fix(connect): surface OIDC device-flow URL and code from connect tool#1270
Open
KyriosGN0 wants to merge 1 commit into
Open
fix(connect): surface OIDC device-flow URL and code from connect tool#1270KyriosGN0 wants to merge 1 commit into
KyriosGN0 wants to merge 1 commit into
Conversation
For OIDC connection strings, MCPConnectionManager.connect() returns a `connecting` state immediately — before the device-flow callback has populated the verification URL and user code. The connect tool ignored that state and always reported "Successfully connected to MongoDB.", so the device-flow URL+code only surfaced later when the first data operation failed with NotConnectedToMongoDB. Make the connect tool wait for the OIDC attempt to make progress and return the verification URL+code directly when a device flow is reported, so the user is asked to authenticate up front instead of after a failing data op. - Add waitForConnectResult: a platform-independent helper that resolves on the first of device-flow notification / success / error / timeout. Kept dependency-free so it is unit-testable on any platform (the real OIDC integration path is Linux-only). - Extract the device-flow message into oidcDeviceFlowMessage so the connect tool and connectionErrorHandler share one wording. - Add unit tests for the wait helper and assert the connect tool's own response carries the URL+code in the Linux device-flow integration test. Fixes mongodb-js#1269 Signed-off-by: AvivGuiser <avivguiser@gmail.com>
KyriosGN0
force-pushed
the
fix/oidc-device-flow-connect-1269
branch
from
633d83a to
441e2d3
Compare
Contributor
Author
|
hey @ciprian-tibulca, could you have a look here? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Fixes #1269.
For OIDC connection strings,
MCPConnectionManager.connect()returns aconnectingstate immediately — before the device-flow callback has populated the verification URL and user code. Theconnecttool ignored that state and always returned"Successfully connected to MongoDB.", so the device-flow URL + user code only surfaced later, when the first data operation (e.g.list-databases) failed withNotConnectedToMongoDBand the connection-error handler appended them. From an MCP client's perspective the tool claimed success, then the next call failed asking the user to authenticate.This change makes the
connecttool wait for the OIDC attempt to make progress and return the verification URL + user code directly when a device flow is reported, so the user is asked to authenticate up front.Changes
src/common/waitForConnectResult.ts(new) — a platform-independent helper that subscribes to the connection-manager events and resolves on the first of: device-flow notification / connection success / error / timeout. It resolves as soon as the device-flow URL+code are known (rather than waiting for success, at which point the user hasn't authenticated yet), and re-checks the current state immediately after subscribing to close the subscribe race. Kept free of any MongoDB/transport dependency so it can be unit-tested on any platform (the real OIDC integration path is Linux-only).src/tools/mongodb/connect/connect.ts— afterconnectToMongoDB, if stillconnecting, wait via the helper and return the URL+code on a device flow. Aconnectedstate short-circuits to the existing success message;errored/timed-outpreserve the prior behavior. The device-flow message is returned as guidance (notisError).src/common/oidcDeviceFlowMessage.ts(new) — extracts the device-flow instruction text so theconnecttool andconnectionErrorHandlershare one wording and can't drift.src/common/connectionErrorHandler.ts— use the shared message helper.connecttool's own response carries the URL+code.Verification
pnpm run check:types,check:lint,check:format,build,check:dependencies, andcheck:apiall pass. Full unit suite passes (961 tests, including 6 new). OIDC integration tests are Linux-only (skipIf(platform !== 'linux')); the wait logic is covered by platform-independent unit tests.Checklist