feat(mcp): add internal OIDC issuer for MCP authentication#2457

Open

topher-lo wants to merge 11 commits intomainfrom

feat/mcp-internal-oidc-v2

Commits on Apr 3, 2026

feat(mcp): add internal OIDC issuer for MCP authentication

topher-lo
and
claude
committed
refactor(mcp): rewire MCP auth to use internal OIDC issuer

topher-lo
and
claude
committed
feat(ui): add MCP auth resume and org picker frontend routes

topher-lo
and
claude
committed
chore(infra): update MCP service config for internal OIDC issuer

topher-lo
and
claude
committed
fix(mcp): resolve OIDC issuer compatibility issues and add tests

topher-lo
and
claude
committed
fix(mcp): address OIDC security and correctness review feedback

topher-lo
and
claude
committed
fix(mcp): update OIDC test fixtures to match refactored secret accessors

topher-lo
and
claude
committed
fix(mcp): grant MCP role IAM access to USER_AUTH_SECRET and fix token rate limiting

topher-lo
and
claude
committed
fix(mcp): key OIDC token rate limit by source IP instead of client_id

topher-lo
and
claude
committed
fix(mcp): handle session resolution errors in OIDC authorize flow

topher-lo
and
claude
committed
fix(mcp): avoid leaking exception details in OIDC authorize error response

topher-lo
and
claude
committed