thoughtspot / mcp-server / 40625874770

91%

push

github

fix(oauth): send only the auth state ID from the callback page (#214)

SCAL-341127

Bump @thoughtspot/mcp-auth to 3.0.0, which keeps the OAuth request and
instance URL server-side and passes only an opaque state ID through the
browser.

Update the OAuth callback page to match: read { state, instanceUrl }
from the server-rendered #oauth-flow JSON block and post
{ token, state } to /store-token. Check the /store-token status before
parsing so the server's error message is shown. Add tests for the
callback page covering these paths.

Document OAUTH_ALLOW_INSECURE_DEV_COOKIE for local OAuth testing over
plain HTTP on non-localhost hosts.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

1788 of 2027 branches covered (88.21%)

Branch coverage included in aggregate %.

3009 of 3231 relevant lines covered (93.13%)

1679.99 hits per line