Skip to content

fix(auth/generic): fix generic auth expiration field and integration with authRequired#3251

Merged
duwenxin99 merged 19 commits into
mainfrom
fix-auth
May 21, 2026
Merged

fix(auth/generic): fix generic auth expiration field and integration with authRequired#3251
duwenxin99 merged 19 commits into
mainfrom
fix-auth

Conversation

@duwenxin99

@duwenxin99 duwenxin99 commented May 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor
  • Fix the expiration field for google OAuth as it returns string instead of numbers like other authServices.
  • Fix issue with using both MCP auth and authRequired feature at the same time.
  • Fix integration test steps are detecting common changes.

Fix #3243 and #3240

@duwenxin99 duwenxin99 requested a review from a team as a code owner May 18, 2026 21:46
@duwenxin99 duwenxin99 changed the title fix(auth/generic): resolve OIDC generic auth introspection and MCP to… fix(auth/generic): fix generic auth expiration field and integration with authRequired May 18, 2026
gemini-code-assist[bot]
gemini-code-assist Bot reviewed May 18, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request enhances the generic authentication service by changing the exp claim type to json.Number, allowing it to correctly parse expiration values provided as strings in introspection responses. Corresponding test cases were added to verify this behavior. Furthermore, the logic in the API and various MCP version handlers was updated to fetch claims from the context when MCP authentication is enabled for a generic service. I have no feedback to provide.

@duwenxin99 duwenxin99 added the release candidate Use label to signal PR should be included in the next release. label May 20, 2026
@duwenxin99 duwenxin99 enabled auto-merge (squash) May 21, 2026 17:22
@duwenxin99 duwenxin99 disabled auto-merge May 21, 2026 17:23
@duwenxin99 duwenxin99 merged commit f4d16c0 into main May 21, 2026
23 checks passed
@duwenxin99 duwenxin99 deleted the fix-auth branch May 21, 2026 18:20
@github-actions

github-actions Bot commented May 21, 2026

Copy link
Copy Markdown
Contributor

🧨 Preview deployments removed.

Cloudflare Pages environments for pr-3251 have been deleted.

@release-please release-please Bot mentioned this pull request May 21, 2026
Merged
Yuan325 added a commit that referenced this pull request May 21, 2026
@release-please @Yuan325
chore(main): release 1.3.0 (#3228)
b001006 
🤖 I have created a release *beep* *boop*
---


##
[1.3.0](v1.2.0...v1.3.0)
(2026-05-21)


### Features

* **auth:** Implement MCP auth tool-level scopes validation
([#3049](#3049))
([c528985](c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([#3253](#3253))
([75da6c2](75da6c2))
* Setup SQLCommenter and allow client metadata
([#3064](#3064))
([9f1f9b3](9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([#3083](#3083))
([ef300a8](ef300a8))


### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([#3251](#3251))
([f4d16c0](f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([#3036](#3036))
([c739b80](c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([#3218](#3218))
([80a6602](80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([#3233](#3233))
([4f409a3](4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([#3273](#3273))
([1e3de96](1e3de96))
* **tools:** Initialize query result slices to empty array
([#3250](#3250))
([60ddf48](60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com>
github-actions Bot pushed a commit that referenced this pull request May 21, 2026
@Yuan325 @release-please
deploy: chore(main): release 1.3.0 (#3228)
1d64c0d 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([#3049](#3049))
([c528985](c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([#3253](#3253))
([75da6c2](75da6c2))
* Setup SQLCommenter and allow client metadata
([#3064](#3064))
([9f1f9b3](9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([#3083](#3083))
([ef300a8](ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([#3251](#3251))
([f4d16c0](f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([#3036](#3036))
([c739b80](c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([#3218](#3218))
([80a6602](80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([#3233](#3233))
([4f409a3](4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([#3273](#3273))
([1e3de96](1e3de96))
* **tools:** Initialize query result slices to empty array
([#3250](#3250))
([60ddf48](60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to renovate-bot/googleapis-_-genai-toolbox that referenced this pull request May 21, 2026
@renovate-bot @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
2d4c637 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to rodineyw/mcp-toolbox that referenced this pull request May 21, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
37848f1 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to Jaleel-zhu/genai-toolbox that referenced this pull request May 21, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
6c4e70d 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
@BrewTestBot BrewTestBot mentioned this pull request May 21, 2026
Merged
github-actions Bot pushed a commit to pepe57/genai-toolbox that referenced this pull request May 22, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
402bf8c 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
@duwenxin99 duwenxin99 mentioned this pull request May 22, 2026
Closed
github-actions Bot pushed a commit to CrazyForks/genai-toolbox that referenced this pull request May 22, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
ebc4be2 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
github-actions Bot pushed a commit to bhardwajRahul/genai-toolbox that referenced this pull request May 23, 2026
@pull @release-please
deploy: chore(main): release 1.3.0 (googleapis#3228)
e3bd116 
🤖 I have created a release *beep* *boop*
---

##
[1.3.0](googleapis/mcp-toolbox@v1.2.0...v1.3.0)
(2026-05-21)

### Features

* **auth:** Implement MCP auth tool-level scopes validation
([googleapis#3049](googleapis#3049))
([c528985](googleapis@c528985))
* **looker:** Propagate client IP from incoming MCP requests to
downstream SDK calls
([googleapis#3253](googleapis#3253))
([75da6c2](googleapis@75da6c2))
* Setup SQLCommenter and allow client metadata
([googleapis#3064](googleapis#3064))
([9f1f9b3](googleapis@9f1f9b3))
* **tool/cloudsqladmin:** Add `cloud-sql-admin-execute-sql-many` and
`cloud-sql-admin-sql-many`
([googleapis#3083](googleapis#3083))
([ef300a8](googleapis@ef300a8))

### Bug Fixes

* **auth/generic:** Fix generic auth expiration field and integration
with `authRequired`
([googleapis#3251](googleapis#3251))
([f4d16c0](googleapis@f4d16c0))
* Enforce toolset/promptset boundary on tools/call and prompts/get
([googleapis#3036](googleapis#3036))
([c739b80](googleapis@c739b80))
* **tools/http:** Prevent path traversal and base path scope escape
([googleapis#3218](googleapis#3218))
([80a6602](googleapis@80a6602))
* **tools/looker:** Return a 401 error to MCP client when Looker returns
a 401 ([googleapis#3233](googleapis#3233))
([4f409a3](googleapis@4f409a3))
* **tools/looker:** Strip wrapping quotes from filter values for
unquoted parameters
([googleapis#3273](googleapis#3273))
([1e3de96](googleapis@1e3de96))
* **tools:** Initialize query result slices to empty array
([googleapis#3250](googleapis#3250))
([60ddf48](googleapis@60ddf48))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>
Co-authored-by: Yuan Teoh <45984206+Yuan325@users.noreply.github.com> b001006
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@averikitsch averikitsch averikitsch approved these changes

+1 more reviewer

@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

@Yuan325 Yuan325

Labels

release candidate Use label to signal PR should be included in the next release.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

bug(auth): tool-level authRequired silently 401s every call when authService has mcpEnabled: true

3 participants

@duwenxin99 @averikitsch @Yuan325