From a926210a510a8888d227d866312619f327ea2b9b Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Wed, 17 Jun 2026 20:45:43 +0200 Subject: [PATCH] fix(auth): clarify empty-allowlist startup warning when userinfo is configured Address claude-review round 9 on #919: an empty ALLOWED_MGMT_CLIENT is no longer a kill switch when userinfo_uri is configured (opaque tokens validated via the userinfo fallback bypass the allowlist). Distinguish the two cases in the startup warning so operators aren't surprised that Astrolabe tokens are still accepted. Co-Authored-By: Claude Opus 4.8 (1M context) --- nextcloud_mcp_server/auth/unified_verifier.py | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/nextcloud_mcp_server/auth/unified_verifier.py b/nextcloud_mcp_server/auth/unified_verifier.py index d49a7642..be55f2b3 100644 --- a/nextcloud_mcp_server/auth/unified_verifier.py +++ b/nextcloud_mcp_server/auth/unified_verifier.py @@ -115,10 +115,20 @@ class UnifiedTokenVerifier(TokenVerifier): if entry.strip() ) if not self._allowed_mgmt_clients: - logger.warning( - "ALLOWED_MGMT_CLIENT is unset or empty: management API will reject " - "all requests until configured." - ) + if self.userinfo_uri: + # An empty allowlist is NOT a kill switch when userinfo is + # configured: opaque tokens validated via the userinfo fallback + # bypass ALLOWED_MGMT_CLIENT (per-user authz still applies). + logger.warning( + "ALLOWED_MGMT_CLIENT is unset: JWT/introspection management " + "tokens will be rejected, but opaque tokens may still be " + "accepted via the userinfo fallback." + ) + else: + logger.warning( + "ALLOWED_MGMT_CLIENT is unset or empty: management API will " + "reject all requests until configured." + ) else: logger.info( "Management API allowlist: %s", sorted(self._allowed_mgmt_clients)