Repository navigation
fix(servers): complete MCP OAuth callback UX - #199
Merged
Merged
Conversation
vishu-bh
marked this pull request as ready for review
October 21, 2026 14:09
vishu-bh
force-pushed
the
fix/4684-mcp-oauth-callback-ux
branch
from
October 21, 2026 14:10
ceb9a29 to
54fada7
Compare
a-effort
requested changes
Oct 21, 2026
Signed-off-by: Vishu Bhatnagar <[email protected]>
Signed-off-by: Vishu Bhatnagar <[email protected]>
vishu-bh
force-pushed
the
fix/4684-mcp-oauth-callback-ux
branch
from
October 22, 2026 12:16
54fada7 to
c7605dc
Compare
a-effort
requested changes
Oct 22, 2026
a-effort
left a comment
a-effort
left a comment
Contributor
There was a problem hiding this comment.
Reviewed again; nice work on addressing change requests! I notice that IBM/mcp-context-forge#4684 which was created in May had gone stale and the proposed interaction for servers that need authentication was established afterwards in #130. We should use that pattern. Details:
Here's a quick demo of the desired interaction: #130 (comment) (0:23 clicking "Auth" triggers a popup for OAuth without triggering the drawer to open). After auth is complete, the status changes to active (or remains the same if it was unsuccessful as the popup communicates failure).
We should use this pattern in the drawer, also. I created a couple of mockups to show the desired changes: authorization required / auth succeeded
I also moved the button for refresh to next to the search icon and changed the styling to match that. This should persist and uses the same mechanism as the refresh overflow menu item for the server in the server table.
Lmk if there are questions / things to discuss and apologies for any confusion coming from that stale issue.
ShaoLOWu
added a commit
to ShaoLOWu/contextforge-web-ui
that referenced
this pull request
Oct 23, 2026
Closing the OAuth popup without completing authorization is a deliberate
user action, not a failure, so ServerCatalog no longer reports it.
Previously both `handleAuthorize` (page-level notice above the grid) and
`handleOAuthSubmit` (notice inside the Add-server dialog) passed the raw
`OAuthCancelledError` message ("OAuth authorization was cancelled",
untranslated) straight into their notification state.
Both catch blocks now return early on `OAuthCancelledError` instead of
notifying, mirroring the MCP Servers page (Servers.tsx), which already
discards the cancellation silently. Genuine authorization failures keep
surfacing their reason, and the dialog stays open for a retry in both
cases.
Tests: the cancelled-authorization test now uses `OAuthCancelledError`
and asserts no cancellation notice appears anywhere (previously it
rejected with a plain `Error` carrying the same text, covering cancel
and failure identically); a new dialog test covers the real-failure path
(provider reason still shown), and a new page-level test covers the
Authorize menu action staying quiet on cancellation.
Fixes IBM/mcp-context-forge#7303 (the catalog UI lives in this repo).
Note: surfacing the provider's denial reason via `OAuthAuthorizationError`
(the remaining suggestion in that issue) lands naturally after contextforge-org#199 adds
the class to `src/api/servers.ts`; this PR intentionally does not
duplicate it.
Verification: `vitest run src/pages/ServerCatalog.test.tsx` 78/78 green;
`tsc -b tsconfig.app.json` clean (after `orval` generation); eslint and
prettier clean on both changed files.
Assisted-by: AI (Claude via WorkBuddy) — diff reviewed and verified by
the human contributor before submission.
Signed-off-by: ShaoLOWu <[email protected]>
vishu-bh
force-pushed
the
fix/4684-mcp-oauth-callback-ux
branch
from
October 27, 2026 13:18
45bc70b to
6254659
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
OAuth authorization on the MCP Servers page opens the server's Components view, shows success inline, and reloads tools, resources, and prompts. Failures display the provider's bounded, validated plain-text reason in a dialog with retry. Dismissal preserves the shared Authorization required or Authorization expired status with an adjacent authorization action.
Fixes IBM/mcp-context-forge#4684.
Validation
npm run buildandnpm run lintpassed.git diff --checkpassed for the changes.e2e/tools.spec.tsandsrc/utils/errors.ts.Manual verification
On an existing OAuth authorization-code server without a valid caller token, deny consent, dismiss the failure dialog, retry from Authorization required, and complete authorization. Confirm inline success and freshly loaded components, then use Refresh components without reopening OAuth. Check that expired tokens retain Authorization expired, valid tokens do not offer Authorize, Escape dismisses only the dialog, and closing a pending popup produces no failure dialog.