Method start_auth

crates/opencode-mcp/src/oauth.rs:127–166

Start the authorization flow. Returns the URL the user should open in a browser. The PKCE verifier and CSRF state are persisted both in-memory and on disk so that `finish_auth` can complete the exchange even after a process restart.

(&self)

    /// and CSRF state are persisted both in-memory and on disk so that
    /// `finish_auth` can complete the exchange even after a process restart.
    pub async fn start_auth(&self) -> Result<String, OAuthError> {
        let (client_id, client_secret, auth_url, token_url, redirect_url) = self.parsed_config()?;

        let mut client = oauth2::basic::BasicClient::new(client_id)
            .set_auth_uri(auth_url)
            .set_token_uri(token_url)
            .set_redirect_uri(redirect_url);

        if let Some(secret) = client_secret {
            client = client.set_client_secret(secret);
        }

        let (pkce_challenge, pkce_verifier) = PkceCodeChallenge::new_random_sha256();

        let mut auth_request = client.authorize_url(CsrfToken::new_random);
        for scope in &self.config.scopes {
            auth_request = auth_request.add_scope(Scope::new(scope.clone()));
        }

        let (url, csrf_state) = auth_request.set_pkce_challenge(pkce_challenge).url();

        // Persist to disk for cross-restart resilience.
        auth::update_code_verifier(&self.mcp_name, pkce_verifier.secret())
            .await
            .map_err(OAuthError::Storage)?;
        auth::update_oauth_state(&self.mcp_name, csrf_state.secret())
            .await
            .map_err(OAuthError::Storage)?;

        // Also keep in memory for the fast path.
        {
            let mut pending = self.pending.write().await;
            *pending = Some(PendingAuth {
                pkce_verifier: pkce_verifier.secret().clone(),
                csrf_state: csrf_state.secret().clone(),
            });
        }

        Ok(url.to_string())
    }
    /// Complete the authorization flow by exchanging the authorization code
    /// for tokens.
    pub async fn finish_auth(&self, code: &str, state: &str) -> Result<(), OAuthError> {