🔐 fix: Reuse MCP OAuth Authorization URL#13532
Conversation
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
Pull request overview
This PR fixes MCP OAuth initiation so the original PKCE verifier/challenge (and corresponding authorization request) is preserved by reusing a previously generated authorizationUrl for still-pending flows, and by persisting regenerated OAuth metadata when the route falls back to generating a new authorization request.
Changes:
- Reuse a stored
authorizationUrlfor freshPENDINGflows and reject stale/completed/mismatched flow states before redirecting. - Persist regenerated OAuth flow metadata (including the new
authorizationUrl) and clean up old state mappings when a new authorization request is generated. - Add route-level regression tests for stored URL reuse, completed-flow rejection, and metadata persistence/state mapping cleanup.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| api/server/routes/mcp.js | Reworks /oauth/initiate flow validation and persists/reuses authorization URLs + state mappings. |
| api/server/routes/tests/mcp.spec.js | Adds coverage for stored authorization URL reuse and regenerated metadata/state-mapping behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
GitNexus: 🚀 deployedThe |
* fix: reuse MCP OAuth authorization URL * fix: validate MCP OAuth initiate flow ID
Summary
I fixed the MCP OAuth initiate route so it preserves the PKCE verifier/challenge pair created when the flow starts, and hardened the route against foreign or malformed flow IDs.
authorizationUrlfor a fresh pending MCP OAuth flow instead of generating a second authorization request./oauth/initiate.userIdandflowIdquery values before loading flow state, and requireflowIdto match the authenticated user and server.Change Type
Testing
npm run build:data-provider && npm run build:data-schemas && npm run build:api.npx eslint api/server/routes/mcp.js api/server/routes/__tests__/mcp.spec.js.cd api && npx jest server/routes/__tests__/mcp.spec.js --runInBand.cd packages/api && npx jest src/mcp/__tests__/MCPConnectionFactory.test.ts --runInBand --coverage=false.Test Configuration:
Checklist