAuth(callback.code);
     } catch (error) {
       err(`${LOG_PREFIX} Token exchange failed: ${describe(error)}\n`);
-      return 1;
+      return { ok: false };
     }
 
     mcpTransport = makeTransport();
@@ -180,31 +227,22 @@ export async function cmdMcpOauth(
       await client.connect(mcpTransport);
       const tools = await client.listTools();
       out(
-        `${LOG_PREFIX} Authorized "${options.connection}" (${tools.tools.length} tools). Local tokens in the agent-serve config dir.\n`
+        `${LOG_PREFIX} Authorized "${connection}" (${tools.tools.length} tools). Local tokens in the agent-serve config dir.\n`
       );
       await client.close().catch(() => undefined);
     } catch (error) {
       err(
-        `${LOG_PREFIX} Reconnect failed: ${describe(error)}. Re-run \`${CLI} mcp oauth ${options.connection}\`.\n`
+        `${LOG_PREFIX} Reconnect failed: ${describe(error)}. Re-run \`${CLI} mcp oauth ${connection}\`.\n`
       );
-      return 1;
+      return { ok: false };
     }
   }
 
-  if (options.store !== true) {
-    return 0;
-  }
-  return storeOauthSecrets({
-    connection: options.connection,
-    dir: options.dir,
-    slug: options.slug,
-    team: options.team,
-    apiKey: options.apiKey,
+  return {
+    ok: true,
     tokens: provider.tokens(),
     clientId: provider.clientInformation()?.client_id,
-    err,
-    out,
-  });
+  };
 }
 
 /**