Method finish_auth

crates/opencode-mcp/src/oauth.rs:169–221

Complete the authorization flow by exchanging the authorization code for tokens.

(&self, code: &str, state: &str)

    /// Complete the authorization flow by exchanging the authorization code
    /// for tokens.
    pub async fn finish_auth(&self, code: &str, state: &str) -> Result<(), OAuthError> {
        // Recover verifier + expected state.
        let (verifier_secret, expected_state) = {
            let pending = self.pending.read().await;
            match pending.as_ref() {
                Some(p) => (p.pkce_verifier.clone(), p.csrf_state.clone()),
                None => {
                    let entry = auth::get(&self.mcp_name)
                        .await
                        .ok_or(OAuthError::NoPendingAuth)?;
                    let v = entry.code_verifier.ok_or(OAuthError::NoPendingAuth)?;
                    let s = entry.oauth_state.ok_or(OAuthError::NoPendingAuth)?;
                    (v, s)
                }
            }
        };

        if state != expected_state {
            return Err(OAuthError::StateMismatch);
        }

        let (client_id, client_secret, auth_url, token_url, redirect_url) = self.parsed_config()?;

        let mut client = oauth2::basic::BasicClient::new(client_id)
            .set_auth_uri(auth_url)
            .set_token_uri(token_url)
            .set_redirect_uri(redirect_url);

        if let Some(secret) = client_secret {
            client = client.set_client_secret(secret);
        }

        let http_client = reqwest::Client::new();

        let token_result = client
            .exchange_code(AuthorizationCode::new(code.to_string()))
            .set_pkce_verifier(PkceCodeVerifier::new(verifier_secret))
            .request_async(&http_client)
            .await
            .map_err(|e| OAuthError::TokenExchange(e.to_string()))?;

        self.save_token_result(&token_result).await?;

        // Clean up transient state.
        auth::clear_code_verifier(&self.mcp_name).await.ok();
        auth::clear_oauth_state(&self.mcp_name).await.ok();
        {
            let mut pending = self.pending.write().await;
            *pending = None;
        }

        Ok(())
    }
    /// Refresh an expired access token using the stored refresh token.
    pub async fn refresh_token(&self) -> Result<(), OAuthError> {
        let entry = auth::get_for_url(&self.mcp_name, &self.server_url)