Class McpOAuthClientProvider

src/services/mcp/McpOAuthClientProvider.ts:34–544

 *  6. `await authProvider.close()` when done (success or permanent failure)
 */
export class McpOAuthClientProvider implements OAuthClientProvider {
	// ── Static negative cache ────────────────────────────────────────────────
	// Remembers servers that returned no OAuth metadata so we can skip the
	// discovery probe on subsequent connection attempts (reconnect, restart).
	private static _nonOAuthCache = new Map<string, number>() // serverUrl → timestamp
	private static NON_OAUTH_TTL_MS = 30 * 60 * 1000 // 30 minutes

	static isKnownNonOAuth(serverUrl: string): boolean {
		const ts = McpOAuthClientProvider._nonOAuthCache.get(serverUrl)
		if (ts === undefined) return false
		if (Date.now() - ts > McpOAuthClientProvider.NON_OAUTH_TTL_MS) {
			McpOAuthClientProvider._nonOAuthCache.delete(serverUrl)
			return false
		}
		return true
	}

	static markNonOAuth(serverUrl: string): void {
		McpOAuthClientProvider._nonOAuthCache.set(serverUrl, Date.now())
	}

	static clearNonOAuthCache(serverUrl?: string): void {
		if (serverUrl) {
			McpOAuthClientProvider._nonOAuthCache.delete(serverUrl)
		} else {
			McpOAuthClientProvider._nonOAuthCache.clear()
		}
	}

	// ── Instance fields ──────────────────────────────────────────────────────
	private _codeVerifier?: string
	// Client info is kept in-memory only (not persisted) to avoid stale registrations
	// when the redirect URI port changes between sessions.
	private _clientInfo?: OAuthClientInformationFull
	private _closed = false
	private _refreshPromise: Promise<OAuthTokens> | null = null
	/** Stored by redirectToAuthorization(); opened on-demand via openBrowser(). */
	private _pendingAuthorizationUrl: URL | null = null
	/** Deduplicates concurrent _ensureCallbackServer() calls. */
	private _ensureServerPromise: Promise<void> | null = null

	private constructor(
		private readonly _serverUrl: string,
		private readonly _secretStorage: SecretStorageService,
		private _server: http.Server | null,
		private _port: number,
		private _authCodePromise: Promise<string> | null,
		private _cancelCallbackServer: (() => void) | null,
		private readonly _tokenEndpointAuthMethod: string,
		private readonly _grantTypes: string[],
		private readonly _scopes: string[],
		private readonly _state: string,
		private readonly _authServerMeta: Record<string, any> | null,
		private readonly _resourceIndicator: string | null,
		private readonly _clientName: string,
	) {}

	/**