fix: authorization resource for EXTERNAL_OAUTH21_PROVIDER=true - #405
Conversation
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Add batch_update_form MCP tool that exposes the Google Forms batchUpdate API endpoint. Supports createItem, updateItem, deleteItem, moveItem, updateFormInfo, and updateSettings operations. Includes _batch_update_form_impl internal function for testability and 6 unit tests covering multiple requests, single request, empty replies, missing replies key, URL generation, and mixed reply types. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add batch_update_form to the Complete tier in tool_tiers.yaml and document it in both README files as requested in PR review. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes the OAuth authorization resource metadata for external OAuth mode (EXTERNAL_OAUTH21_PROVIDER=true) by properly implementing Resource Server behavior that points to Google's Authorization Server instead of attempting to act as an Authorization Server itself.
Changes:
- Enhanced ExternalOAuthProvider to implement get_routes() that creates protected resource metadata endpoints pointing to Google's Authorization Server
- Updated server configuration to enable protocol-level auth validation by setting server.auth = provider instead of None
- Improved logging to clarify the Resource Server role and expected token flow
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| core/server.py | Updated external OAuth configuration to enable auth provider and improved logging messages |
| auth/external_oauth_provider.py | Added get_routes() method, resource_server_url parameter, and enhanced documentation about Resource Server role |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Store credentials as they're not exposed by parent class | ||
| self._client_id = client_id | ||
| self._client_secret = client_secret | ||
| # Store as string - Pydantic validates it when passed to models |
There was a problem hiding this comment.
The comment mentions Pydantic validation but the assignment is a simple string copy without any validation happening at this point. Consider removing the misleading comment or adding actual validation if needed.
| # Store as string - Pydantic validates it when passed to models | |
| # Store as string for compatibility with any Pydantic models that may consume it |
| Returns: | ||
| List of routes - only protected resource metadata | ||
| """ | ||
| from mcp.server.auth.routes import create_protected_resource_routes |
There was a problem hiding this comment.
Import statements should be at the module level rather than inside a method. Move this import to the top of the file with other imports for better code organization and to avoid repeated import overhead on each method call.
|
@taylorwilsdon thank you so much for the help. I am so sorry, I was not too familiar with the process. I will do better job next time. |
302 from #401 (no edit rights)
Thanks @ryohang
Fixes the authorization resource metadata for EXTERNAL_OAUTH21_PROVIDER=true mode to properly act as a Resource Server that points to Google's Authorization Server.
Problem
When using external OAuth mode (where access tokens are issued by external systems), the MCP server was not properly advertising its role as a Resource Server or pointing to the correct Authorization Server.
Changes
Enhanced ExternalOAuthProvider to implement proper Resource Server behavior:
Added get_routes() method to create protected resource metadata endpoints
Metadata now correctly points to Google's Authorization Server (https://accounts.google.com/)
Added resource_server_url parameter for proper endpoint configuration
Improved documentation explaining Resource Server vs Authorization Server roles
Updated server configuration to properly enable protocol-level auth:
Changed from server.auth = None to server.auth = provider to enable OAuth validation
Added clearer logging to indicate protected resource metadata setup