atlatl/mcphub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: OAuth user fixes + dashboard UI improvements (v3.2.0)

Browse Source 
- Bug A: Fix OAuth consent redirect loop (return_url path-relative)
- Bug B: Accept OAuth JWT tokens on /u/{user_id}/{alias}/mcp
- Bug C: Add user OAuth client CRUD (list/create/delete) + new page
- D-1: Sidebar border via Tailwind class, version footer in sidebar
- D-2: Remove broken setInterval targeting #stats-container
- D-3: 404.html purple primary colors + system dark mode support
- D-4: Fix invisible buttons (bg-gray-200 + text-white in light mode)
- D-5: Pin Alpine.js to 3.14.8, remove duplicate CSRF meta tag
- D-6: Fix invisible lang toggle button in settings (dark mode)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
airano
2026-02-25 23:27:59 +03:30
parent ea51c10e03
commit fdb050454e
17 changed files with 538 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

57
CHANGELOG.md
View File

@@ -5,48 +5,25 @@ All notable changes to MCP Hub will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
---
## [3.2.0] — 2026-02-25
## [3.2.0] - 2026-02-24
### Fixed
- **Bug A**: OAuth consent redirect loop — after GitHub/Google login, page now returns to consent screen instead of `/dashboard`
- **Bug B**: `/u/{user_id}/{alias}/mcp` endpoint now accepts OAuth JWT tokens (issued after social login) in addition to `mhu_` API keys
- **Bug C**: OAuth users can now create, list, and delete their own OAuth clients via the new `/dashboard/connect/oauth-clients` page
- **D-1**: Dashboard sidebar border uses Tailwind class instead of inline style; version shown in footer
- **D-2**: Removed broken `setInterval` in dashboard that targeted non-existent `#stats-container`
- **D-3**: 404 page uses purple primary colors and respects system dark mode preference
- **D-4**: Fixed invisible buttons (`bg-gray-200` + `text-white` in light mode) across api-keys, health, projects pages
- **D-5**: Pinned Alpine.js to 3.14.8; removed duplicate CSRF meta tag from `head_assets.html`
- **D-6**: Fixed invisible language toggle button in settings (dark mode)
### claude.ai Protocol Compatibility & Social Login Consent
Adds full MCP Authorization Specification compliance for claude.ai Connectors, social login on the OAuth consent screen, and 15 bug fixes from comprehensive testing.
#### Added
- **`client_secret_basic` Authentication** (RFC 6749 §2.3.1): Token endpoint now accepts client credentials via `Authorization: Basic` header in addition to `client_secret_post`
- **Token Revocation Endpoint** (RFC 7009): `POST /oauth/revoke` for revoking access and refresh tokens, with `client_secret_basic` support
- **`resource` Parameter** (RFC 8707): Authorization and token requests accept the `resource` parameter; JWT access tokens include the `aud` claim binding tokens to the MCP server URL
- **Social Login on OAuth Consent**: OAuth authorize page detects dashboard sessions, allowing users logged in via GitHub/Google to authorize MCP clients without re-entering API keys
- **Session-Based Consent**: `__session__` consent mode creates JWT tokens with `sub: "admin:..."` or `sub: "user:..."` claims based on session identity
- **Social Login Return URL**: `mcp_auth_next` cookie preserves OAuth flow state across social login redirects, with open redirect protection
#### Fixed
- `get_system_info` returned hardcoded version `v2.6.0` instead of actual version
- Internal `"phase": "X.3"` debug field exposed in system info
- `/dashboard/audit-logs` caused redirect loop (removed from nav)
- Settings page used wrong sidebar layout
- Server mode displayed `sse` instead of `streamable-http`
- Plugin descriptions showed "No description" when description existed
- 404 page was unstyled plain text (now styled standalone page)
- OAuth flows failed without `PUBLIC_URL` env var
- Endpoint page showed wrong example tools per project
- Health check timestamps showed "None" for new projects
- Health checks missing `auth_valid` field causing dashboard errors
- `ENCRYPTION_KEY` not validated on startup (now fails fast with clear error)
- Stale JWT tokens caused 500 errors instead of 401
- Per-user MCP endpoint returned 500 `ImportError` on first request
- Copy button displayed Python `repr()` instead of clean JSON
#### Improved
- API key modal stays open until user clicks "Done" (was 0.5s auto-close)
- `health_metric_recorded` events filtered from project activity feed
- WooCommerce health checks use `consumer_key`/`consumer_secret` authentication
#### Tests
- Test suite expanded from 290 to 442 tests (+152)
- Added 23 Phase B OAuth protocol tests
- Added Phase C social login consent tests
### Added
- `OAuthClient.owner_user_id` field for per-user OAuth client isolation
- `dashboard_connect_page` now includes Claude.ai connection guide with endpoint URL and link to OAuth Clients
- New route: `GET /dashboard/connect/oauth-clients` — user's OAuth clients list
- New API: `POST /api/dashboard/user-oauth-clients/create` — create OAuth client for logged-in user
- New API: `DELETE /api/dashboard/user-oauth-clients/{client_id}` — delete own OAuth client
---