pomerium / pomerium / 22914102726

45%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: improve route listing for auto-discovery upstream auth (#6178)

## Summary

Improve MCP route listing to support auto-discovery upstream auth:

- **Auto-discovery token checking**: adds `GetUpstreamMCPToken` lookup
alongside existing static OAuth2 token lookup when reporting `connected`
status. Previously auto-discovery routes always showed as connected even
when the user had no upstream token.

- **No access token expiry check**: connection status only checks
whether a token exists, not whether it's expired. Expired tokens with
refresh tokens are refreshed in-place when requests are made (via
`getAutoDiscoveryToken`/`refreshOrClearToken`), so an expired access
token does not mean the user is disconnected.

- **`NeedsOauth: true` for all routes**: all MCP server routes now
report `needs_oauth: true` so external clients know auth is needed (both
static `upstream_oauth2` and auto-discovery routes).

## Related

- [ENG-3596](https://linear.app/pomerium/issue/ENG-3596) — extend
/routes for auto-discovery upstream auth

Run Details

10 of 28 new or added lines in 1 file covered. (35.71%)

27 existing lines in 9 files now uncovered.

34427 of 76106 relevant lines covered (45.24%)

115.82 hits per line