24740199847
45%

Ran 21 Apr 2026 07:01PM UTC

Jobs 1

Files 696

Run time 1min

Badge

Embed ▾

Committed 21 Apr 2026 06:44PM UTC coverage: 45.684% (+0.07%) from 45.619%

Build # 24740199847

Build Type

push

github

Committed by

web-flow

Commit Message

mcp: refresh expired upstream token before forcing reauth (#6282)

## Summary

`/.pomerium/mcp/authorize` and `/.pomerium/mcp/connect` forced a full
interactive OAuth flow whenever the cached `UpstreamMCPToken` was past
its expiry, even when a valid `refresh_token` was on hand. Now attempt a
silent refresh first; on permanent failure drop the stale token and fall
through as before.

## Related issues


[ENG-3927](https://linear.app/pomerium/issue/ENG-3927/mcp-authorize-handler-doesnt-refresh-expired-upstreammcptoken-triggers)

## User Explanation

MCP clients no longer get bounced through a full upstream OAuth consent
page once a day when their cached access token expires; a fresh token is
fetched silently from the upstream's `token_endpoint`.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (`bug`)
- [ ] ready for review

Coverage Stats

79 of 110 new or added lines in 3 files covered. (71.82%)

28 existing lines in 7 files now uncovered.

35553 of 77823 relevant lines covered (45.68%)

114.87 hits per line

Uncovered Changes

Lines	Coverage	∆	File
13	70.33	1.45%	internal/mcp/upstream_auth.go
9	52.25	0.2%	internal/mcp/handler_authorization.go
9	47.47	11.24%	internal/mcp/handler_connect.go

Coverage Regressions

Lines	Coverage	∆	File
9	80.34	0.0%	pkg/ssh/manager.go
8	91.72	-1.79%	pkg/ssh/policy_index_inmemory.go
4	74.26	-1.18%	internal/databroker/config_source.go
2	92.78	-1.11%	internal/fileutil/watcher.go
2	79.15	-0.77%	internal/recording/server.go
2	95.83	-2.08%	pkg/identity/manager/schedulers.go
1	75.41	0.0%	pkg/storage/postgres/registry.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	24740199847.1	21 Apr 2026 07:01PM UTC	696	45.68	GitHub Action Run

pomerium / pomerium / 24740199847
45%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Changes

Coverage Regressions

Jobs

Source Files on build 24740199847

pomerium / pomerium / 24740199847 45%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Uncovered Changes

Coverage Regressions

Jobs

Source Files on build 24740199847

pomerium / pomerium / 24740199847
45%

README BADGES
x