Function createAuthTransport

src/mcp/auth.ts:402–463

(
	serverName: string,
	url: URL,
	kind: "http" | "sse",
	oauth: McpOAuthConfig,
	requestInit: RequestInit,
	intercept?: AuthIntercept,
)

 *  and how the code is obtained (TUI with copy + paste fallback). When omitted,
 *  the flow auto-waits for the loopback callback server (headless mode). */
export function createAuthTransport(
	serverName: string,
	url: URL,
	kind: "http" | "sse",
	oauth: McpOAuthConfig,
	requestInit: RequestInit,
	intercept?: AuthIntercept,
): AuthTransport {
	const { provider, callbackPort } = buildAuthProvider(serverName, oauth)
	const fileProvider = provider instanceof FileOAuthProvider ? provider : undefined

	const transport =
		kind === "http"
			? new StreamableHTTPClientTransport(url, { authProvider: provider, requestInit })
			: new SSEClientTransport(url, { authProvider: provider, requestInit })

	const authenticate = async (): Promise<void> => {
		// M2M providers (ClientCredentialsProvider, PrivateKeyJwtProvider) don't
		// need a browser — the auth() call handles token acquisition directly.
		if (!fileProvider) {
			const result = await auth(provider, { serverUrl: url })
			if (result === "REDIRECT") {
				throw new Error("M2M provider requested a browser redirect — unexpected.")
			}
			return
		}

		// Interactive flow: use the standalone auth() orchestrator.
		// If we already have valid tokens, auth() returns AUTHORIZED immediately.
		// If not, it returns REDIRECT (after calling redirectToAuthorization,
		// which opens the browser and captures the URL).
		const serverUrlStr = url.toString()
		const result = await auth(provider, { serverUrl: serverUrlStr })

		if (result === "AUTHORIZED") return // tokens are valid

		// REDIRECT: the provider's redirectToAuthorization was called, which
		// captured the auth URL and opened the browser. Surface it to the TUI.
		const authUrl = fileProvider.getAuthUrl()
		if (intercept && authUrl) intercept.onAuthUrl(authUrl)

		// Start the callback server (the browser redirect may arrive here).
		const callbackServer = startCallbackServer(callbackPort!, (code) => fileProvider.resolveCode(code))

		try {
			let code: string
			if (intercept) {
				// Interactive: race the callback against a manual paste.
				code = await Promise.race([intercept.getCode(), fileProvider.waitForCode()])
			} else {
				code = await fileProvider.waitForCode()
			}

			// Exchange the code for tokens via the standalone auth() call.
			await auth(provider, { serverUrl: serverUrlStr, authorizationCode: code })
		} finally {
			callbackServer.close()
		}