fix(DATAGO-121085): Adding Platform OAuth Callback endpoint to list of skipped paths

[Hugo-Pare]

What is the purpose of this change?

Allows MCP OAuth callback endpoint to receive redirects from external OAuth providers without requiring authentication (fixes "Not authenticated" errors during OAuth flow).

How was this change implemented?

Single Line Change:

• src/solace_agent_mesh/shared/auth/middleware.py: Added /api/v1/platform/mcp/oauth/callback to skip_paths list

Key Design Decisions

OAuth providers redirect to callback URLs without authentication credentials. The callback endpoint must be publicly accessible to complete the OAuth flow, then validates the OAuth state parameter for CSRF protection.

How was this change tested?

• Manual testing: Successfully completed OAuth flow with Miro MCP server
• Unit tests: No middleware tests exist
• Integration tests: Existing MCP OAuth integration tests should pass
• Known limitations: Only tested with MCP OAuth flows

Is there anything the reviewers should focus on/be aware of?

Security: The endpoint is protected by OAuth state parameter validation - no user authentication needed at callback time since the external provider redirects without our session context.

[sonarqube-solacecloud]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube