Patrick Buckley
e5f8453e1a
fix(mcp): complete oauth_obo revocation lifecycle + fix hot-path regression (follow-up review)
...
Addresses the high follow-up review of the first fix round:
Revocation lifecycle (the review's dominant theme):
- identity-unlink now purges the user's minted obo cache rows in addition
to revoking the credential, and the response/audit report the actual
effect (credential + N cache rows) instead of a blanket revoked=true;
warmed-session residual (bounded by token TTL) documented
- bulk-revoke on obo is now an honest cache-FLUSH: distinct audit event
(obo_cache_flushed) + response effect=cache_flush_remints, since the
shared credential survives and the next dispatch re-mints (oauth_user
keeps its durable revoke semantics)
- changing oauth_audience on a pool-backed row now purges cached tokens
(audience is the token binding), like URL/name/auth_type changes
- flipping oauth_user->oauth_obo now clears the stale AS-consent scopes
(else rfc8693 sends them -> invalid_scope loop); write path rejects
oauth_scopes under the entra profile (it mints <audience>/.default)
- a cache row bearing a refresh token is never served as an obo token
(guards the cross-node purge-vs-refresh race)
Self-inflicted regression:
- _clear_pending_consent_sync is now gated on an in-memory
_pending_consent_written hint, so the common successful-dispatch path
issues ZERO SQL (was an unconditional per-dispatch DELETE)
Observability + cleanups:
- restore the obo_mint_rejected log carrying the IdP error text (the
shared-helper unification dropped it); event names passed as whole
literals so alerting can grep them
- persist_rotation typed Callable[[str], Awaitable[None]] (was Any)
- _prime_one branches on _obo_server_names (no pre-lookup SQL for
oauth_user)
- removed now-dead any_oauth_user_mcp_servers (3 impls + tests)
+13 regression tests. Full mcp/oidc/console suite 1888 green; mypy clean.
Refs #551 .
2026-07-12 19:03:35 -07:00
..
2026-07-10 15:59:40 -07:00
2026-03-02 00:33:37 -08:00
2026-04-30 23:20:14 -07:00
2026-07-07 16:42:36 -07:00
2026-07-10 15:42:33 -07:00
2026-07-05 01:57:54 -07:00
2026-05-09 02:45:13 -07:00
2026-07-04 20:54:20 -07:00
2026-07-03 19:16:16 -07:00
2026-05-05 15:27:14 -07:00
2026-06-01 21:34:12 -07:00
2026-07-11 18:15:48 -07:00
2026-05-19 08:09:33 -07:00
2026-05-29 21:11:16 -07:00
2026-05-06 23:29:08 -07:00
2026-06-01 15:47:14 -07:00
2026-04-26 22:14:22 -07:00
2026-07-10 15:59:40 -07:00
2026-06-04 11:03:13 -07:00
2026-06-16 00:48:14 -07:00
2026-06-16 19:49:31 -07:00
2026-04-27 22:51:31 -07:00
2026-06-15 02:48:50 -07:00
2026-06-15 02:48:50 -07:00
2026-07-10 15:42:33 -07:00
2026-07-10 15:42:33 -07:00
2026-07-10 15:42:33 -07:00
2026-06-01 12:56:45 -07:00
2026-07-07 08:20:57 -07:00
2026-05-23 14:20:36 -07:00
2026-07-05 01:57:54 -07:00
2026-04-18 05:49:54 -07:00
2026-07-05 01:57:54 -07:00
2026-07-05 01:57:54 -07:00
2026-04-18 05:49:54 -07:00
2026-03-23 11:11:40 -07:00
2026-05-12 13:15:09 -07:00
2026-05-11 01:06:47 -07:00
2026-04-30 23:20:14 -07:00
2026-04-30 23:20:14 -07:00
2026-05-24 18:31:23 -07:00
2026-05-30 16:27:15 -07:00
2026-06-27 23:36:24 -07:00
2026-07-01 21:06:31 -07:00
2026-05-31 19:54:43 -07:00
2026-05-31 19:03:16 -07:00
2026-07-05 01:59:38 -07:00
2026-07-05 01:59:38 -07:00
2026-05-11 01:06:47 -07:00
2026-04-27 21:52:57 -07:00
2026-04-16 13:30:25 -07:00
2026-04-18 19:02:52 -07:00
2026-07-03 00:29:26 -07:00
2026-05-09 17:06:47 -07:00
2026-07-07 08:20:57 -07:00
2026-06-08 10:08:30 -07:00
2026-07-02 00:32:11 -07:00
2026-07-03 00:29:26 -07:00
2026-07-07 23:32:20 -07:00
2026-07-05 01:57:54 -07:00
2026-07-07 16:42:36 -07:00
2026-06-10 22:03:08 -07:00
2026-06-26 03:28:06 -07:00
2026-05-11 01:06:47 -07:00
2026-07-06 19:16:09 -07:00
2026-06-26 03:28:06 -07:00
2026-06-04 11:03:13 -07:00
2026-07-05 01:57:54 -07:00
2026-04-16 21:40:50 -07:00
2026-07-07 08:20:57 -07:00
2026-03-13 21:21:09 -07:00
2026-06-16 17:10:12 -07:00
2026-06-17 18:07:45 -07:00
2026-06-26 04:57:20 -07:00
2026-04-04 17:53:20 -07:00
2026-03-02 00:33:37 -08:00
2026-07-05 01:59:38 -07:00
2026-07-05 01:59:38 -07:00
2026-05-04 00:46:43 -07:00
2026-06-04 11:03:13 -07:00
2026-06-26 19:37:01 -07:00
2026-03-03 22:57:34 -08:00
2026-07-03 00:29:26 -07:00
2026-07-03 00:29:26 -07:00
2026-06-10 13:31:53 -07:00
2026-06-09 18:37:46 -07:00
2026-04-04 23:44:29 -07:00
2026-06-09 20:00:55 -07:00
2026-06-04 11:03:13 -07:00
2026-05-30 01:11:48 -07:00
2026-07-07 16:42:36 -07:00
2026-07-07 16:42:36 -07:00
2026-06-16 03:41:51 -07:00
2026-05-31 19:54:43 -07:00
2026-07-08 16:58:23 -07:00
2026-06-04 11:03:13 -07:00
2026-05-31 19:54:43 -07:00
2026-04-05 01:53:33 -07:00
2026-06-09 20:00:55 -07:00
2026-07-11 17:53:24 -07:00
2026-03-04 06:47:30 -08:00
2026-07-11 16:37:13 -07:00
2026-03-02 16:55:12 -08:00
2026-07-12 19:03:35 -07:00
2026-07-12 19:03:35 -07:00
2026-07-06 18:46:28 -07:00
2026-05-07 13:59:50 -07:00
2026-05-04 22:00:23 -07:00
2026-05-04 22:00:23 -07:00
2026-05-06 11:29:25 -07:00
2026-05-04 22:00:23 -07:00
2026-07-06 18:19:17 -07:00
2026-05-07 13:59:50 -07:00
2026-06-25 20:42:22 -07:00
2026-07-04 03:27:55 -07:00
2026-05-04 22:00:23 -07:00
2026-05-04 22:00:23 -07:00
2026-07-03 22:11:15 -07:00
2026-05-07 13:59:50 -07:00
2026-05-07 13:59:50 -07:00
2026-07-12 19:03:35 -07:00
2026-05-12 13:15:09 -07:00
2026-07-04 03:27:55 -07:00
2026-07-12 19:03:35 -07:00
2026-06-17 18:07:45 -07:00
2026-07-06 18:19:17 -07:00
2026-06-17 18:07:45 -07:00
2026-06-17 18:07:45 -07:00
2026-07-06 18:46:28 -07:00
2026-03-12 16:57:31 -07:00
2026-03-21 16:12:50 -07:00
2026-03-20 20:01:26 -07:00
2026-03-23 11:11:40 -07:00
2026-05-07 13:59:50 -07:00
2026-05-04 22:00:23 -07:00
2026-07-06 18:46:28 -07:00
2026-05-06 22:09:47 -07:00
2026-07-12 19:03:35 -07:00
2026-06-26 17:24:06 -07:00
2026-06-26 17:24:06 -07:00
2026-06-26 19:37:01 -07:00
2026-05-04 22:00:23 -07:00
2026-06-04 11:03:13 -07:00
2026-06-12 13:54:49 -07:00
2026-06-26 17:24:06 -07:00
2026-07-03 00:29:26 -07:00
2026-07-04 16:48:52 -07:00
2026-07-08 00:59:14 -07:00
2026-05-31 16:05:21 -07:00
2026-05-09 02:45:13 -07:00
2026-06-11 20:27:29 -07:00
2026-07-06 21:10:27 -07:00
2026-06-11 20:27:29 -07:00
2026-06-04 11:03:13 -07:00
2026-04-28 13:49:31 -07:00
2026-04-06 03:08:19 -07:00
2026-06-04 11:03:13 -07:00
2026-05-11 01:23:54 -07:00
2026-04-05 17:18:26 -07:00
2026-03-07 12:49:07 -08:00
2026-07-10 15:42:33 -07:00
2026-07-06 21:52:42 -07:00
2026-07-12 19:03:35 -07:00
2026-07-12 19:03:35 -07:00
2026-07-04 16:48:52 -07:00
2026-07-12 19:03:35 -07:00
2026-07-07 08:20:57 -07:00
2026-05-31 19:54:43 -07:00
2026-07-05 11:59:52 -07:00
2026-06-11 14:00:42 -07:00
2026-05-24 17:49:27 -07:00
2026-07-11 17:53:24 -07:00
2026-07-06 21:42:51 -07:00
2026-06-16 00:48:14 -07:00
2026-07-02 19:23:04 -07:00
2026-06-16 00:48:14 -07:00
2026-07-03 00:29:26 -07:00
2026-07-06 19:58:36 -07:00
2026-07-06 19:58:36 -07:00
2026-07-03 00:29:26 -07:00
2026-07-06 19:16:09 -07:00
2026-07-07 22:07:20 -07:00
2026-07-07 08:20:57 -07:00
2026-07-01 18:01:50 -07:00
2026-06-26 17:24:06 -07:00
2026-07-01 18:01:50 -07:00
2026-07-06 19:16:09 -07:00
2026-07-03 19:16:36 -07:00
2026-07-03 00:29:26 -07:00
2026-07-05 01:59:38 -07:00
2026-05-09 02:45:13 -07:00
2026-06-04 11:03:13 -07:00
2026-06-04 11:03:13 -07:00
2026-07-11 16:37:13 -07:00
2026-07-03 00:29:26 -07:00
2026-06-16 00:48:14 -07:00
2026-07-11 16:37:13 -07:00
2026-04-26 22:14:22 -07:00
2026-05-28 17:14:50 -07:00
2026-07-01 21:05:57 -07:00
2026-06-04 11:03:13 -07:00
2026-07-07 23:03:47 -07:00
2026-04-18 19:02:52 -07:00
2026-06-01 14:44:30 -07:00
2026-06-01 21:34:12 -07:00
2026-03-30 20:30:05 -07:00
2026-06-04 11:03:13 -07:00
2026-05-31 19:54:43 -07:00
2026-05-31 19:54:43 -07:00
2026-03-02 00:33:37 -08:00
2026-07-03 00:29:26 -07:00
2026-07-08 00:59:14 -07:00
2026-07-08 00:59:14 -07:00
2026-07-08 00:59:14 -07:00
2026-07-03 00:29:26 -07:00
2026-03-02 16:55:12 -08:00
2026-07-08 00:59:14 -07:00
2026-05-31 19:54:43 -07:00
2026-04-04 22:19:03 -07:00
2026-04-16 13:30:25 -07:00
2026-07-08 00:59:14 -07:00
2026-04-26 22:14:22 -07:00
2026-04-26 13:11:07 -07:00
2026-07-01 21:05:57 -07:00
2026-07-07 22:47:15 -07:00
2026-07-07 16:42:36 -07:00
2026-07-06 19:16:09 -07:00
2026-05-30 14:03:39 -07:00
2026-07-04 20:54:20 -07:00
2026-05-04 22:00:23 -07:00
2026-07-03 00:29:26 -07:00
2026-05-02 20:22:25 -07:00
2026-05-22 15:13:39 -07:00
2026-03-30 20:30:05 -07:00
2026-07-02 19:23:04 -07:00
2026-06-30 03:47:12 -07:00
2026-05-20 22:41:40 -07:00
2026-07-03 00:29:26 -07:00
2026-06-26 08:38:31 -07:00
2026-06-04 11:03:13 -07:00
2026-07-07 08:20:57 -07:00
2026-07-11 16:37:13 -07:00
2026-07-07 23:32:20 -07:00
2026-07-07 16:42:36 -07:00
2026-07-11 16:37:13 -07:00
2026-07-03 00:29:26 -07:00
2026-05-31 19:03:16 -07:00
2026-05-31 19:54:43 -07:00
2026-07-07 22:07:20 -07:00
2026-07-03 17:30:33 -07:00
2026-05-24 14:56:43 -07:00
2026-05-24 14:56:43 -07:00
2026-05-24 14:56:43 -07:00
2026-07-03 19:16:36 -07:00
2026-03-17 01:26:44 -07:00
2026-03-23 11:11:40 -07:00
2026-03-16 15:45:21 -07:00
2026-05-08 13:58:02 -07:00
2026-07-03 19:16:36 -07:00
2026-07-03 19:16:36 -07:00
2026-07-03 19:16:36 -07:00
2026-06-04 11:03:13 -07:00
2026-07-08 16:58:23 -07:00
2026-07-07 23:32:20 -07:00
2026-07-07 23:32:20 -07:00
2026-04-25 20:11:47 -07:00
2026-07-07 08:20:57 -07:00
2026-05-11 01:23:54 -07:00
2026-04-04 17:53:20 -07:00
2026-05-24 14:56:43 -07:00
2026-04-18 10:20:19 -07:00
2026-06-04 11:03:13 -07:00
2026-07-07 08:20:57 -07:00
2026-06-28 20:24:20 -07:00
2026-06-28 20:24:20 -07:00
2026-07-03 19:16:36 -07:00
2026-06-16 03:41:51 -07:00
2026-04-01 19:38:24 -07:00
2026-06-16 17:10:12 -07:00
2026-04-01 19:38:24 -07:00
2026-05-30 16:27:15 -07:00
2026-03-25 16:07:05 -07:00
2026-06-04 11:03:13 -07:00
2026-03-30 20:30:05 -07:00
2026-03-12 14:49:58 -07:00
2026-06-01 12:56:45 -07:00
2026-07-01 21:06:31 -07:00
2026-07-10 15:42:33 -07:00
2026-06-04 11:03:13 -07:00
2026-06-04 11:03:13 -07:00
2026-03-23 11:11:40 -07:00
2026-06-16 17:10:12 -07:00
2026-07-10 15:42:33 -07:00
2026-07-07 16:42:36 -07:00
2026-05-14 15:13:00 -07:00
2026-07-07 16:42:36 -07:00
2026-07-07 22:47:15 -07:00
2026-06-01 11:01:30 -07:00
2026-07-03 19:16:16 -07:00
2026-07-07 23:32:20 -07:00
2026-07-10 15:59:40 -07:00
2026-07-05 01:57:54 -07:00
2026-06-12 13:54:49 -07:00