Repository navigation
Fix OAuth refresh resource binding and expired-token challenges - #7
Merged
Merged
Conversation
Jenik5
marked this pull request as ready for review
October 6, 2026 16:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An expired access token in 2026.10.6.1 receives HTTP 401 without
error="invalid_token", and refreshing without a repeatedresourceis rejected withinvalid_target. Accept an omitted indicator only for renewal of a valid, client-bound grant whose stored resource matches the unchanged connector origin; add the standard invalid-token challenge while preserving initial discovery. Explicit resource mismatches and refresh attempts after an origin change stay rejected.Add bounded Boolean refresh diagnostics without logging credentials or hashes. Token lifetime, rotation/replay revocation, policy permissions and session identity remain unchanged.
Validation: 100 Python tests, 5 JavaScript tests, package and JavaScript syntax checks passed locally. GitHub Validate passed on the reviewed revision. A timed HTTP test renews four times over 40 simulated minutes and keeps reading selected states in the same MCP session; security tests cover client/resource binding, restoration, expiry, replay and log privacy.
Related to #6. The rejected refresh without a resource and the incomplete challenge are reproduced server behavior, but the actual reported Grok failure still requires the reporter's logs or a live retest. The troubleshooting guide documents safe capture instructions and distinguishes token errors, HA failed-login/IP-ban handling and session recovery. This change does not close #6 as resolved. No live HA update or new release was performed.