J.C. Bartle bf251b820f ♻️ refactor: Pass OBO upstream-token closure into MCP instead of req ... Build the OpenID upstream-token provider at the request boundary and thread only the closure through MCP handling, so the MCP service layer no longer receives the raw Express request. The closure still reads/refreshes the live session at tool-call time, preserving the walk-away recovery. - Drop `req`/`capturedReq` from createMCPTools, createMCPTool, reconnectServer, createToolInstance, and reinitMCPServer; forward `upstreamTokenProvider` instead. Closure is constructed in loadTools, loadToolDefinitionsWrapper, and the reinitialize route, where req/res are in scope. - OBO: fall back to user.federatedTokens when the provider yields no live session, so OIDC remote-agent calls (verified bearer, no session) still work. - Inline refresh: mirror a rotated refresh token to the refreshToken cookie via a shared setRefreshTokenCookie helper, guarded by !res.headersSent (no-op on the streaming path; session copy stays authoritative). - Single-flight: hydrate a joining request's own session from the resolved tokens so a later OBO call doesn't replay a rotated-away refresh token. Addresses owner feedback and three review findings.		2026-06-23 11:59:01 -04:00
..
clients	♻️ refactor: Pass OBO upstream-token closure into MCP instead of req	2026-06-23 11:59:01 -04:00
index.js	🛠️ fix: Optionally add OpenID Sig. Algo. from Server Discovery (#5398)	2025-01-21 21:49:27 -05:00