Repository navigation
OAuth consent flow follow-ups - #9018
Merged
Merged
Conversation
added 3 commits
October 22, 2026 10:28
Also cover an MCP client using the editor scope to skip the consent page.
Every MCP code now goes through the consent page, so the read-only and all-teams fallbacks for sessions saved before tool permissions existed are no longer needed.
knolleary
self-requested a review
October 22, 2026 08:48
knolleary
approved these changes
Oct 22, 2026
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## oauth-approve-put #9018 +/- ##
=====================================================
- Coverage 79.50% 79.50% -0.01%
=====================================================
Files 475 475
Lines 26054 26052 -2
Branches 6944 6942 -2
=====================================================
- Hits 20714 20712 -2
Misses 5340 5340
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups to #9015, based on its branch so they can be merged into it.
PUT /account/reject/:codeusesverifyBrowserSession, the same asPUT /account/complete/:code.toolPermissionssaved on the consent page and no longer falls back to defaults. The fallback was only for OAuth sessions saved before tool permissions were added (Store tool permissions on MCP tokens #8686), and those expire after 5 minutes, so the test for it is removed.AccessRequest.vue) shows an error when Allow or Deny fails, for example on an expired request, matchingAccessRequestMCP.vue.Tests
scope=editorwhile logged in gets a 400 fromGET /account/complete.toolPermissionsis refused at the token endpoint.AccessRequest.spec.js: Allow and Deny follow the returned redirect, and a failed request shows the error.