Repository navigation
Conversation
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
The fix works. I ran the #58319 reproduction (a mock OAuth/MCP server whose token responses leave out scope) against both checkouts from source. On the base, an expired token gets 403 insufficient_scope, no refresh follows, and the server shows needs authentication. With this change, the same 403 is followed by a refresh_token request and the server reconnects. The new tests fail on the base and pass with the fix; the OAuth suite passed 5 more runs in a row, and typecheck:tsc passes.
Public API: unchanged. The stored credential's metadata.scope is now filled in when the provider leaves scope out, using the existing field.
One limitation worth noting: credentials saved before this change have no stored scope, and a refresh only falls back to the previously stored one. Affected users will still hit the re-login once after upgrading; after that, the stored scope is kept. That's acceptable, but worth a line in the release notes.
The new table-driven test is long (about 160 lines) for what it checks, but it is deterministic: expiry is forced through the stored credential, with no sleeps.
Issue for this PR
Fixes #58319
Type of change
What does this PR do?
Preserves the requested scope when an OAuth provider omits
scopefrom its token response, as specified by RFC 6749 §5.1. Without it, the MCP SDK treats aninsufficient_scopechallenge as a scope expansion and skips the stored refresh token.The fallback comes from the actual authorization URL, so it includes scopes selected from server metadata and any
offline_accessadded by the SDK. Refresh responses withoutscoperetain the previously granted scope. An explicitly returned scope, including an empty string, remains authoritative.Adds regression coverage using a local OAuth/resource server and the real MCP HTTP transport. The tests cover configured, challenged and discovered scopes, repeated refreshes after expiry, explicit response scopes, and genuine scope expansion still requiring authorization.
How did you verify your code works?
bun typecheckandbun run typecheck:tscinpackages/corepassed.bun run checkpassed with Bun 1.4.4. On Windows, I temporarily materialized the app's existing declaration-file symlink for this check; that setup change is not included in the PR.I have not tested against a live Cognito deployment.
Screenshots / recordings
Not applicable; no UI changes.
Checklist
Added by the opencode bot (AI-generated).
Related: #49773, #53942