Repository navigation
Reject expired or revoked MCP authority after delayed validation - #48
Merged
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A request held during account validation could start a new MCP board read after its grant was revoked. Delayed single-use consumption could also issue a code or token after the consumed record expired. Recheck token, grant and account validity after awaited account resolution, and recheck consumed records after the last required read before creating new authority. SQL consumption now requires
expires_at > clock_timestamp()in the same atomic DELETE; valid concurrent consumption still has exactly one winner.This protects the recorded authorization decisions. It does not cancel or roll back a tool or SQL write already dispatched, or promise linearizable revocation across systems. A code issued for an already-expired account was already unusable; rejecting that issuance also makes its acknowledgement accurate.
Validation: actual runtime/SDK HTTP/SQL regression fixtures pass all 16 cases, including zero board dispatch after held revocation or expiry, delayed code/grant issuance, transaction-start versus current SQL time, and valid/concurrent controls. The 22 focused native OAuth/store/plugin cases pass on Node 20 and Node 22; strict MCP/API types and scoped lint pass. The repaired combined app/API gate passes all 989 tests across 47 files once on Node 20.20.2, with zero retries; types, scoped lint and original-config build pass. An earlier combined run had 981 passes and one Account sign-out failure. That outcome remains preserved, and PR46 separately fixes a phase-controlled owner-reset race with seven before/after regressions; the earlier uninstrumented failure is consistent with that race rather than uniquely attributed to it.. Exact-head full CI is required before merge. Recorded before/after and fixture setup evidence.
Four fresh compiled setup/consent cases pass on desktop/mobile after integrating the sign-out and toolbar fixes. The four captures below are actual disposable browser fixtures from the frozen final app, with published exact-head hashes verified. They validate the inherited connector UI around this backend change. Three fresh toolbar geometry checks also pass. Combined gate and compiled browser evidence.