fix: keep request pending during OAuth redirect and fix e2e tests

* StreamableHTTPClientTransport._send and _startOrAuthSse now wait for finishAuth() rather than rejecting immediately with UnauthorizedError when a REDIRECT occurs.
* Refactored OAuth test suite to support asynchronous redirect flows. Tests now hang gracefully during REDIRECT, waiting for finishAuth() rather than asserting immediate rejections.
* Updated simpleOAuthClient example to accurately reflect the new asynchronous flow.
* Fixed sporadic vitest timeouts and FakeTimers leakage by properly managing unhandled transport promises during tests.

Author: GhagSagar23

examples/oauth/client.ts

@@ -96,6 +96,11 @@ const client = new Client(
 // `redirectToAuthorization` — in `simpleOAuthClient.ts` that opens a browser;
 // here we just capture it.
 let capturedAuthorizationUrl: URL | undefined;
+let urlCapturedCallback: () => void;
+const urlCapturedPromise = new Promise<void>(resolve => {
+    urlCapturedCallback = resolve;
+});
+
 const clientMetadata: OAuthClientMetadata = {
     client_name: 'Headless OAuth MCP Client (CI)',
     redirect_uris: [CALLBACK_URL],
@@ -106,24 +111,20 @@ const clientMetadata: OAuthClientMetadata = {
 };
 const provider = new InMemoryOAuthClientProvider(CALLBACK_URL, clientMetadata, authUrl => {
     capturedAuthorizationUrl = authUrl;
+    urlCapturedCallback();
 });
 
 const firstTransport = new StreamableHTTPClientTransport(new globalThis.URL(url), { authProvider: provider });
-let challenged = false;
-try {
-    await client.connect(firstTransport);
-} catch (error) {
-    // Both `--legacy` and `mode: 'auto'` surface the original
-    // `UnauthorizedError` directly (the negotiation probe propagates it
-    // unchanged; older releases wrapped it as the `data.cause` of an
-    // EraNegotiationFailed `SdkError`, which the unwrap below still
-    // tolerates). Either way the auth driver has already run by the time we
-    // land here — DCR done, auth URL captured.
-    const root = error instanceof UnauthorizedError ? error : (error as { data?: { cause?: unknown } }).data?.cause;
-    if (!(root instanceof UnauthorizedError)) throw error;
-    challenged = true;
-}
-check.ok(challenged, 'first connect must 401 and throw UnauthorizedError');
+const connectPromise = client.connect(firstTransport).catch(error => {
+    // Both `--legacy` and `mode: 'auto'` surfaced the original
+    // `UnauthorizedError` directly before the pending contract change.
+    // Now they should just succeed after finishAuth completes!
+    throw error;
+});
+
+// Give the async connect time to hit the auth wall and trigger the callback
+await urlCapturedPromise;
+
 check.ok(capturedAuthorizationUrl, 'SDK auth driver should have produced an authorization URL');
 check.ok(provider.clientInformation()?.client_id, 'dynamic client registration should have run');
 
@@ -139,6 +140,9 @@ const callbackParams = await followAuthorizationRedirects(capturedAuthorizationU
 // (+ PKCE `code_verifier`) to the AS `/token` endpoint and saves the tokens
 // on `provider`.
 await firstTransport.finishAuth(callbackParams);
+
+// The original connect should now complete!
+await connectPromise;
 const tokens = provider.tokens();
 check.ok(tokens?.access_token, 'token exchange should have yielded an access_token');
 check.equal(tokens?.token_type, 'Bearer');

examples/oauth/simpleOAuthClient.ts

@@ -136,32 +136,14 @@ class InteractiveOAuthClient {
         });
     }
 
-    private async attemptConnection(oauthProvider: InMemoryOAuthClientProvider): Promise<void> {
-        console.log('🚢 Creating transport with OAuth provider...');
-        const baseUrl = new URL(this.serverUrl);
-        const transport = new StreamableHTTPClientTransport(baseUrl, {
-            authProvider: oauthProvider
-        });
-        console.log('🚢 Transport created');
-
+    private async attemptConnection(transport: StreamableHTTPClientTransport): Promise<void> {
         try {
             console.log('🔌 Attempting connection (this will trigger OAuth redirect)...');
             await this.client!.connect(transport);
             console.log('✅ Connected successfully');
         } catch (error) {
-            if (error instanceof UnauthorizedError) {
-                console.log('🔐 OAuth required - waiting for authorization...');
-                const callbackParams = await this.waitForOAuthCallback();
-                // Pass the whole callback query — the SDK extracts `code` and validates
-                // `iss` against the recorded issuer (RFC 9207) before exchanging the code.
-                await transport.finishAuth(callbackParams);
-                console.log('🔐 Authorization code received:', callbackParams.get('code'));
-                console.log('🔌 Reconnecting with authenticated transport...');
-                await this.attemptConnection(oauthProvider);
-            } else {
-                console.error('❌ Connection failed with non-auth error:', error);
-                throw error;
-            }
+            console.error('❌ Connection failed:', error);
+            throw error;
         }
     }
 
@@ -180,18 +162,35 @@ class InteractiveOAuthClient {
             token_endpoint_auth_method: 'client_secret_post'
         };
 
+        let currentTransport: StreamableHTTPClientTransport;
+
         console.log('🔐 Creating OAuth provider...');
         const oauthProvider = new InMemoryOAuthClientProvider(
             CALLBACK_URL,
             clientMetadata,
             (redirectUrl: URL) => {
                 console.log(`📌 OAuth redirect handler called - opening browser`);
                 console.log(`Opening browser to: ${redirectUrl.toString()}`);
+                
+                console.log('🔐 OAuth required - waiting for authorization...');
+                this.waitForOAuthCallback().then(async callbackParams => {
+                    console.log('🔐 Authorization code received:', callbackParams.get('code'));
+                    await currentTransport.finishAuth(callbackParams);
+                    console.log('🔌 Authentication complete!');
+                }).catch(err => {
+                    console.error("❌ OAuth flow failed:", err);
+                });
+
                 this.openBrowser(redirectUrl.toString());
             },
             this.clientMetadataUrl
         );
         console.log('🔐 OAuth provider created');
+        
+        const baseUrl = new URL(this.serverUrl);
+        currentTransport = new StreamableHTTPClientTransport(baseUrl, {
+            authProvider: oauthProvider
+        });
 
         console.log('👤 Creating MCP client...');
         this.client = new Client(
@@ -205,7 +204,7 @@ class InteractiveOAuthClient {
 
         console.log('🔐 Starting OAuth flow...');
 
-        await this.attemptConnection(oauthProvider);
+        await this.attemptConnection(currentTransport);
 
         // Start interactive loop
         await this.interactiveLoop();

packages/client/src/client/streamableHttp.ts

@@ -616,7 +616,17 @@ export class StreamableHTTPClientTransport implements Transport {
                             { scope, resourceMetadataUrl, errorDescription, statusText: response.statusText, text },
                             stepUpRetries
                         );
-                        if (result !== 'AUTHORIZED') {
+                        if (result === 'REDIRECT') {
+                            if (!this._pendingAuthPromise) {
+                                this._pendingAuthPromise = new Promise<void>((resolve, reject) => {
+                                    this._authResolve = resolve;
+                                    this._authReject = reject;
+                                });
+                                this._pendingAuthPromise.catch(() => {});
+                            }
+                            await this._pendingAuthPromise;
+                            return this._startOrAuthSse(options, isAuthRetry, stepUpRetries + 1);
+                        } else if (result !== 'AUTHORIZED') {
                             throw markAuthSeamEscape(new UnauthorizedError());
                         }
                         return this._startOrAuthSse(options, isAuthRetry, stepUpRetries + 1);
@@ -1124,7 +1134,17 @@ export class StreamableHTTPClientTransport implements Transport {
                             { scope, resourceMetadataUrl, errorDescription, statusText: response.statusText, text },
                             stepUpRetries
                         );
-                        if (result !== 'AUTHORIZED') {
+                        if (result === 'REDIRECT') {
+                            if (!this._pendingAuthPromise) {
+                                this._pendingAuthPromise = new Promise<void>((resolve, reject) => {
+                                    this._authResolve = resolve;
+                                    this._authReject = reject;
+                                });
+                                this._pendingAuthPromise.catch(() => {});
+                            }
+                            await this._pendingAuthPromise;
+                            return this._send(message, options, isAuthRetry, stepUpRetries + 1);
+                        } else if (result !== 'AUTHORIZED') {
                             throw markAuthSeamEscape(new UnauthorizedError());
                         }
                         return this._send(message, options, isAuthRetry, stepUpRetries + 1);