@mcp-ts/sdk 2.5.2 → 2.6.0

package/src/server/mcp/storage-oauth-provider.ts

@@ -1,3 +1,4 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
 import type { OAuthClientProvider } from "@modelcontextprotocol/sdk/client/auth.js";
 import type {
     OAuthClientInformationFull,
@@ -6,7 +7,7 @@ import type {
     OAuthTokens
 } from "@modelcontextprotocol/sdk/shared/auth.js";
 import { nanoid } from "nanoid";
-import { sessions, type SessionCredentials } from "../storage/index.js";
+import { sessions, type SessionCredentials, type SessionStore } from "../storage/index.js";
 import {
     DEFAULT_CLIENT_NAME,
     DEFAULT_CLIENT_URI,
@@ -18,6 +19,50 @@ import {
 } from '../../shared/constants.js';
 import { formatOAuthState, parseOAuthState } from '../../shared/utils.js';
 
+/**
+ * Context stored in AsyncLocalStorage for callback-time code verifier resolution.
+ * Stores the raw verifier and method directly, matching Cloudflare's DurableObjectOAuthClientProvider.
+ * This avoids a DB read in codeVerifier() — the verifier is loaded once by the caller
+ * (from session.credentials after get({includeCredentials: true})) and propagated through ALS.
+ */
+interface CodeVerifierContext {
+    verifier: string;
+    method: 'S256';
+}
+
+const codeVerifierContext = new AsyncLocalStorage<CodeVerifierContext>();
+
+/**
+ * Run a function inside a code verifier context, providing the raw verifier and method
+ * so that codeVerifier() can return them without a DB read.
+ */
+export function runWithCodeVerifierState<T>(
+    verifier: string,
+    method: 'S256',
+    fn: () => Promise<T>
+): Promise<T> {
+    return codeVerifierContext.run({ verifier, method }, fn);
+}
+
+function base64UrlEncode(bytes: Uint8Array): string {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+
+async function createCodeChallenge(verifier: string): Promise<string> {
+    const digest = await crypto.subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(verifier)
+    );
+    return base64UrlEncode(new Uint8Array(digest));
+}
+
 /**
  * Extension of OAuthClientProvider interface with additional methods
  * Enables server-specific tracking and state management
@@ -44,6 +89,8 @@ export interface StorageOAuthClientProviderOptions {
     policyUri?: string;
     clientId?: string;
     clientSecret?: string;
+    cachedTokens?: OAuthTokens;
+    sessionStore?: SessionStore;
     onRedirect?: (url: string) => void;
 }
 
@@ -63,8 +110,12 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
     private readonly policyUri?: string;
     private readonly clientSecret?: string;
 
+    private _store: SessionStore;
     private _authUrl: string | undefined;
     private _clientId: string | undefined;
+    private _cachedCodeVerifier: string | undefined;
+    private _hasCodeVerifier = false;
+    private _cachedTokens: OAuthTokens | null | undefined;
     private onRedirectCallback?: (url: string) => void;
 
     /**
@@ -82,6 +133,8 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
         this.policyUri = options.policyUri;
         this._clientId = options.clientId;
         this.clientSecret = options.clientSecret;
+        this._cachedTokens = options.cachedTokens;
+        this._store = options.sessionStore ?? sessions;
         this.onRedirectCallback = options.onRedirect;
     }
 
@@ -113,7 +166,7 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
      * @private
      */
     private async getCredentials(): Promise<SessionCredentials> {
-        const data = await sessions.getCredentials(this.userId, this.sessionId);
+        const data = await this._store.getCredentials(this.userId, this.sessionId);
         if (!data) {
             return { userId: this.userId, sessionId: this.sessionId };
         }
@@ -127,31 +180,39 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
      * @throws Error if session doesn't exist (session must be created by controller layer)
      */
     private async patchCredentials(data: Partial<SessionCredentials>): Promise<void> {
-        await sessions.patchCredentials(this.userId, this.sessionId, data);
+        await this._store.patchCredentials(this.userId, this.sessionId, data);
     }
 
     /**
-     * Retrieves stored OAuth client information
+     * Retrieves stored OAuth client information.
      */
     async clientInformation(): Promise<OAuthClientInformationMixed | undefined> {
-        const data = await this.getCredentials();
-
-        if (data.clientId && !this._clientId) {
-            this._clientId = data.clientId;
+        if (this._clientId) {
+            return {
+                client_id: this._clientId,
+                ...(this.clientSecret ? { client_secret: this.clientSecret } : {}),
+            };
         }
 
-        if (data.clientInformation) {
-            return data.clientInformation;
+        const data = await this.getCredentials();
+
+        // Pre-cache tokens (or absent sentinel) so subsequent tokens() call is 0 DB reads
+        if (this._cachedTokens === undefined) {
+            this._cachedTokens = data.tokens ?? null;
         }
 
-        if (!this._clientId) {
-            return undefined;
+        if (data.clientId) {
+            this._clientId = data.clientId;
+            if (data.clientInformation) {
+                return data.clientInformation;
+            }
+            return {
+                client_id: data.clientId,
+                ...(this.clientSecret ? { client_secret: this.clientSecret } : {}),
+            };
         }
 
-        return {
-            client_id: this._clientId,
-            ...(this.clientSecret ? { client_secret: this.clientSecret } : {}),
-        };
+        return undefined;
     }
 
     /**
@@ -170,6 +231,24 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
      */
     async saveTokens(tokens: OAuthTokens): Promise<void> {
         await this.patchCredentials({ tokens });
+        this._cachedTokens = tokens;
+    }
+
+    /**
+     * Persists static client credentials to DB immediately on creation.
+     * Ensures getOrCreateClient() finds them on rehydration, even when the
+     * server allows anonymous connect and never triggers DCR.
+     */
+    async initializeCredentials(): Promise<void> {
+        if (this._clientId) {
+            await this.patchCredentials({
+                clientId: this._clientId,
+                clientInformation: {
+                    client_id: this._clientId,
+                    ...(this.clientSecret ? { client_secret: this.clientSecret } : {}),
+                },
+            });
+        }
     }
 
     get authUrl() {
@@ -177,6 +256,8 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
     }
 
     async state(): Promise<string> {
+        this._cachedCodeVerifier = undefined;
+        this._hasCodeVerifier = false;
         const nonce = nanoid(32);
         await this.patchCredentials({
             oauthState: {
@@ -200,7 +281,7 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
             return { valid: false, error: "OAuth state mismatch" };
         }
 
-        const data = await sessions.getCredentials(this.userId, parsed.sessionId);
+        const data = await this._store.getCredentials(this.userId, parsed.sessionId);
 
         if (!data) {
             return { valid: false, error: "Session not found" };
@@ -237,7 +318,24 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
 
     async redirectToAuthorization(authUrl: URL): Promise<void> {
         this._authUrl = authUrl.toString();
-        await sessions.update(this.userId, this.sessionId, { authUrl: this._authUrl });
+
+        // Extract PKCE parameters from auth URL and persist verifier
+        // keyed by state nonce for callback-time retrieval.
+        const codeChallenge = authUrl.searchParams.get("code_challenge");
+        const state = authUrl.searchParams.get("state");
+
+        if (this._cachedCodeVerifier && codeChallenge && state) {
+            const expectedChallenge = await createCodeChallenge(this._cachedCodeVerifier);
+            if (expectedChallenge === codeChallenge) {
+                const parsed = parseOAuthState(state);
+                if (parsed) {
+                    await this.patchCredentials({
+                        codeVerifier: this._cachedCodeVerifier,
+                    });
+                }
+            }
+        }
+
         if (this.onRedirectCallback) {
             this.onRedirectCallback(authUrl.toString());
         }
@@ -247,7 +345,8 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
         scope: "all" | "client" | "tokens" | "verifier"
     ): Promise<void> {
         if (scope === "all") {
-            await sessions.delete(this.userId, this.sessionId);
+            this._cachedTokens = undefined;
+            await this._store.delete(this.userId, this.sessionId);
         } else {
             const updates: Partial<SessionCredentials> = {};
 
@@ -255,8 +354,11 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
                 updates.clientInformation = null;
                 updates.clientId = null;
             } else if (scope === "tokens") {
+                this._cachedTokens = undefined;
                 updates.tokens = null;
             } else if (scope === "verifier") {
+                this._cachedCodeVerifier = undefined;
+                this._hasCodeVerifier = false;
                 updates.codeVerifier = null;
             }
             await this.patchCredentials(updates);
@@ -264,34 +366,52 @@ export class StorageOAuthClientProvider implements AgentsOAuthProvider {
     }
 
     async saveCodeVerifier(verifier: string): Promise<void> {
-        const data = await this.getCredentials();
-        if (data.codeVerifier) {
+        if (this._hasCodeVerifier) {
             return;
         }
 
-        await this.patchCredentials({ codeVerifier: verifier });
+        this._cachedCodeVerifier = verifier;
+        this._hasCodeVerifier = true;
     }
 
     async codeVerifier(): Promise<string> {
-        const data = await this.getCredentials();
+        if (this._cachedCodeVerifier) {
+            return this._cachedCodeVerifier;
+        }
 
-        if (data.clientId && !this._clientId) {
-            this._clientId = data.clientId;
+        // ALS context carries the raw verifier directly (set by the caller via
+        // runWithCodeVerifierState), avoiding a DB read at callback time.
+        const ctx = codeVerifierContext.getStore();
+        if (ctx?.verifier) {
+            return ctx.verifier;
         }
 
-        if (!data.codeVerifier) {
-            throw new Error("No code verifier found");
+        // Cross-instance fallback: read verifier from DB (no ALS context).
+        const data = await this.getCredentials();
+        if (data.codeVerifier) {
+            return data.codeVerifier;
         }
-        return data.codeVerifier;
+
+        throw new Error("No code verifier found");
     }
 
     async deleteCodeVerifier(): Promise<void> {
-        await this.patchCredentials({ codeVerifier: null });
+        this._cachedCodeVerifier = undefined;
+        this._hasCodeVerifier = false;
+        await this.patchCredentials({
+            codeVerifier: null,
+        });
     }
 
     async tokens(): Promise<OAuthTokens | undefined> {
+        if (this._cachedTokens !== undefined) {
+            return this._cachedTokens ?? undefined;
+        }
+
         const data = await this.getCredentials();
 
+        this._cachedTokens = data.tokens ?? null;
+
         if (data.clientId && !this._clientId) {
             this._clientId = data.clientId;
         }

package/src/server/mcp/tool-policy-gateway.ts

@@ -1,4 +1,4 @@
-import type { Tool, ListToolsResult, CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { Tool, ListToolsResult, CallToolResult, Implementation } from '@modelcontextprotocol/sdk/types.js';
 import type { ToolClient } from '../../shared/types.js';
 import { sessions } from '../storage/index.js';
 import type { Session } from '../storage/types.js';
@@ -13,6 +13,7 @@ type RawToolClient = ToolClient & {
     fetchTools(): Promise<{ tools: Tool[] }>;
     listTools(): Promise<{ tools: Tool[] }>;
     callTool(name: string, args: Record<string, unknown>): Promise<CallToolResult>;
+    getServerInfo?(): Implementation | undefined;
 };
 
 /**
@@ -46,6 +47,15 @@ export class ToolPolicyGateway implements ToolClient {
         return this.client.getServerId?.();
     }
 
+    /**
+     * Returns the full server metadata from the underlying client, if available.
+     * Includes name, version, icons, title, description, and website URL.
+     * Available only after the client has connected and completed initialization.
+     */
+    getServerInfo(): Implementation | undefined {
+        return this.client.getServerInfo?.();
+    }
+
     /**
      * Returns the human-readable server name from the underlying client, if available.
      */

package/src/server/storage/file-backend.ts

@@ -1,6 +1,6 @@
 import { promises as fs } from 'fs';
 import * as path from 'path';
-import type { SessionStore, Session, SessionCredentials } from './types.js';
+import type { SessionStore, Session, SessionCredentials, GetOptions, SessionResult } from './types.js';
 import { generateSessionId } from '../../shared/utils.js';
 import {
     mergeSessionUpdate,
@@ -16,7 +16,6 @@ import {
 export class FileStorageBackend implements SessionStore {
     private filePath: string;
     private memoryCache: Map<string, Session> | null = null;
-    private credentialsCache: Map<string, SessionCredentials> | null = null;
     private initialized = false;
 
     /**
@@ -42,23 +41,16 @@ export class FileStorageBackend implements SessionStore {
             const json = JSON.parse(data);
 
             this.memoryCache = new Map();
-            this.credentialsCache = new Map();
             if (Array.isArray(json.sessions)) {
                 json.sessions.forEach((s: Session) => {
                     const session = normalizeStoredSession(s);
                     this.memoryCache!.set(this.getSessionKey(session.userId || 'unknown', session.sessionId), session);
                 });
             }
-            if (Array.isArray(json.credentials)) {
-                json.credentials.forEach((c: SessionCredentials) => {
-                    this.credentialsCache!.set(this.getSessionKey(c.userId, c.sessionId), c);
-                });
-            }
         } catch (error: any) {
             if (error.code === 'ENOENT') {
                 // File does not exist, initialize empty
                 this.memoryCache = new Map();
-                this.credentialsCache = new Map();
                 await this.flush();
             } else {
                 console.error('[FileStorage] Failed to load sessions:', error);
@@ -75,10 +67,9 @@ export class FileStorageBackend implements SessionStore {
     }
 
     private async flush(): Promise<void> {
-        if (!this.memoryCache || !this.credentialsCache) return;
+        if (!this.memoryCache) return;
         await fs.writeFile(this.filePath, JSON.stringify({
             sessions: Array.from(this.memoryCache.values()),
-            credentials: Array.from(this.credentialsCache.values()),
         }, null, 2), 'utf-8');
     }
 
@@ -124,26 +115,40 @@ export class FileStorageBackend implements SessionStore {
     async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
         await this.ensureInitialized();
         const sessionKey = this.getSessionKey(userId, sessionId);
-        if (!this.memoryCache!.has(sessionKey)) {
+        const current = this.memoryCache!.get(sessionKey);
+        if (!current) {
             throw new Error(`Session ${sessionId} not found`);
         }
 
-        const current = this.credentialsCache!.get(sessionKey) ?? { sessionId, userId };
-        this.credentialsCache!.set(sessionKey, { ...current, ...data, sessionId, userId });
+        this.memoryCache!.set(sessionKey, { ...current, ...data, sessionId, userId });
         await this.flush();
     }
 
-    async get(userId: string, sessionId: string): Promise<Session | null> {
+    async get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null> {
         await this.ensureInitialized();
         const sessionKey = this.getSessionKey(userId, sessionId);
-        return this.memoryCache!.get(sessionKey) || null;
+        const session = this.memoryCache!.get(sessionKey) || null;
+        if (!session) return null;
+        if (!options?.includeCredentials) {
+            const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+            return sessionOnly as Session;
+        }
+        return session;
     }
 
     async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
         await this.ensureInitialized();
         const sessionKey = this.getSessionKey(userId, sessionId);
-        if (!this.memoryCache!.has(sessionKey)) return null;
-        return this.credentialsCache!.get(sessionKey) ?? { sessionId, userId };
+        const session = this.memoryCache!.get(sessionKey);
+        if (!session) return null;
+
+        const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+        return {
+            sessionId, userId,
+            clientInformation, tokens, codeVerifier,
+            codeVerifierChallenge, codeVerifierNonce,
+            clientId, oauthState,
+        };
     }
 
     async clearCredentials(userId: string, sessionId: string): Promise<void> {
@@ -151,6 +156,8 @@ export class FileStorageBackend implements SessionStore {
             clientInformation: null,
             tokens: null,
             codeVerifier: null,
+            codeVerifierChallenge: null,
+            codeVerifierNonce: null,
             clientId: null,
             oauthState: null,
         });
@@ -172,7 +179,6 @@ export class FileStorageBackend implements SessionStore {
         await this.ensureInitialized();
         const sessionKey = this.getSessionKey(userId, sessionId);
         const deleted = this.memoryCache!.delete(sessionKey);
-        this.credentialsCache!.delete(sessionKey);
         if (deleted) {
             await this.flush();
         }
@@ -186,7 +192,6 @@ export class FileStorageBackend implements SessionStore {
     async clearAll(): Promise<void> {
         await this.ensureInitialized();
         this.memoryCache!.clear();
-        this.credentialsCache!.clear();
         await this.flush();
     }
 
@@ -198,7 +203,6 @@ export class FileStorageBackend implements SessionStore {
             if (!isSessionExpired(session)) continue;
 
             this.memoryCache!.delete(key);
-            this.credentialsCache!.delete(key);
             changed = true;
         }
 

package/src/server/storage/index.ts

@@ -6,6 +6,7 @@ import { SqliteStorage } from './sqlite-backend.js';
 import { SupabaseStorageBackend } from './supabase-backend.js';
 import { NeonStorageBackend, type NeonStorageOptions } from './neon-backend.js';
 import type { SessionStore, Session, SessionMutationEvent, SessionMutationListener } from './types.js';
+import type { McpObservabilityEvent } from '../../shared/events.js';
 
 // Re-export types
 export * from './types.js';
@@ -283,6 +284,76 @@ export function _resetSessionMutationListenersForTesting(): void {
     sessionMutationListeners.clear();
 }
 
+/**
+ * Wraps a SessionStore with a Proxy that emits an McpObservabilityEvent for every
+ * method call — reads (`db:read`) and writes (`db:write`) — including duration
+ * and any error. Useful for debugging connection flows end-to-end.
+ *
+ * Usage:
+ * ```ts
+ * import { sessions, withDbObservability } from '@mcp-ts/sdk/server/storage';
+ * const db = withDbObservability(sessions, (event) => console.log('[DB]', event));
+ * // Use `db` instead of `sessions` throughout the request
+ * ```
+ *
+ * @param store - The underlying SessionStore instance to wrap.
+ * @param emit  - Called synchronously after each store method completes
+ *                (or rejects) with a typed observability event.
+ * @returns A drop-in SessionStore replacement.
+ */
+export function withDbObservability(
+    store: SessionStore,
+    emit: (event: McpObservabilityEvent) => void,
+): SessionStore {
+    const readMethods = new Set<keyof SessionStore>([
+        'get', 'getCredentials', 'list', 'listIds', 'listAllIds',
+    ]);
+
+    return new Proxy(store, {
+        get(target, prop, receiver) {
+            const original = Reflect.get(target, prop, receiver);
+            if (typeof original !== 'function') return original;
+
+            return (...args: any[]) => {
+                const method = prop as string;
+                const isRead = readMethods.has(prop as keyof SessionStore);
+                const start = performance.now();
+
+                const emitEvent = (error?: string) => {
+                    emit({
+                        type: isRead ? 'db:read' : 'db:write',
+                        level: error ? 'error' : 'debug',
+                        message: `${method}(${args.map(a =>
+                            typeof a === 'string' ? a.slice(0, 24) : typeof a,
+                        ).join(', ')})`,
+                        sessionId: typeof args[1] === 'string' ? args[1] : undefined,
+                        payload: {
+                            method,
+                            argTypes: args.map(a => typeof a),
+                            durationMs: performance.now() - start,
+                            ...(error ? { error } : {}),
+                        },
+                        timestamp: Date.now(),
+                    });
+                };
+
+                try {
+                    const result = original.apply(target, args);
+                    if (result instanceof Promise) {
+                        return result.then(r => { emitEvent(); return r; })
+                            .catch(e => { emitEvent(String(e)); throw e; });
+                    }
+                    emitEvent();
+                    return result;
+                } catch (e) {
+                    emitEvent(String(e));
+                    throw e;
+                }
+            };
+        },
+    });
+}
+
 /**
  * Global session store instance
  * Uses lazy initialization with a Proxy to handle async setup transparently

package/src/server/storage/memory-backend.ts

@@ -1,4 +1,4 @@
-import type { SessionStore, Session, SessionCredentials } from './types.js';
+import type { SessionStore, Session, SessionCredentials, GetOptions, SessionResult } from './types.js';
 import { generateSessionId } from '../../shared/utils.js';
 import { isSessionExpired, mergeSessionUpdate, normalizeNewSession } from './session-lifecycle.js';
 
@@ -9,7 +9,6 @@ import { isSessionExpired, mergeSessionUpdate, normalizeNewSession } from './ses
 export class MemoryStorageBackend implements SessionStore {
     // Map<userId:sessionId, Session>
     private sessions = new Map<string, Session>();
-    private credentials = new Map<string, SessionCredentials>();
 
     // Map<userId, Set<sessionId>>
     private userIdSessions = new Map<string, Set<string>>();
@@ -63,24 +62,38 @@ export class MemoryStorageBackend implements SessionStore {
 
     async patchCredentials(userId: string, sessionId: string, data: Partial<SessionCredentials>): Promise<void> {
         const sessionKey = this.getSessionKey(userId, sessionId);
-        if (!this.sessions.has(sessionKey)) {
+        const current = this.sessions.get(sessionKey);
+        if (!current) {
             throw new Error(`Session ${sessionId} not found`);
         }
 
-        const current = this.credentials.get(sessionKey) ?? { sessionId, userId };
-        this.credentials.set(sessionKey, { ...current, ...data, sessionId, userId });
+        this.sessions.set(sessionKey, { ...current, ...data, sessionId, userId });
     }
 
 
-    async get(userId: string, sessionId: string): Promise<Session | null> {
+    async get(userId: string, sessionId: string, options?: GetOptions): Promise<SessionResult | null> {
         const sessionKey = this.getSessionKey(userId, sessionId);
-        return this.sessions.get(sessionKey) || null;
+        const session = this.sessions.get(sessionKey) || null;
+        if (!session) return session;
+        if (!options?.includeCredentials) {
+            const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState, ...sessionOnly } = session;
+            return sessionOnly as Session;
+        }
+        return session;
     }
 
     async getCredentials(userId: string, sessionId: string): Promise<SessionCredentials | null> {
         const sessionKey = this.getSessionKey(userId, sessionId);
-        if (!this.sessions.has(sessionKey)) return null;
-        return this.credentials.get(sessionKey) ?? { sessionId, userId };
+        const session = this.sessions.get(sessionKey);
+        if (!session) return null;
+
+        const { clientInformation, tokens, codeVerifier, codeVerifierChallenge, codeVerifierNonce, clientId, oauthState } = session;
+        return {
+            sessionId, userId,
+            clientInformation, tokens, codeVerifier,
+            codeVerifierChallenge, codeVerifierNonce,
+            clientId, oauthState,
+        };
     }
 
     async clearCredentials(userId: string, sessionId: string): Promise<void> {
@@ -88,6 +101,8 @@ export class MemoryStorageBackend implements SessionStore {
             clientInformation: null,
             tokens: null,
             codeVerifier: null,
+            codeVerifierChallenge: null,
+            codeVerifierNonce: null,
             clientId: null,
             oauthState: null,
         });
@@ -115,7 +130,6 @@ export class MemoryStorageBackend implements SessionStore {
     async delete(userId: string, sessionId: string): Promise<void> {
         const sessionKey = this.getSessionKey(userId, sessionId);
         this.sessions.delete(sessionKey);
-        this.credentials.delete(sessionKey);
 
         const set = this.userIdSessions.get(userId);
         if (set) {
@@ -132,7 +146,6 @@ export class MemoryStorageBackend implements SessionStore {
 
     async clearAll(): Promise<void> {
         this.sessions.clear();
-        this.credentials.clear();
         this.userIdSessions.clear();
     }
 
@@ -141,7 +154,6 @@ export class MemoryStorageBackend implements SessionStore {
             if (!isSessionExpired(session)) continue;
 
             this.sessions.delete(key);
-            this.credentials.delete(key);
 
             const set = this.userIdSessions.get(session.userId);
             if (set) {