fix(connectors): stop the MCP OAuth wait when the user cancels sign-in by Asymtode712 · Pull Request #3055 · arc53/DocsGPT

Asymtode712 · 2026-10-10T10:57:19Z

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Bug fix.
Why was this change needed? (You can also link to an open issue here)

Closes 🐛 Bug Report: Cancelling an MCP OAuth sign-in leaves the worker waiting, so the next sign-in shows a blank popup #3051

Cancelling an MCP OAuth sign-in only reset the frontend. The worker kept waiting up to 5 minutes for a callback that would never come. On the solo pool (docsgpt worker on macOS and Windows), each cancelled attempt blocked the next sign-in, and its popup stayed blank.

Fixing that exposed a second bug. The worker caches MCP clients for 5 minutes, keyed by server, transport and user, but not by sign-in attempt. A sign-in's client carries its task id and the publisher for that task's events, so a retry within 5 minutes reused the previous attempt's client. It published mcp.oauth.awaiting_redirect under the old task id, and the new popup, listening for its own task, stayed blank.

Changes:
- Server: new POST /api/mcp_server/oauth_cancel (task_id). /mcp_server/test records who started each sign-in, and only that user can cancel it; anyone else gets a 404. Cancelling sets a per-task mark in Redis. DocsGPTOAuth stops on it: callback_handler checks it on every 1-second poll, and redirect_handler stops a sign-in cancelled while queued before it publishes the provider URL. The route has a PAT rule (tools:write, as for /mcp_server/test), and docs/data/swagger.json is regenerated.
- Client cache: MCPTool._setup_client no longer caches or reuses a client built for a sign-in task (oauth auth, an oauth_task_id, not query mode). Other clients are cached as before.
- Frontend: useMcpOAuth calls the endpoint on the wizard's Cancel, when the user starts again, and when a cancel happened while /mcp_server/test was still answering. It still ignores popup.closed, because a provider's Cross-Origin-Opener-Policy (Stripe, Sentry) makes an active sign-in look closed. Leaving the page doesn't cancel; that attempt still ends on the 5-minute timeout.
- Tests: cancel then retry in the hook (the stopped attempt's late events are ignored and the new one completes) and in the worker (a retry for the same server and user gets its own client and reaches the provider; this test fails without the cache fix). Also: a COOP provider signing in without a cancel, cancel while /mcp_server/test is in flight, starting again, ownership checks, both handlers stopping on cancel, the route, and clients without a sign-in task still being shared.
Demo:

Screen.Recording.2026-10-10.at.4.23.02.PM.mov
Other information:
- Celery's soft_time_limit isn't enforced on the solo pool, so before this fix only the 5-minute poll ended an abandoned sign-in. It still does when the cancel request fails (it is best-effort) or when the user leaves the page.
- A sign-in cancelled while queued still makes its discovery requests (the initial 401 and the metadata lookups, about a second) before it stops at redirect_handler.
- This fix doesn't need the queue-purge workaround, which also removes unrelated jobs.
- Checks: ruff check . and npm run lint (0 errors) pass, and npm run build succeeds. The frontend connector and locale tests pass, and so do tests/agents, tests/api, tests/connectors and tests/worker, except test_base_routes.py::TestCompleteStreamWalAcceptance::test_sources_found_before_the_pause_are_saved_with_it, which fails the same way on main.

Summary by CodeRabbit

New Features
- Added the ability to cancel an in-progress MCP OAuth sign-in. Cancellation is limited to the user who started it, and a new sign-in attempt is handled independently of the cancelled one.
- Updated the API reference with the OAuth cancellation endpoint.
Bug Fixes
- Cancelled sign-ins now stop waiting for authorization, and late responses from cancelled attempts are ignored.

vercel · 2026-10-10T10:57:23Z

@Asymtode712 is attempting to deploy a commit to the DocsGPT OSS Program Team on Vercel.

A member of the Team first needs to authorize it.

coderabbitai · 2026-10-10T10:57:46Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: 8946c291-5b04-462d-8425-fc82d7bd8ad7

📥 Commits

Reviewing files that changed from the base of the PR and between 09ea60b and c28d2ad.

📒 Files selected for processing (11)

docs/content/API/reference.mdx
docs/data/swagger.json
docsgpt/agents/tools/mcp_tool.py
docsgpt/api/pat/rules.py
docsgpt/api/user/tools/mcp.py
frontend/src/api/endpoints.ts
frontend/src/api/services/userService.ts
frontend/src/connectors/useMcpOAuth.test.tsx
frontend/src/connectors/useMcpOAuth.ts
tests/agents/tools/test_mcp_tool.py
tests/api/user/test_tools_mcp_pg.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

Adds an owner-checked MCP OAuth cancellation endpoint and connects it to frontend cancellation and retry handling. The backend stops callback polling for cancelled tasks, and tests cover ownership, cancellation responses, and task isolation.

Changes

MCP OAuth cancellation

Layer / File(s)	Summary
Track and stop OAuth tasks `docsgpt/agents/tools/mcp_tool.py`, `tests/agents/tools/test_mcp_tool.py`	OAuth tasks record their owners and cancellation marks. Interactive OAuth clients with task IDs are not shared. Callback handling stops for cancelled tasks. Tests cover ownership, callback cancellation, and client isolation.
Expose owner-checked cancellation `docsgpt/api/user/tools/mcp.py`, `docsgpt/api/pat/rules.py`, `docs/data/swagger.json`, `docs/content/API/reference.mdx`, `tests/api/user/test_tools_mcp_pg.py`	The MCP test endpoint registers OAuth tasks to the requesting user. The new cancellation route requires authentication and a task ID. The API rule, reference, and tests describe and verify the endpoint.
Connect frontend cancellation and retries `frontend/src/api/endpoints.ts`, `frontend/src/api/services/userService.ts`, `frontend/src/connectors/useMcpOAuth.ts`, `frontend/src/connectors/useMcpOAuth.test.tsx`	The frontend stores the active task ID and requests server-side cancellation when a sign-in is cancelled or replaced. Tests cover retry behavior, delayed task IDs, and cancellation cases.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix · Severity of issue fixed: Medium

Sequence Diagram(s)

sequenceDiagram
  participant Frontend
  participant MCPTestEndpoint
  participant MCPOAuthManager
  participant Redis
  participant OAuthCallback
  Frontend->>MCPTestEndpoint: Start connection test
  MCPTestEndpoint->>MCPOAuthManager: Register task ID and user ID
  MCPOAuthManager->>Redis: Store task owner
  Frontend->>MCPTestEndpoint: POST cancellation with task ID
  MCPTestEndpoint->>MCPOAuthManager: Cancel task for requesting user
  MCPOAuthManager->>Redis: Store cancellation marker
  OAuthCallback->>Redis: Poll cancellation marker
  Redis-->>OAuthCallback: Return cancellation marker
  OAuthCallback->>Redis: Delete authorization URL and state

Suggested reviewers: dartpain

Merge Risk: ⚪ Minimal · up to c28d2

No actionable merge-blocking issue is established; the change is ready for normal merge checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: stopping the MCP OAuth wait when the user cancels sign-in.
Linked Issues check		Issue [`#3051`] requires cancellation of an MCP OAuth sign-in to stop the server-side wait and allow a retry. The PR adds `POST /api/mcp_server/oauth_cancel`, records task ownership, and rejects cancell…
Out of Scope Changes check		The changes stay within issue [`#3051`]. The endpoint, PAT rule, Swagger update, frontend service, hook behavior, OAuth handler changes, cache isolation, and automated tests all support cancellation or …
Attached-Screenshot		The check is relevant because the PR changes the MCP OAuth sign-in UI flow. The PR description includes a demo video attachment URL, and the diff confirms the related frontend cancellation behavior in…

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

arc53-machine · 2026-10-10T11:01:27Z

A maintainer will review this; the remaining workflow runs need maintainer approval.

_{Automated triage. A maintainer will follow up.}

vercel · 2026-10-15T09:19:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
oss-docsgpt	Ready	Preview	Oct 15, 2026 9:20am UTC

codecov · 2026-10-15T09:32:15Z

Codecov Report

❌ Patch coverage is 86.44068% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.31%. Comparing base (bd36902) to head (c28d2ad).
⚠️ Report is 58 commits behind head on main.

Files with missing lines	Patch %	Lines
docsgpt/agents/tools/mcp_tool.py	86.48%	5 Missing ⚠️
docsgpt/api/user/tools/mcp.py	86.36%	3 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3055      +/-   ##
==========================================
+ Coverage   91.27%   91.31%   +0.04%     
==========================================
  Files         598      598              
  Lines       71565    71761     +196     
==========================================
+ Hits        65318    65528     +210     
+ Misses       6247     6233      -14

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

fix(connectors): stop the MCP OAuth wait when the user cancels sign-in

c28d2ad

github-actions Bot added docs frontend application Application tests Tests labels Oct 10, 2026

arc53-machine added the maintainer-review Looks ready for a maintainer label Oct 10, 2026

arc53-machine mentioned this pull request Oct 11, 2026

🐛 Bug Report: Cancelling an MCP OAuth sign-in leaves the worker waiting, so the next sign-in shows a blank popup #3051

Closed

2 tasks done

vercel Bot deployed to Preview – oss-docsgpt October 15, 2026 09:20

View deployment

dartpain approved these changes Oct 15, 2026

View reviewed changes

vercel Bot deployed to Preview – nextra-docsgpt October 15, 2026 09:30

View deployment

dartpain merged commit 94db040 into arc53:main Oct 15, 2026
20 of 21 checks passed

Navigation Menu

Repository navigation

fix(connectors): stop the MCP OAuth wait when the user cancels sign-in - #3055

fix(connectors): stop the MCP OAuth wait when the user cancels sign-in#3055
dartpain merged 1 commit into
arc53:mainfrom
Asymtode712:fix/mcp-oauth-cancel

Asymtode712 commented Oct 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Oct 10, 2026

Uh oh!

coderabbitai Bot commented Oct 10, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

arc53-machine commented Oct 10, 2026

Uh oh!

vercel Bot commented Oct 15, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 15, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Asymtode712 commented Oct 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

vercel Bot commented Oct 10, 2026

Uh oh!

coderabbitai Bot commented Oct 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

arc53-machine commented Oct 10, 2026

Uh oh!

vercel Bot commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented Oct 15, 2026

Codecov Report

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Asymtode712 commented Oct 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 10, 2026 •

edited

Loading

vercel Bot commented Oct 15, 2026 •

edited

Loading