feat(mcp): add temporary OAuth state for staged connections

Merged
WE
16h ago
+617-16

Description

Add temporary OAuth storage for proposed MCP connections. Attempts use Onyx’s credential-protection helper, expire after ten minutes, and can be consumed once by their owner. Encryption requires Enterprise Edition and a configured encryption key. Shared cache storage supports callbacks on any API replica.

Reuse provider construction and discovery. Preserve registered client metadata and probe through an OAuth-capable transport before SSE sign-in.

How Has This Been Tested?

OAuth storage/provider tests and the full MCP/route unit suite passed. Redis concurrency and owner-binding tests passed. Python typing, lint, formatting, and feature-map checks passed.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Summary by CodeRabbit

  • New Features

    • Added OAuth setup for MCP connections, including provider discovery and resumable authorization.
    • Added secure, temporary setup storage with expiration, single-use protection, and owner and tenant binding.
    • Added clear setup outcomes for connected servers and authorization-required states.
    • Added configuration options for availability, chat access, policy management, and action policies.

  • Documentation

    • Documented staged OAuth support for proposed MCP connections.