@pi-archimedes/mcp 2.3.0

package/src/npx-resolver.test.ts

@@ -0,0 +1,142 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { parseNpxArgs, resolveNpxBinary } from "./npx-resolver.js";
+
+describe("parseNpxArgs", () => {
+  it("strips -y", () => {
+    expect(parseNpxArgs(["-y", "pkg"])).toEqual(["pkg"]);
+  });
+
+  it("strips --yes", () => {
+    expect(parseNpxArgs(["--yes", "pkg"])).toEqual(["pkg"]);
+  });
+
+  it("strips exec subcommand", () => {
+    expect(parseNpxArgs(["exec", "pkg"])).toEqual(["pkg"]);
+  });
+
+  it("strips combined wrapper flags", () => {
+    expect(parseNpxArgs(["-y", "exec", "pkg"])).toEqual(["pkg"]);
+    expect(parseNpxArgs(["--yes", "-y", "pkg"])).toEqual(["pkg"]);
+  });
+
+  it("keeps the package and any real args intact", () => {
+    expect(parseNpxArgs(["pkg", "--foo", "bar"])).toEqual(["pkg", "--foo", "bar"]);
+  });
+
+  it("handles pkg@version form", () => {
+    expect(parseNpxArgs(["-y", "pkg@1.2.3"])).toEqual(["pkg@1.2.3"]);
+  });
+
+  it("returns empty array when only wrapper flags present", () => {
+    expect(parseNpxArgs(["-y", "--yes"])).toEqual([]);
+  });
+});
+
+describe("resolveNpxBinary", () => {
+  it("returns null for a non-npx command", async () => {
+    const result = await resolveNpxBinary("node", ["x"]);
+    expect(result).toBeNull();
+  });
+
+  it("returns null for a plain executable (pure, no filesystem)", async () => {
+    const result = await resolveNpxBinary("/usr/bin/python3", ["script.py"]);
+    expect(result).toBeNull();
+  });
+
+  it("returns a non-null resolution for an npx command", async () => {
+    // Environment-dependent: it may resolve to a real bin or fall back to the
+    // original command with wrapper flags stripped. Either way it must be non-null.
+    const result = await resolveNpxBinary("npx", ["-y", "some-real-pkg"]);
+    expect(result).not.toBeNull();
+    if (result) {
+      expect(result.command).toBeTruthy();
+      expect(Array.isArray(result.args)).toBe(true);
+    }
+  });
+
+  it("returns a non-null resolution for npm exec", async () => {
+    const result = await resolveNpxBinary("npm", ["exec", "-y", "some-real-pkg"]);
+    expect(result).not.toBeNull();
+  });
+});
+
+describe("resolveNpxBinary (filesystem fixtures)", () => {
+  let originalCwd: string;
+  const tmpDirs: string[] = [];
+
+  beforeEach(() => {
+    originalCwd = process.cwd();
+  });
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+    for (const dir of tmpDirs.splice(0)) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  /** Create a tmp cwd with a fake package install and chdir into it. */
+  function withInstalledPkg(
+    pkgName: string,
+    pkgJson: Record<string, unknown>,
+    dotBinEntries: string[],
+  ): string {
+    const dir = mkdtempSync(join(tmpdir(), "npx-resolver-"));
+    tmpDirs.push(dir);
+    const nm = join(dir, "node_modules");
+    mkdirSync(join(nm, pkgName), { recursive: true });
+    writeFileSync(
+      join(nm, pkgName, "package.json"),
+      JSON.stringify(pkgJson),
+      "utf8",
+    );
+    for (const entry of dotBinEntries) {
+      mkdirSync(join(nm, ".bin"), { recursive: true });
+      writeFileSync(join(nm, ".bin", entry), "#!/usr/bin/env node\n", "utf8");
+    }
+    process.chdir(dir);
+    return dir;
+  }
+
+  it("resolves object-form bin using the bin key, not the value", async () => {
+    const dir = withInstalledPkg(
+      "fixture-key-pkg",
+      { name: "fixture-key-pkg", bin: { foo: "cli.js" } },
+      ["foo"],
+    );
+    const result = await resolveNpxBinary("npx", ["-y", "fixture-key-pkg", "--flag"]);
+    expect(result).toEqual({
+      command: join(dir, "node_modules", ".bin", "foo"),
+      args: ["--flag"],
+    });
+  });
+
+  it("resolves string-form bin using the package name", async () => {
+    const dir = withInstalledPkg(
+      "fixture-string-pkg",
+      { name: "fixture-string-pkg", bin: "cli.js" },
+      ["fixture-string-pkg"],
+    );
+    const result = await resolveNpxBinary("npx", ["fixture-string-pkg"]);
+    expect(result).toEqual({
+      command: join(dir, "node_modules", ".bin", "fixture-string-pkg"),
+      args: [],
+    });
+  });
+
+  it("fallback (no package found) returns the original command and args unchanged", async () => {
+    withInstalledPkg("fixture-unrelated-pkg", { name: "fixture-unrelated-pkg" }, []);
+    const result = await resolveNpxBinary("npx", [
+      "-y",
+      "definitely-not-installed-xyz-42",
+      "--port", "8080",
+    ]);
+    expect(result).toEqual({
+      command: "npx",
+      args: ["-y", "definitely-not-installed-xyz-42", "--port", "8080"],
+    });
+  });
+});

package/src/npx-resolver.ts

@@ -0,0 +1,126 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+
+export interface NpxResolution {
+  command: string;
+  args: string[];
+}
+
+/** Flags/subcommands that wrap the real package argument. */
+const WRAPPER_FLAGS = new Set(["-y", "--yes", "exec"]);
+
+/**
+ * Pure helper: strip npx wrapper flags (-y, --yes, exec) from args.
+ * The first remaining argument is the package (or bin) name.
+ */
+export function parseNpxArgs(args: string[]): string[] {
+  return args.filter((a) => !WRAPPER_FLAGS.has(a));
+}
+
+/**
+ * True when the command is `npx`, or `npm` invoked with the `exec`/`npx`
+ * subcommand. The command may be an absolute path; only its basename matters.
+ */
+function isNpxCommand(command: string, args: string[]): boolean {
+  const base = basename(command);
+  if (base === "npx") return true;
+  if (base === "npm") return args[0] === "exec" || args[0] === "npx";
+  return false;
+}
+
+/** Strip a trailing `@version` from a package name (handles scoped names). */
+function stripVersion(arg: string): string {
+  const start = arg.startsWith("@") ? 1 : 0;
+  const at = arg.indexOf("@", start);
+  return at === -1 ? arg : arg.slice(0, at);
+}
+
+/** Read the bin name(s) declared by a package's package.json (bin *keys*). */
+function readPackageBinNames(pkgDir: string): string[] {
+  try {
+    const raw = readFileSync(join(pkgDir, "package.json"), "utf8");
+    const pkg = JSON.parse(raw) as { bin?: unknown; name?: unknown };
+    // String form: npm names the .bin symlink after the package name.
+    if (typeof pkg.bin === "string") {
+      return typeof pkg.name === "string" && pkg.name ? [pkg.name] : [];
+    }
+    if (pkg.bin && typeof pkg.bin === "object") {
+      return Object.keys(pkg.bin as Record<string, string>);
+    }
+  } catch {
+    // Missing/unreadable package.json — no declared bin.
+  }
+  return [];
+}
+
+/** Directories that contain a `node_modules` tree worth checking. */
+function nodeModulesBases(cwd: string): string[] {
+  const bases: string[] = [cwd];
+
+  // npx/npm install cache (~/.npm/_npx/<hash>)
+  const npxCache = join(homedir(), ".npm", "_npx");
+  try {
+    for (const entry of readdirSync(npxCache)) {
+      bases.push(join(npxCache, entry));
+    }
+  } catch {
+    // No cache present — ignore.
+  }
+
+  // Global installs relative to the running node binary (<prefix>/lib).
+  bases.push(join(dirname(process.execPath), "..", "lib"));
+
+  return bases;
+}
+
+/**
+ * Locate the actual bin of `pkg` by finding its package.json and resolving the
+ * declared bin name against the sibling `node_modules/.bin`. Returns the absolute
+ * bin path, or null when it cannot be found.
+ */
+function findBinPath(cwd: string, pkg: string): string | null {
+  for (const base of nodeModulesBases(cwd)) {
+    const binNames = readPackageBinNames(join(base, "node_modules", pkg));
+    for (const binName of binNames) {
+      const binPath = join(base, "node_modules", ".bin", binName);
+      try {
+        if (existsSync(binPath) && statSync(binPath).isFile()) return binPath;
+      } catch {
+        // Unreadable entry — skip.
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * If command is `npx`/`npm exec`, attempt to resolve the actual package binary
+ * so we spawn it directly instead of the npm parent.
+ *
+ * Returns null when the command is NOT an npx/npm command (caller uses the
+ * original command/args). Otherwise always returns a resolution: either the
+ * resolved bin path (with wrapper flags stripped), or the original command and
+ * args *unchanged* when no bin could be located (graceful degradation — never
+ * null for npx/npm, never strips flags we didn't consume).
+ */
+export async function resolveNpxBinary(
+  command: string,
+  args: string[],
+): Promise<NpxResolution | null> {
+  if (!isNpxCommand(command, args)) return null;
+
+  const parsed = parseNpxArgs(args);
+  const first = parsed[0];
+  const rest = parsed.slice(1);
+
+  // No package argument (e.g. bare `npx`) — degrade to the original.
+  if (!first) return { command, args };
+
+  const bin = findBinPath(process.cwd(), stripVersion(first));
+  if (bin) return { command: bin, args: rest };
+
+  // No bin found — degrade gracefully to the original command/args unchanged
+  // (keep -y/--yes so npx doesn't prompt; never return null for npx/npm).
+  return { command, args };
+}

package/src/oauth-provider.test.ts

@@ -0,0 +1,404 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { AuthEntry } from "./oauth-types.js";
+import type { McpOAuthConfig } from "./types.js";
+
+/**
+ * Mocks for the storage and callback-server boundaries so the provider is
+ * exercised in isolation:
+ * - `auth-storage.js` — in-memory AuthEntry per server name. The mock
+ *   mirrors the real module's contract: `getAuthEntry` returns a clone,
+ *   `saveAuthEntry` replaces the stored entry and mutates `entry.serverUrl`
+ *   when the param is passed.
+ * - `callback-server.js` — pinned constants so redirect URL assertions are
+ *   independent of the MCP_OAUTH_CALLBACK_PORT env var.
+ */
+const storage = vi.hoisted(() => {
+  const entries = new Map<string, AuthEntry>();
+  const clone = <T>(value: T): T => (value === undefined ? value : structuredClone(value));
+
+  const getAuthEntry = vi.fn((serverName: string): AuthEntry | undefined =>
+    clone(entries.get(serverName)),
+  );
+  const saveAuthEntry = vi.fn(
+    (serverName: string, entry: AuthEntry, serverUrl?: string): void => {
+      if (serverUrl !== undefined) entry.serverUrl = serverUrl;
+      entries.set(serverName, clone(entry));
+    },
+  );
+  const deleteAuthEntry = vi.fn((serverName: string): void => {
+    entries.delete(serverName);
+  });
+
+  return {
+    entries,
+    getAuthEntry,
+    saveAuthEntry,
+    deleteAuthEntry,
+    seed(serverName: string, entry: AuthEntry): void {
+      entries.set(serverName, clone(entry));
+    },
+    reset(): void {
+      entries.clear();
+      getAuthEntry.mockClear();
+      saveAuthEntry.mockClear();
+      deleteAuthEntry.mockClear();
+    },
+  };
+});
+
+vi.mock("./auth-storage.js", () => ({
+  getAuthEntry: storage.getAuthEntry,
+  saveAuthEntry: storage.saveAuthEntry,
+  deleteAuthEntry: storage.deleteAuthEntry,
+}));
+
+vi.mock("./callback-server.js", () => ({
+  getCallbackPort: () => 19876,
+  getCallbackPath: () => "/callback",
+}));
+
+import { McpOAuthProvider, type OAuthCallbacks } from "./oauth-provider.js";
+
+const SERVER_NAME = "test-server";
+const SERVER_URL = "https://mcp.example.com";
+
+/** Fixed wall clock for deterministic expiresAt/expires_in math. */
+const FAKE_NOW_MS = Date.parse("2026-02-03T12:00:00.000Z");
+const FAKE_NOW_SECONDS = FAKE_NOW_MS / 1000;
+
+const DEFAULT_REDIRECT = "http://localhost:19876/callback";
+
+function makeProvider(
+  config: McpOAuthConfig = {},
+  callbacks: OAuthCallbacks = {},
+  csrfState?: string,
+  callbackPort?: number,
+): McpOAuthProvider {
+  return new McpOAuthProvider(SERVER_NAME, SERVER_URL, config, callbacks, csrfState, callbackPort);
+}
+
+beforeEach(() => {
+  storage.reset();
+  vi.useFakeTimers({ now: FAKE_NOW_MS });
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("McpOAuthProvider", () => {
+  describe("clientMetadata", () => {
+    it("authorization_code: localhost redirect, grants, response types, no scope", () => {
+      const metadata = makeProvider({ grantType: "authorization_code" }).clientMetadata;
+      expect(metadata.redirect_uris).toEqual([DEFAULT_REDIRECT]);
+      expect(metadata.grant_types).toEqual(["authorization_code", "refresh_token"]);
+      expect(metadata.response_types).toEqual(["code"]);
+      expect(metadata.client_name).toBe(SERVER_NAME);
+      expect(Object.keys(metadata)).not.toContain("scope");
+    });
+
+    it("authorization_code: scope present only when configured", () => {
+      const withScope = makeProvider({ grantType: "authorization_code", scope: "mcp tools" });
+      expect(withScope.clientMetadata.scope).toBe("mcp tools");
+
+      const withoutScope = makeProvider({ grantType: "authorization_code" });
+      expect(Object.keys(withoutScope.clientMetadata)).not.toContain("scope");
+    });
+
+    it("authorization_code: client_secret_post only with a client secret", () => {
+      expect(makeProvider({ grantType: "authorization_code" }).clientMetadata.token_endpoint_auth_method).toBe(
+        "none",
+      );
+      expect(
+        makeProvider({ grantType: "authorization_code", clientSecret: "shh" })
+          .clientMetadata
+          .token_endpoint_auth_method,
+      ).toBe("client_secret_post");
+    });
+
+    it("authorization_code: config.redirectUri wins over the default", () => {
+      const metadata = makeProvider({
+        grantType: "authorization_code",
+        redirectUri: "https://app.example.com/oauth/callback",
+      }).clientMetadata;
+      expect(metadata.redirect_uris).toEqual(["https://app.example.com/oauth/callback"]);
+    });
+
+    it("authorization_code: redirect_uris advertise the actual bound callback port", () => {
+      const metadata = makeProvider({ grantType: "authorization_code" }, {}, undefined, 43217)
+        .clientMetadata;
+      expect(metadata.redirect_uris).toEqual(["http://localhost:43217/callback"]);
+    });
+
+    it("authorization_code: client_name honors config, defaults to server name", () => {
+      expect(makeProvider({ grantType: "authorization_code" }).clientMetadata.client_name).toBe(
+        SERVER_NAME,
+      );
+      expect(
+        makeProvider({ grantType: "authorization_code", clientName: "My App" }).clientMetadata
+          .client_name,
+      ).toBe("My App");
+    });
+
+    it("client_credentials: empty redirect_uris and correct grants", () => {
+      const metadata = makeProvider({ grantType: "client_credentials" }).clientMetadata;
+      expect(metadata.redirect_uris).toEqual([]);
+      expect(metadata.grant_types).toEqual(["client_credentials"]);
+      expect(metadata.token_endpoint_auth_method).toBe("none");
+      expect(metadata.client_name).toBe(SERVER_NAME);
+    });
+
+    it("client_credentials: client_secret_post with a secret", () => {
+      expect(
+        makeProvider({ grantType: "client_credentials", clientSecret: "shh" }).clientMetadata
+          .token_endpoint_auth_method,
+      ).toBe("client_secret_post");
+    });
+  });
+
+  describe("redirectUrl", () => {
+    it("is undefined for client_credentials", () => {
+      expect(makeProvider({ grantType: "client_credentials" }).redirectUrl).toBeUndefined();
+    });
+
+    it("defaults to localhost for authorization_code (explicit and default grant type)", () => {
+      expect(makeProvider({ grantType: "authorization_code" }).redirectUrl).toBe(DEFAULT_REDIRECT);
+      expect(makeProvider({}).redirectUrl).toBe(DEFAULT_REDIRECT);
+    });
+
+    it("config.redirectUri wins when set", () => {
+      expect(
+        makeProvider({ grantType: "authorization_code", redirectUri: "https://app.example.com/cb" })
+          .redirectUrl,
+      ).toBe("https://app.example.com/cb");
+    });
+
+    it("uses the actual bound callback port (not the default) when provided", () => {
+      expect(makeProvider({ grantType: "authorization_code" }, {}, undefined, 43217).redirectUrl).toBe(
+        "http://localhost:43217/callback",
+      );
+    });
+
+    it("config.redirectUri wins over callbackPort", () => {
+      expect(
+        makeProvider(
+          { grantType: "authorization_code", redirectUri: "https://app.example.com/cb" },
+          {},
+          undefined,
+          43217,
+        ).redirectUrl,
+      ).toBe("https://app.example.com/cb");
+    });
+  });
+
+  describe("tokens round-trip", () => {
+    it("saveTokens maps expires_in to expiresAt and preserves seeded clientInfo", async () => {
+      storage.seed(SERVER_NAME, {
+        clientInfo: { clientId: "seed-client", clientSecret: "seed-secret" },
+      });
+      const provider = makeProvider({ grantType: "authorization_code" });
+
+      await provider.saveTokens({
+        access_token: "at-1",
+        token_type: "Bearer",
+        expires_in: 3600,
+        refresh_token: "rt-1",
+        scope: "mcp",
+      });
+
+      const saved = storage.entries.get(SERVER_NAME);
+      expect(saved?.tokens).toEqual({
+        accessToken: "at-1",
+        refreshToken: "rt-1",
+        expiresAt: FAKE_NOW_SECONDS + 3600,
+        scope: "mcp",
+      });
+      expect(saved?.clientInfo).toEqual({ clientId: "seed-client", clientSecret: "seed-secret" });
+      expect(storage.saveAuthEntry).toHaveBeenCalledWith(
+        SERVER_NAME,
+        expect.objectContaining({
+          clientInfo: { clientId: "seed-client", clientSecret: "seed-secret" },
+        }),
+        SERVER_URL,
+      );
+    });
+
+    it("saveTokens omits optional fields that were not provided", async () => {
+      const provider = makeProvider({ grantType: "authorization_code" });
+      await provider.saveTokens({ access_token: "at-2", token_type: "Bearer" });
+
+      const saved = storage.entries.get(SERVER_NAME);
+      expect(Object.keys(saved?.tokens ?? {})).toEqual(["accessToken"]);
+    });
+
+    it("tokens maps back with token_type Bearer and remaining expires_in", async () => {
+      storage.seed(SERVER_NAME, {
+        tokens: {
+          accessToken: "at-9",
+          refreshToken: "rt-9",
+          expiresAt: FAKE_NOW_SECONDS + 3600,
+          scope: "mcp",
+        },
+      });
+      const provider = makeProvider({ grantType: "authorization_code" });
+
+      expect(await provider.tokens()).toEqual({
+        access_token: "at-9",
+        token_type: "Bearer",
+        refresh_token: "rt-9",
+        expires_in: 3600,
+        scope: "mcp",
+      });
+    });
+
+    it("tokens returns undefined when nothing is stored", async () => {
+      expect(await makeProvider({}).tokens()).toBeUndefined();
+    });
+
+    it("tokens returns expired tokens with expires_in 0 (SDK drives the refresh)", async () => {
+      storage.seed(SERVER_NAME, {
+        tokens: { accessToken: "at-exp", expiresAt: FAKE_NOW_SECONDS - 500 },
+      });
+      expect(await makeProvider({}).tokens()).toEqual({
+        access_token: "at-exp",
+        token_type: "Bearer",
+        expires_in: 0,
+      });
+    });
+  });
+
+  describe("clientInformation", () => {
+    it("uses config.clientId without reading storage", async () => {
+      const provider = makeProvider({ grantType: "authorization_code", clientId: "cfg-client" });
+      const readsBefore = storage.getAuthEntry.mock.calls.length;
+
+      expect(await provider.clientInformation()).toEqual({ client_id: "cfg-client" });
+      expect(storage.getAuthEntry.mock.calls.length).toBe(readsBefore);
+    });
+
+    it("includes config.clientSecret when set", async () => {
+      const provider = makeProvider({
+        grantType: "authorization_code",
+        clientId: "cfg-client",
+        clientSecret: "cfg-secret",
+      });
+      expect(await provider.clientInformation()).toEqual({
+        client_id: "cfg-client",
+        client_secret: "cfg-secret",
+      });
+    });
+
+    it("falls back to stored clientInfo when config has no clientId", async () => {
+      storage.seed(SERVER_NAME, {
+        clientInfo: { clientId: "stored-client", redirectUris: ["https://app.example.com/cb"] },
+      });
+      const provider = makeProvider({ grantType: "authorization_code" });
+
+      expect(await provider.clientInformation()).toEqual({
+        client_id: "stored-client",
+        redirect_uris: ["https://app.example.com/cb"],
+      });
+    });
+
+    it("returns undefined when there is no stored client info", async () => {
+      expect(await makeProvider({ grantType: "authorization_code" }).clientInformation()).toBeUndefined();
+    });
+  });
+
+  describe("saveClientInformation", () => {
+    it("persists registered client info and preserves existing tokens", async () => {
+      storage.seed(SERVER_NAME, { tokens: { accessToken: "keep-me" } });
+      const provider = makeProvider({ grantType: "authorization_code" });
+
+      await provider.saveClientInformation({
+        client_id: "dyn-client",
+        redirect_uris: [DEFAULT_REDIRECT],
+        client_name: "pi-archimedes mcp client",
+      });
+
+      const saved = storage.entries.get(SERVER_NAME);
+      expect(saved?.clientInfo).toEqual({
+        clientId: "dyn-client",
+        redirectUris: [DEFAULT_REDIRECT],
+      });
+      expect(saved?.tokens).toEqual({ accessToken: "keep-me" });
+      expect(storage.saveAuthEntry).toHaveBeenCalledWith(
+        SERVER_NAME,
+        expect.objectContaining({
+          clientInfo: { clientId: "dyn-client", redirectUris: [DEFAULT_REDIRECT] },
+        }),
+        SERVER_URL,
+      );
+    });
+
+    it("stores the client secret when the registration response includes one", async () => {
+      const provider = makeProvider({ grantType: "authorization_code" });
+
+      await provider.saveClientInformation({
+        client_id: "dyn-client",
+        client_secret: "dyn-secret",
+        redirect_uris: [DEFAULT_REDIRECT],
+      });
+
+      expect(storage.entries.get(SERVER_NAME)?.clientInfo).toEqual({
+        clientId: "dyn-client",
+        clientSecret: "dyn-secret",
+        redirectUris: [DEFAULT_REDIRECT],
+      });
+    });
+  });
+
+  describe("codeVerifier", () => {
+    it("round-trips through storage", async () => {
+      const provider = makeProvider({ grantType: "authorization_code" });
+      await provider.saveCodeVerifier("verifier-123");
+
+      expect(storage.entries.get(SERVER_NAME)?.codeVerifier).toBe("verifier-123");
+      expect(await provider.codeVerifier()).toBe("verifier-123");
+    });
+
+    it("preserves tokens when saving the verifier", async () => {
+      storage.seed(SERVER_NAME, { tokens: { accessToken: "keep-me" } });
+      const provider = makeProvider({ grantType: "authorization_code" });
+
+      await provider.saveCodeVerifier("verifier-xyz");
+      expect(storage.entries.get(SERVER_NAME)?.tokens).toEqual({ accessToken: "keep-me" });
+    });
+
+    it("throws when no verifier has been saved", async () => {
+      const provider = makeProvider({ grantType: "authorization_code" });
+      await expect(provider.codeVerifier()).rejects.toThrow("Missing OAuth code verifier");
+    });
+  });
+
+  describe("state", () => {
+    it("returns the CSRF state when constructed with one", () => {
+      expect(makeProvider({}, {}, "csrf-42").state()).toBe("csrf-42");
+    });
+
+    it("returns an empty string without state (intentional for client_credentials)", () => {
+      expect(makeProvider({ grantType: "client_credentials" }).state()).toBe("");
+    });
+  });
+
+  describe("redirectToAuthorization", () => {
+    it("forwards the URL to onAuthorizationUrl", async () => {
+      const onAuthorizationUrl = vi.fn();
+      const provider = makeProvider({}, { onAuthorizationUrl });
+      const url = new URL("https://auth.example.com/authorize?state=abc");
+
+      await provider.redirectToAuthorization(url);
+
+      expect(onAuthorizationUrl).toHaveBeenCalledTimes(1);
+      expect(onAuthorizationUrl).toHaveBeenCalledWith(url);
+    });
+
+    it("resolves without callbacks", async () => {
+      const provider = makeProvider({});
+      await expect(
+        provider.redirectToAuthorization(new URL("https://auth.example.com/authorize")),
+      ).resolves.toBeUndefined();
+    });
+  });
+});