fix(mcp): end sign-in loop after fresh email sign-in
Problem
Connecting an MCP client after signing in by email from scratch loops forever between ooxml.dev/sign-in ("Finishing connection") and api.ooxml.dev/authorize. It never reaches consent or the client callback. If the user was already signed in, it works.
Cause
On the first, signed-out visit to /authorize, Clerk's satellite check leaves a __clerk_handshake cookie on .ooxml.dev for 70 seconds. That cookie holds a signed-out result. Clerk returns headers that clear it, but authenticateClerkUser dropped them for signed-out users, so the redirect to sign-in never cleared the cookie. After the email sign-in, /authorize read the stale cookie first, treated the user as signed out again, and sent them back to sign-in. The sign-in page saw the real session and sent them straight back.
Fix
authenticateClerkUser now returns Clerk's headers whether or not the user is signed in. The redirect to sign-in passes them to the browser, as the consent page already did.
Verification
- Worker logs (
wrangler tail) from a looping attempt: about 60/authorizeā sign-in redirects in about 90 seconds. - Against the production Clerk instance, a real handshake cookie gives a signed-out result whose headers include
__clerk_handshake=; ... Expires=Thu, 01 Jan 1970. The old code dropped that header. - New test in
tests/mcp-server/oauth-authorization.test.ts: fails before the fix, passes after. bun run mcp:test(46 pass) and typecheck pass.- The full browser flow is not tested yet. It needs the deployed Worker.
š¤ Generated with Claude Code