Function authenticate

src/mcp/auth.ts:418–460

()

			: new SSEClientTransport(url, { authProvider: provider, requestInit })

	const authenticate = async (): Promise<void> => {
		// M2M providers (ClientCredentialsProvider, PrivateKeyJwtProvider) don't
		// need a browser — the auth() call handles token acquisition directly.
		if (!fileProvider) {
			const result = await auth(provider, { serverUrl: url })
			if (result === "REDIRECT") {
				throw new Error("M2M provider requested a browser redirect — unexpected.")
			}
			return
		}

		// Interactive flow: use the standalone auth() orchestrator.
		// If we already have valid tokens, auth() returns AUTHORIZED immediately.
		// If not, it returns REDIRECT (after calling redirectToAuthorization,
		// which opens the browser and captures the URL).
		const serverUrlStr = url.toString()
		const result = await auth(provider, { serverUrl: serverUrlStr })

		if (result === "AUTHORIZED") return // tokens are valid

		// REDIRECT: the provider's redirectToAuthorization was called, which
		// captured the auth URL and opened the browser. Surface it to the TUI.
		const authUrl = fileProvider.getAuthUrl()
		if (intercept && authUrl) intercept.onAuthUrl(authUrl)

		// Start the callback server (the browser redirect may arrive here).
		const callbackServer = startCallbackServer(callbackPort!, (code) => fileProvider.resolveCode(code))

		try {
			let code: string
			if (intercept) {
				// Interactive: race the callback against a manual paste.
				code = await Promise.race([intercept.getCode(), fileProvider.waitForCode()])
			} else {
				code = await fileProvider.waitForCode()
			}

			// Exchange the code for tokens via the standalone auth() call.
			await auth(provider, { serverUrl: serverUrlStr, authorizationCode: code })
		} finally {
			callbackServer.close()
		}
	}

	return { transport, authenticate, provider: fileProvider }
}