Function buildAuthProvider

src/mcp/auth.ts:319–352

(
	serverName: string,
	oauth: McpOAuthConfig,
)

/** Build an OAuthClientProvider from an McpOAuthConfig. Returns the provider
 *  plus a callback-port hint (for the interactive flow). */
export function buildAuthProvider(
	serverName: string,
	oauth: McpOAuthConfig,
): { provider: OAuthClientProvider; callbackPort?: number } {
	// M2M: client_credentials grant (no browser).
	if (typeof oauth === "object" && "grantType" in oauth && oauth.grantType === "client_credentials") {
		return {
			provider: new ClientCredentialsProvider({
				clientId: oauth.clientId,
				clientSecret: oauth.clientSecret,
				scope: oauth.scope,
				clientName: "OrbCode CLI",
			}),
		}
	}

	// M2M: private_key_jwt assertion (no browser).
	if (typeof oauth === "object" && "grantType" in oauth && oauth.grantType === "private_key_jwt") {
		return {
			provider: new PrivateKeyJwtProvider({
				clientId: oauth.clientId,
				privateKey: oauth.privateKey,
				algorithm: oauth.algorithm,
				scope: oauth.scope,
				clientName: "OrbCode CLI",
			}),
		}
	}

	// Interactive authorization-code flow (browser redirect).
	const scope = typeof oauth === "object" ? oauth.scope : undefined
	const port = ephemeralPort()
	return { provider: new FileOAuthProvider(serverName, port, scope), callbackPort: port }
}

/** True if the config requests OAuth (vs. static headers). */
export function hasOAuth(config: { oauth?: McpOAuthConfig }): boolean {