Function forcedMcpConsent

e2e/targets/selfhost.ts:56–102

(baseUrl: string, credentials: { readonly email: string; readonly password: string })

// then POST the same `/api/auth/oauth2/consent` grant the Allow button fires.
export const forcedMcpConsent =
  (baseUrl: string, credentials: { readonly email: string; readonly password: string }) =>
  async ({ authorizationUrl }: { authorizationUrl: string }): Promise<{ code: string }> => {
    const origin = new URL(baseUrl).origin;
    const { cookieHeader } = await signInSession(baseUrl, credentials);

    const authorize = await fetch(authorizationUrl, {
      headers: { cookie: cookieHeader },
      redirect: "manual",
    });
    const location = authorize.headers.get("location");
    if (!location) {
      throw new Error(`forcedMcpConsent: authorize did not redirect (status ${authorize.status})`);
    }
    // The consent redirect is relative (`/mcp-consent?...`) — resolve it against
    // the instance origin. If the server issued a code directly (consent not
    // forced), use it; otherwise complete the forced approval below.
    const redirect = new URL(location, baseUrl);
    const direct = redirect.searchParams.get("code");
    if (direct) return { code: direct };
    const consentCode = redirect.searchParams.get("consent_code");
    if (!consentCode) {
      throw new Error(`forcedMcpConsent: no consent_code in authorize redirect: ${location}`);
    }

    const decision = await fetch(new URL("/api/auth/oauth2/consent", baseUrl), {
      method: "POST",
      headers: { "content-type": "application/json", origin, cookie: cookieHeader },
      body: JSON.stringify({ accept: true, consent_code: consentCode }),
    });
    if (!decision.ok) {
      throw new Error(`forcedMcpConsent: consent grant failed (status ${decision.status})`);
    }
    const decisionText = await decision.text();
    if (!decisionText) {
      throw new Error(
        `forcedMcpConsent: consent grant returned an empty body (status ${decision.status})`,
      );
    }
    const body = JSON.parse(decisionText) as { redirectURI?: string };
    const code = body.redirectURI ? new URL(body.redirectURI).searchParams.get("code") : null;
    if (!code) {
      throw new Error(
        `forcedMcpConsent: no code in consent redirect: ${body.redirectURI ?? "(none)"}`,
      );
    }
    return { code };
  };

// A second, distinct member of the (single) selfhost org: admin invite →
// invited email signup → Better Auth session. What multi-user scenarios use