13 commits

Author	SHA1	Message	Date
Jeremiah Lowin	67527c1f69	Block unsafe OAuth redirect schemes (#4419)	2026-07-05 17:16:10 -04:00
Jeremiah Lowin	e58f386bac	Log refresh-token misses in OAuthProxy instead of failing silently (#4276)	2026-06-03 11:22:35 -04:00
Jeremiah Lowin	58e0f5320b	Decouple FastMCP access token lifetime from upstream expires_in (#4254)	2026-05-30 11:48:23 -04:00
Jeremiah Lowin	53b20168c8	Close upstream OAuth clients (#4248)	2026-05-27 19:45:45 -04:00
mohanram	0022d8518f	Add token_expiry_threshold_seconds for proactive token refresh (#4142) ... Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>	2026-05-20 10:47:26 -04:00
Jeremiah Lowin	2d6143c6d8	fix: honor upstream refresh token expiry in OAuthProxy (#3990)	2026-04-20 14:03:57 -04:00
Jeremiah Lowin	801385df44	fix: bound _refresh_locks with LRU eviction to prevent memory leak (#3968)	2026-04-18 11:07:38 -04:00
Kakarlamudi Venkata Dhanush	c642d6a5cf	fix: propagate upstream_claims in load_access_token (#3750)	2026-04-06 19:55:26 -04:00
Jeremiah Lowin	52feff6878	Transparently refresh upstream token in OAuthProxy.load_access_token() (#3584) ... * Transparently refresh upstream token in OAuthProxy.load_access_token() When upstream token validation fails during load_access_token, attempt to refresh using the stored refresh token before returning None. This prevents premature 401s that force clients into expensive full re-auth flows when the upstream token expires. Co-authored-by: Claude <noreply@anthropic.com> * Gate transparent refresh on token expiry, add advisory lock Only attempt upstream refresh when the token is actually expired, not on any validation failure (scope mismatch, revocation, etc.). Add per-token advisory lock to prevent concurrent async tasks from racing to refresh the same upstream token. * Re-check expiry inside lock, reload from storage after refresh failure --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-03-22 10:43:44 -04:00
Jeremiah Lowin	bb37c3bb6b	fix: reject refresh tokens used as Bearer access tokens (#3524)	2026-03-15 15:21:30 -04:00
Jeremiah Lowin	32dfe50f39	Treat refresh_expires_in=0 as missing, fall back to 30-day default (#3514) ... Keycloak returns refresh_expires_in=0 for offline tokens (offline_access scope), meaning "no fixed time-based expiry". The truthiness check on this value caused the proxy to skip issuing a PROXY_RT, forcing browser re-auth every hour. Closes #3509 🤖 Generated with Claude Code Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com> Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com>	2026-03-15 11:49:50 -04:00
claude[bot]	cec40b378d	Use MemoryStore for OAuth proxy tests ... Updated all OAuthProxy test instantiations to use MemoryStore instead of defaulting to DiskStore, avoiding SQLite timeout issues on Windows and improving test performance. Co-authored-by: Bill Easton <strawgate@users.noreply.github.com>	2026-02-01 02:30:05 +00:00
Jeremiah Lowin	23bfdf0680	Consolidate test fixtures and refactor large test files (#2941)	2026-01-19 15:18:35 -05:00