fix(mcp): handle transient session endpoint failures without invalidating token - #1558
fix(mcp): handle transient session endpoint failures without invalidating token#1558Sruhvx-jpg wants to merge 1 commit into
Conversation
![graphite-app[bot]](https://avatars.githubusercontent.com/in/158384?s=60&v=4){kind=small}
| const authUser = isApiKey(token) | ||
| ? await validateApiKey(token, apiUrl) | ||
| : await validateOAuthToken(token, apiUrl, mcpResource) | ||
| let authUser: AuthUser | null |
There was a problem hiding this comment.
This line uses let to declare authUser, but the variable is only assigned once (inside the try block) and never reassigned afterward. According to the Variables and constants rule, you should use const by default and only use let when reassignment is needed. Since authUser is not reassigned after its initial assignment, it should be declared with const. However, because the assignment happens inside a try block, you may need to restructure the code — for example, by extracting the auth logic into a helper that returns the value, allowing const authUser = await resolveAuthUser(...) at the call site.
Spotted by Graphite (based on custom rule: TypeScript style guide (Google))
Is this helpful? React 👍 or 👎 to let us know.
…ting token - Distinguish 401/403 explicit rejection from 5xx and network failures in validateApiKey - Return 503 Service Unavailable with JSON-RPC error when authentication service is temporarily unreachable - Prevent MCP clients from dropping valid API keys during transient outages - Add unit tests for 403 status rejection and 500 error propagation Fixes supermemoryai#1551
c9f3201 to
212216f
Compare
1 participant
Description
Fixes #1551
Previously,
validateApiKeycollapsed all errors fromfetchSessionintonull, which causedhandleMcpRequestto return401 UnauthorizedwithWWW-Authenticate: Bearer error="invalid_token". This misled MCP clients into discarding valid API keys during transient backend errors (e.g. 500s, Hyperdrive blips, or timeouts) and forcing users through a browser re-auth flow.Changes
apps/mcp/src/server/auth/index.ts:nullwhen the session endpoint returns an explicit rejection (401or403).apps/mcp/src/server/index.ts:authUnavailableResponse()returning503 Service Unavailablewith JSON-RPC error code-32000and message"Authentication service unavailable"(withouterror="invalid_token").handleMcpRequestand returned the 503 response so MCP clients know to retry instead of clearing credentials.apps/mcp/src/server/auth/index.test.ts:nulland 500 status propagates the error.Verification
bun run test:unitinapps/mcp(all 23 tests passing).bun run check-types(clean, no type errors).bunx biome check apps/mcp(clean, no formatting or lint errors).