From fd8c037eea869133ffc41f7c323fdc1836b96c60 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Sat, 9 May 2026 14:03:42 +0200 Subject: [PATCH] fix(login-flow): allow Astrolabe's OAuth client on the management API MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `mcp-login-flow` profile's `ALLOWED_MGMT_CLIENT` was set to the test-fixture id `nextcloudMcpServerUIPublicClient` only, but the actual Astrolabe app provisions its OIDC client as `astrolabeMcpClientOAuth00000000000` (see `app-hooks/before-starting/26-configure-astrolabe-oauth.sh:39`). All tokens issued through the "Enable Semantic Search" flow were rejected with HTTP 401 by `unified_verifier.py:222-227`'s allowlist check, and the Astrolabe UI's retry loop subsequently exhausted the `api/passwords.py` 5/hr rate limit (HTTP 429). Switch the `mcp-login-flow` allowlist to Astrolabe's client id so production-shaped traffic actually validates. The `mcp-multi-user-basic` profile keeps `nextcloudMcpServerUIPublicClient` for the `configure_astrolabe_for_mcp_server` test fixture. Also bump `third_party/astrolabe` 0.13.12 → 0.14.0 to pull in the chunk-context indexed-lookup fix (#75) and the PDF bbox highlight overlay (#76) that match the master-side changes already merged on this branch. Co-Authored-By: Claude Opus 4.7 (1M context) --- docker-compose.yml | 2 +- third_party/astrolabe | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 208ce05e..46984db5 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -293,7 +293,7 @@ services: # the same configure_astrolabe_for_mcp_server fixture (which creates the # static `nextcloudMcpServerUIPublicClient` OIDC client) works for tests # against this profile too. - - ALLOWED_MGMT_CLIENT=nextcloudMcpServerUIPublicClient + - ALLOWED_MGMT_CLIENT=astrolabeMcpClientOAuth00000000000 volumes: - login-flow-data:/app/data - login-flow-oauth-storage:/app/.oauth diff --git a/third_party/astrolabe b/third_party/astrolabe index d9e641b9..7e08b498 160000 --- a/third_party/astrolabe +++ b/third_party/astrolabe @@ -1 +1 @@ -Subproject commit d9e641b93e6511fba0c27acc06ee0733fcdd5add +Subproject commit 7e08b4983ae03675a81039d85c7056eb7a3bd70e