fix(mcp,google-discovery): persist pending OAuth sessions via binding store - #221
Merged
Conversation
… store
The mcp and google-discovery plugins kept pending OAuth sessions in an
in-process Map on the plugin closure. In cloud, createOrgExecutor runs
per-request on Cloudflare Workers, so the redirect-back request built a
fresh plugin with an empty Map and completeOAuth failed with
"OAuth session not found".
Persist sessions through the existing KV-backed binding stores under a
new ${namespace}.oauth-sessions scoped namespace, with a 15-minute TTL
enforced via an expiresAt field filtered on read.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
executor-marketing | 7e49e4c | Commit Preview URL Branch Preview URL |
Apr 13 2026, 06:50 AM |
@executor/sdk
@executor/plugin-file-secrets
@executor/plugin-google-discovery
@executor/plugin-graphql
@executor/plugin-keychain
@executor/plugin-mcp
@executor/plugin-onepassword
@executor/plugin-openapi
@executor/plugin-workos-vault
commit: |
Promote McpOAuthSession and GoogleDiscoveryOAuthSession from plain TS interfaces to Schema.Struct definitions, and swap JSON.parse/stringify with Schema.parseJson in both binding stores so corrupt or schema-drifted KV entries surface a parse error instead of silently flowing through as unchecked any. Matches the StoredBindingEntry pattern already used in the same files.
RhysSullivan
added a commit
that referenced
this pull request
May 31, 2026
… store (#221) * fix(mcp,google-discovery): persist pending OAuth sessions via binding store The mcp and google-discovery plugins kept pending OAuth sessions in an in-process Map on the plugin closure. In cloud, createOrgExecutor runs per-request on Cloudflare Workers, so the redirect-back request built a fresh plugin with an empty Map and completeOAuth failed with "OAuth session not found". Persist sessions through the existing KV-backed binding stores under a new ${namespace}.oauth-sessions scoped namespace, with a 15-minute TTL enforced via an expiresAt field filtered on read. * refactor(mcp,google-discovery): schema-encode persisted OAuth sessions Promote McpOAuthSession and GoogleDiscoveryOAuthSession from plain TS interfaces to Schema.Struct definitions, and swap JSON.parse/stringify with Schema.parseJson in both binding stores so corrupt or schema-drifted KV entries surface a parse error instead of silently flowing through as unchecked any. Matches the StoredBindingEntry pattern already used in the same files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mapon the plugin closure. In cloud,createOrgExecutorruns per-request on Cloudflare Workers (apps/cloud/src/api/protected.ts:43), so the OAuth provider's redirect-back request built a fresh plugin instance with an emptyMapandcompleteOAuthfailed withOAuth session not found: mcp_oauth_<uuid>.${namespace}.oauth-sessionsscoped namespace.expiresAt(15 min TTL) and are filtered + cleaned up on read. In-memory binding stores get a third in-memory KV soapps/localand tests behave the same.Notes
codeVerifierand (for MCP) dynamically-registered client info now land in plain KV alongside the existing bindings/sources data — same trust level as what's already there. The actual access/refresh tokens still go throughctx.secrets→ WorkOS Vault unchanged.MCP_OAUTH_SESSION_TTL_MS/GOOGLE_DISCOVERY_OAUTH_SESSION_TTL_MSif we want to tune it later.Test plan
bunx vitest runinpackages/plugins/mcp— 19/19 passbunx vitest runinpackages/plugins/google-discovery— 6/6 passbun --filter=@executor/plugin-mcp typecheckbun --filter=@executor/plugin-google-discovery typecheckcompleteOAuthsucceeds and stores tokens