feat(mcp): add temporary OAuth setup state (v5.0 backport)

Merged
WE
14h ago
+617-16

Description

Store temporary OAuth attempts for proposed MCP connections. Preserve owner binding, expiration, and single-use authorization across API replicas.

Manual cherry-pick of #16417 from main (eee522c3fdd2b0421d3eb424f65b410a0687df50). The original stack merged on main; its automatic release backport did not run. This cherry-pick applied without code changes.

Builds on https://github.com/onyx-dot-app/onyx/pull/16451. Merge this stack from bottom to top into release/v5.0.

How Has This Been Tested?

Validated the complete backport stack on release/v5.0:

  • 202 frontend component tests passed across MCP configuration, authentication, setup, default Chat, and OpenAPI plugins.
  • 353 backend MCP, route-contract, and OpenAPI availability tests passed.
  • Changed-file pre-commit checks passed, including Python and TypeScript typing, coverage, lint, formatting, translations, and feature-map integrity.
  • PostgreSQL setup and locking tests could not start: local PostgreSQL refused connections on port 5432.
  • Live provider OAuth was not rerun locally. Release CI will run on this PR.

Additional Options

  • [Optional] Please cherry-pick this PR to the latest release version.

Summary by cubic

Backports the staged OAuth setup state for proposed MCP connections (original #16417) from main to release/v5.0. The automatic release backport did not run, so this is a manual cherry-pick applied without code changes.

Adds temporary OAuth storage for proposed MCP connections so authorization attempts work before a server is saved. Attempts expire after ten minutes, are bound to their owner and tenant, and can each be consumed once. Payloads use credential encryption when Enterprise Edition has an encryption key configured, otherwise Base64 encoding. Shared cache storage keeps callbacks working across API replicas.

  • New setup_oauth.py stores and consumes setup attempts, with transient token storage preserving registered client metadata, tokens, and expiry until the caller publishes the connection.
  • oauth.py and oauth_flow.py extract reusable provider construction and discovery so staged and persisted connections share the same path.
  • Adds MCPSetupRequest and setup response models; tests cover owner binding, single-use consumption, expiry, and auto-discovery.