pomerium / pomerium / 22967674384

45%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: add auto-discovery support to connect, disconnect, and authorize endpoints (#6179)

## Summary

MCP server routes can be configured with static `upstream_oauth2`
credentials, but many upstream servers publish their authorization
server dynamically via RFC 9728 Protected Resource Metadata (PRM). This
PR adds auto-discovery support so users can connect to those servers
without manual OAuth config.

### Routes portal (connect/disconnect)

Users clicking "Connect" in the routes portal need a seamless flow even
when the upstream server uses dynamic OAuth. The connect handler now
probes for PRM, registers a client via DCR if needed, and redirects the
user to the upstream authorization server — all transparently. Discovery
failures are surfaced as `connect_error` query params rather than 500
errors, so the UI can show a meaningful message.

Disconnecting must clean up auto-discovery tokens (not just static
OAuth2 tokens), otherwise stale credentials accumulate silently.

### Route sign-in (authorize)

When a user signs into a route, the authorize endpoint opportunistically
sets up upstream tokens via auto-discovery so the user doesn't hit a 401
on first request. Discovery errors are non-fatal here — the user still
authenticates to Pomerium, and upstream auth can happen later via
ext_proc 401 interception.

### Redirect URL validation

The connect endpoint accepts a `redirect_url` parameter. To prevent open
redirect vulnerabilities, it validates that the target is either a known
MCP client route or the same host as the server route (needed for the
portal's own connect flow). The validator naming follows CodeQL's
barrier-guard convention to avoid false-positive static analysis
warnings.

## Linear

- [ENG-3596](https://linear.app/pomerium/issue/ENG-3596) — extend
/routes and /connect for auto-discovery upstream auth
- [ENG-3593](https://linear.app/pomerium/issue/ENG-3593) — authorize
endpoint auto-discovery

## Test plan

- [x] Unit tests for redirect URL... (continued)

Run Details

238 of 494 new or added lines in 3 files covered. (48.18%)

20 existing lines in 8 files now uncovered.

34783 of 76514 relevant lines covered (45.46%)

115.23 hits per line