stacklok / toolhive / 24338135480

push

github

Return 503 for expired proxy tokens (#4722)

* Return 503 for expired proxy tokens

When the proxy's OAuth token source fails, the token injection
middleware returned 401 Unauthorized. MCP clients interpret 401
as a signal to begin OAuth authentication, but the proxy manages
OAuth internally and has no client-facing OAuth metadata. The
failed discovery is cached, blocking reconnection even after the
token refreshes.

Return 503 Service Unavailable with Retry-After instead, which
clients treat as a transient connection error.

Fixes #4721

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: Greg Katz <gkatz@indeed.com>

* Extract Retry-After value into named constant

Address review nit: extract the retry delay into a package-level
constant with a comment linking it to the MonitoredTokenSource
backoff interval.

Signed-off-by: Greg Katz <gkatz@indeed.com>

---------

Signed-off-by: Greg Katz <gkatz@indeed.com>
Co-authored-by: Claude <noreply@anthropic.com>

5 of 5 new or added lines in 1 file covered. (100.0%)

56745 of 86468 relevant lines covered (65.63%)

62.87 hits per line