rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accept OAuth access tokens on MCP API

Browse Source 
Manual OAuth bearer tokens worked on Console and Connect but
were rejected by MCP, which only ran the personal API key
middleware. Align MCP with the shared bearer chain used
elsewhere: API key, OAuth access token, then identity
presence. Drop the local RequireAPIKeyHandler.

Add e2e coverage for MCP calls authenticated with a manual
OAuth token, including scope enforcement.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-18 22:39:14 +02:00
parent fdf5188707
commit 0256babc9d
4 changed files with 96 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
e2e/internal/testutil/mcp.go
View File

@@ -63,15 +63,49 @@ func (c *Client) CreateAPIKey(name string) string {
return result.CreatePersonalAPIKey.Token
}
// CreateOAuth2AccessToken creates a manual OAuth access token via the connect GraphQL API.
// It returns the raw bearer token string.
func (c *Client) CreateOAuth2AccessToken(name string, scopes []string) string {
const query = `
mutation($input: CreateOAuth2AccessTokenInput!) {
createOAuth2AccessToken(input: $input) {
token
}
}
`
var result struct {
CreateOAuth2AccessToken struct {
Token string `json:"token"`
} `json:"createOAuth2AccessToken"`
}
err := c.ExecuteConnect(query, map[string]any{
"input": map[string]any{
"name": name,
"expiresAt": time.Now().Add(90 * 24 * time.Hour).UTC().Format(time.RFC3339),
"scopes": scopes,
},
}, &result)
require.NoError(c.T, err, "createOAuth2AccessToken failed")
require.NotEmpty(c.T, result.CreateOAuth2AccessToken.Token, "OAuth access token is empty")
return result.CreateOAuth2AccessToken.Token
}
// NewMCPClient creates an MCP client authenticated with an API key.
// It initializes an MCP session and stores the session ID.
func NewMCPClient(t require.TestingT, owner *Client) *MCPClient {
token := owner.CreateAPIKey("e2e-mcp-test")
return NewMCPClientWithAccessToken(t, owner, owner.CreateAPIKey("e2e-mcp-test"))
}
// NewMCPClientWithAccessToken creates an MCP client authenticated with a bearer token.
// It initializes an MCP session and stores the session ID.
func NewMCPClientWithAccessToken(t require.TestingT, owner *Client, accessToken string) *MCPClient {
mc := &MCPClient{
t: t,
baseURL: owner.BaseURL() + "/mcp/v1",
apiToken: token,
apiToken: accessToken,
httpClient: &http.Client{
Timeout: 30 * time.Second,
},