This repository was archived by the owner on Oct 17, 2026. It is now read-only.
Repository navigation
fix(mcp): OAuth token in connection tests, 502 for OAuth errors, optional session id - #1
Open
kelvinymoura wants to merge 3 commits into
Conversation
POST /api/mcp/test-connection connected without the token stored by the OAuth login, so after a successful login the Tools page kept reporting "authentication required" even though agent sessions already sent the bearer. The connection test service now takes the same IMcpAccessTokenProvider the session build uses and adds `Authorization: Bearer <token>` to HTTP and SSE tests through apply_bearer_header, leaving an Authorization header configured by the user untouched. The app wires the shared McpOAuthService into it.
McpError::OAuth maps to ApiError::Internal, so a server that publishes no OAuth metadata, or a rejected dynamic client registration, reached the user as a generic "Internal server error.". Discovery failures now raise McpError::OAuthDiscovery and RFC 7591 registration failures McpError::OAuthRegistration. Both map to 502 with the codes MCP_OAUTH_DISCOVERY_FAILED and MCP_OAUTH_REGISTRATION_FAILED and keep their message; a rejected registration carries the authorization server's own error body. The discovery variant follows the mapping introduced in iOfficeAI#988.
The live OAuth test panicked against stateless streamable HTTP servers, such as https://mcp.cloudflare.com/mcp, that never return an Mcp-Session-Id. The header is optional in the streamable HTTP transport, so the test now echoes it only when initialize returned one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to iOfficeAI#1029, fixing three gaps found while testing the OAuth login end to end against https://mcp.cloudflare.com/mcp.
POST /api/mcp/test-connectionnow authenticates HTTP/SSE tests with the stored token viaIMcpAccessTokenProvider+apply_bearer_header, like session builds, without overriding a user-configuredAuthorizationheader. The Tools page no longer reports "authentication required" after a successful login.MCP_OAUTH_DISCOVERY_FAILED/MCP_OAUTH_REGISTRATION_FAILEDwith the real message; registration passes through the server's RFC 7591 error body. The discovery variant follows fix(mcp): discover OAuth endpoints per spec and support dynamic client registration iOfficeAI/AionCore#988.Mcp-Session-Id.oauth_live_manualechoes it only when the server returns one; stateless streamable HTTP servers such as Cloudflare's send none.Testing: new
connection_test_oauth_integration.rs(bearer-protected fake MCP server: no token → needs auth, stored token → lists tools, user header wins, no cross-user token, SSE presents the token), newmcp_e2ecases (connection test before/after storing a token; discovery failure → 502), and error-mapping unit tests. On Windows:cargo fmt --check, clippy-D warningsforaionui-mcpandaionui-app(lib +mcp_e2e),cargo test -p aionui-mcp -p aionui-ai-agentandcargo test -p aionui-app --test mcp_e2e. Pre-existing Unix-only tests and lints inaionui-ai-agentand the stdio cases inconnection_test_integrationfail on Windows independently of this change.Live, against https://mcp.cloudflare.com/mcp:
oauth_live_manualpassed (discovery, dynamic client registration, authenticatedinitialize→ 200,tools/list→ 4 tools; the server returned noMcp-Session-Id), and in AionUi's Tools page, running on this branch's backend, the connection test succeeded after the OAuth login and listed the tools, with no "authentication required" state left.