Fix: Prevent Stale Tool/Resource/Prompt Deletion During OAuth Authorization Code Flow by rakdutta · Pull Request #2537 · IBM/mcp-context-forge

rakdutta · 2026-01-28T07:24:48Z

closes issue #2272

Problem

During gateway activation with OAuth Authorization Code flow, _initialize_gateway returns empty lists for capabilities, tools, resources, and prompts because the user hasn't completed authorization yet. Health checks then treat these empty responses as legitimate and delete all existing tools/resources/prompts as "stale", causing data loss.

Solution

Added oath_auto_fetch_tool_flag parameter to _initialize_gateway method (line 3792)
- When False (default): Skips OAuth token fetch and returns empty lists for Authorization Code flow (line 3852, 3865)
- When True: Forces tool/resource/prompt fetch even during OAuth flows (used during gateway activation, line 2459)
Added early return check in _refresh_gateway_tools_resources_prompts (lines 4724-4729)
- Detects Authorization Code OAuth gateways with empty responses
- Skips database updates to preserve existing records until OAuth authorization is completed

Changes

New flag: oath_auto_fetch_tool_flag controls whether to fetch tools during OAuth initialization
Gateway activation: Sets flag to True to force tool fetch (line 2459)
Health checks: Uses default False to skip incomplete OAuth flows (line 4726-4729)
Stale detection: Only deletes tools/resources/prompts for non-auth-code gateways or when legitimately empty

During gateway activation with OAuth Authorization Code flow, `_initialize_gateway` returns empty lists because the user hasn't completed authorization yet. Health checks then treat these empty responses as legitimate and delete all existing tools/resources/prompts. This change adds an `oauth_auto_fetch_tool_flag` parameter to `_initialize_gateway` that: - When False (default): Returns empty lists for auth_code gateways during health checks, preserving existing tools - When True (activation): Skips the early return for auth_code gateways, allowing activation to proceed The existing check in `_refresh_gateway_tools_resources_prompts` at lines 4724-4729 prevents stale deletion for auth_code gateways with empty responses. Fixed issues from original PR: - Corrected typo: oath -> oauth in parameter name - Removed duplicate docstring entry - Fixed logic bug that incorrectly skipped token fetch for client_credentials flow when flag was True Co-authored-by: rakdutta <rakhibiswas@yahoo.com> Closes #2272 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

crivetimihai · 2026-01-28T13:10:00Z

Review & Fixes Applied

I've reviewed and fixed this PR. Here's a summary of the changes:

Issues Found and Fixed

Typo in parameter name: oath_auto_fetch_tool_flag → oauth_auto_fetch_tool_flag
Duplicate docstring entry: The parameter was documented twice in the docstring - removed the duplicate and improved the description.
Logic bug that broke client_credentials flow: The original condition not oath_auto_fetch_tool_flag caused the entire OAuth block to be skipped when the flag was True. This meant:
- For authorization_code: Skipped early return (intended ✓)
- For client_credentials: Also skipped token fetch (unintended ✗)
Fixed by restructuring the logic so the flag only affects the early return for authorization_code, while client_credentials always fetches its token.

Updated Logic Structure

if grant_type == "authorization_code":
    if not oauth_auto_fetch_tool_flag:
        # Health checks: return empty, preserve existing tools
        return {}, [], [], []
    # Activation: skip early return, try to connect
elif grant_type == "client_credentials":
    # Always fetch token (unaffected by flag)
    access_token = await self.oauth_manager.get_access_token(oauth_config)

Verification

✅ All 5,127 unit tests pass
✅ Ruff linting passes
✅ Black formatting verified
✅ OAuth-specific tests pass

The commits have been squashed into a single properly signed commit with co-author attribution preserved.

…BM#2537) During gateway activation with OAuth Authorization Code flow, `_initialize_gateway` returns empty lists because the user hasn't completed authorization yet. Health checks then treat these empty responses as legitimate and delete all existing tools/resources/prompts. This change adds an `oauth_auto_fetch_tool_flag` parameter to `_initialize_gateway` that: - When False (default): Returns empty lists for auth_code gateways during health checks, preserving existing tools - When True (activation): Skips the early return for auth_code gateways, allowing activation to proceed The existing check in `_refresh_gateway_tools_resources_prompts` at lines 4724-4729 prevents stale deletion for auth_code gateways with empty responses. Fixed issues from original PR: - Corrected typo: oath -> oauth in parameter name - Removed duplicate docstring entry - Fixed logic bug that incorrectly skipped token fetch for client_credentials flow when flag was True Closes IBM#2272 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com> Signed-off-by: hughhennnelly <hughhennelly06@gmail.com>

…BM#2537) During gateway activation with OAuth Authorization Code flow, `_initialize_gateway` returns empty lists because the user hasn't completed authorization yet. Health checks then treat these empty responses as legitimate and delete all existing tools/resources/prompts. This change adds an `oauth_auto_fetch_tool_flag` parameter to `_initialize_gateway` that: - When False (default): Returns empty lists for auth_code gateways during health checks, preserving existing tools - When True (activation): Skips the early return for auth_code gateways, allowing activation to proceed The existing check in `_refresh_gateway_tools_resources_prompts` at lines 4724-4729 prevents stale deletion for auth_code gateways with empty responses. Fixed issues from original PR: - Corrected typo: oath -> oauth in parameter name - Removed duplicate docstring entry - Fixed logic bug that incorrectly skipped token fetch for client_credentials flow when flag was True Closes IBM#2272 Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

When an OAuth authorization_code gateway transitions from offline to online, set_gateway_state re-initializes without a valid token, receives empty results, and deletes all existing tools/resources/prompts as stale. Add the same auth_code guard that _refresh_gateway_tools_resources_prompts already has (PR IBM#2537): skip stale cleanup when the response is empty for authorization_code gateways. Signed-off-by: kimsehwan96 <sktpghks138@gmail.com>

* fix: prevent tool deletion on auth_code gateway reactivation When an OAuth authorization_code gateway transitions from offline to online, set_gateway_state re-initializes without a valid token, receives empty results, and deletes all existing tools/resources/prompts as stale. Add the same auth_code guard that _refresh_gateway_tools_resources_prompts already has (PR #2537): skip stale cleanup when the response is empty for authorization_code gateways. Signed-off-by: kimsehwan96 <sktpghks138@gmail.com> * test: align assert style with existing conventions Replace string-parsing assert with call_count check to match the existing test patterns in test_gateway_service.py. Signed-off-by: kimsehwan96 <sktpghks138@gmail.com> * fix: also guard in-memory list reassignment and improve test coverage Skip gateway.tools/resources/prompts list filtering when stale cleanup is skipped, and verify all existing tools are preserved by id. Signed-off-by: kimsehwan96 <sktpghks138@gmail.com> * style: align variable naming with existing convention Rename _is_auth_code_gw to is_auth_code_gateway and _skip_stale_cleanup to skip_stale_cleanup to match _refresh_gateway_tools_resources_prompts naming. Signed-off-by: kimsehwan96 <sktpghks138@gmail.com> * test: add negative and resource/prompt coverage for auth_code guard Add two tests for set_gateway_state auth_code guard: - Non-auth_code gateway with empty results still runs stale cleanup - Auth_code guard preserves resources and prompts (not just tools) Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * test: add partial-results coverage for auth_code guard Verify that an authorization_code gateway returning partial results (some tools) still runs stale cleanup, ensuring the guard only activates when all three collections are empty. Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> * fix(sdist): include infra/s390x/Containerfile in MANIFEST.in Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> --------- Signed-off-by: kimsehwan96 <sktpghks138@gmail.com> Signed-off-by: Mihai Criveti <crivetimihai@gmail.com> Co-authored-by: Mihai Criveti <crivetimihai@gmail.com>

rakdutta changed the title ~~Oath2 mcp server 22272~~ Add flag to control tool auto-fetch during OAuth gateway initialization Jan 28, 2026

rakdutta marked this pull request as ready for review January 28, 2026 07:48

rakdutta requested a review from crivetimihai as a code owner January 28, 2026 07:48

rakdutta changed the title ~~Add flag to control tool auto-fetch during OAuth gateway initialization~~ Fix: Prevent Stale Tool/Resource/Prompt Deletion During OAuth Authorization Code Flow Jan 28, 2026

crivetimihai self-assigned this Jan 28, 2026

crivetimihai force-pushed the oath2_mcp_server_22272 branch from 2d66b75 to c0e9751 Compare January 28, 2026 12:56

crivetimihai approved these changes Jan 28, 2026

View reviewed changes

crivetimihai merged commit 2543af6 into main Jan 28, 2026
53 checks passed

crivetimihai deleted the oath2_mcp_server_22272 branch January 28, 2026 15:18

crivetimihai added this to the Release 1.0.0-RC1 milestone Jan 31, 2026

kimsehwan96 mentioned this pull request Mar 22, 2026

[BUG]: set_gateway_state deletes tools on offlin to online transition for OAuth authorization_code gateways #3788

Closed

7 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix: Prevent Stale Tool/Resource/Prompt Deletion During OAuth Authorization Code Flow#2537

Fix: Prevent Stale Tool/Resource/Prompt Deletion During OAuth Authorization Code Flow#2537
crivetimihai merged 1 commit intomainfrom
oath2_mcp_server_22272

rakdutta commented Jan 28, 2026 •

edited

Loading

Uh oh!

crivetimihai commented Jan 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

rakdutta commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Solution

Changes

Uh oh!

crivetimihai commented Jan 28, 2026

Review & Fixes Applied

Issues Found and Fixed

Updated Logic Structure

Verification

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rakdutta commented Jan 28, 2026 •

edited

Loading