Repository navigation
Conversation
…ientSecret on refresh Resolves google-gemini#29577 - Add access_type=offline and prompt=consent to Google authorization URLs in buildAuthorizationUrl to ensure refresh tokens are issued. - Store clientSecret in OAuthCredentials and MCPOAuthTokenStorage. - Forward clientSecret in getStoredOAuthToken and MCPOAuthProvider during refreshAccessToken to support confidential client refresh. - Add unit tests in oauth-flow, oauth-token-storage, and oauth-provider test suites.
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
📊 PR Size: size/M
|
🛑 Action Required: Evaluation ApprovalSteering changes have been detected in this PR. To prevent regressions, a maintainer must approve the evaluation run before this PR can be merged. Maintainers:
Once approved, the evaluation results will be posted here automatically. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses authentication issues with remote MCP servers using Google OAuth 2.0. It ensures that the necessary parameters are provided during the initial authorization flow to receive refresh tokens and fixes a bug where missing client secrets caused background token refresh failures. Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
![gemini-code-assist[bot]](/web-api/iframe-proxy?url=https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds support for storing, preserving, and refreshing OAuth tokens using a clientSecret in the MCP OAuth provider and token storage. Additionally, it updates Google OAuth authorization URLs to automatically append access_type=offline and prompt=consent parameters if they are not already present. Feedback on these changes suggests using the nullish coalescing operator (??) instead of the logical OR operator (||) when resolving the clientSecret in oauth-token-storage.ts to ensure empty strings are not incorrectly overridden.
|
Hi there! Thank you for your interest in contributing to Gemini CLI. To ensure we maintain high code quality and focus on our prioritized roadmap, we only guarantee review and consideration of pull requests for issues that are explicitly labeled as 'help wanted'. This PR will be closed in 7 days if it remains without that designation. We encourage you to find and contribute to existing 'help wanted' issues in our backlog! Thank you for your understanding. |
|
Hi team, I've submitted a complete fix for this in PR #29578 to fix the MCP issue #29577 . The automated PR bot mentioned that community PRs are only reviewed if the associated issue has the Trying luck here, - could a maintainer please triage this issue and add the Thanks! |
This branch is waiting to be deployed
1 participant
Summary
Fixes an issue where remote MCP servers configured with OAuth 2.0 against Google endpoints (e.g. Google Workspace APIs such as Docs, Sheets, Slides, Drive) or other confidential OAuth providers fail to receive refresh tokens on initial login and fail during background token refresh, trapping users in an hourly re-authentication loop.
Details
Offline Access & Consent Prompt for Google Endpoints:
In
packages/core/src/utils/oauth-flow.ts(buildAuthorizationUrl), when the authorization URL targets Google endpoints (accounts.google.comor*.google.com), automatically appendaccess_type=offlineandprompt=consent(if not already explicitly provided in the URL). This mirrors the CLI's internal OAuth login inpackages/core/src/code_assist/oauth2.tsand ensures Google issues arefresh_tokenupon authorization code exchange instead of only a transient 1-houraccess_token.clientSecretStorage & Propagation on Refresh:When an MCP server's OAuth client is registered with a
client_secret(as is required by Google for Web/Desktop client applications during token refresh), Google's token endpoint (https://oauth2.googleapis.com/token) strictly rejects refresh requests withclient_secret is missingif the secret is omitted:clientSecret?: stringtoOAuthCredentials(packages/core/src/mcp/token-storage/types.ts).MCPOAuthTokenStorage.saveTokento accept and preserveclientSecretacross updates.MCPOAuthProvider.getValidTokenandMCPOAuthProvider.getValidTokenWithMetadatato resolve and forwardclientSecrettorefreshAccessTokenand persist it on subsequent saves.getStoredOAuthToken(packages/core/src/tools/mcp-client.ts) to forwardclientSecretfrom stored credentials.Related Issues
Fixes #29577
Related to #29048
How to Validate
oauth-flow:npm test -w @google/gemini-cli-core -- src/utils/oauth-flow.test.tsnpm test -w @google/gemini-cli-core -- src/mcp/oauth-token-storage.test.ts src/mcp/oauth-provider.test.tsPre-Merge Checklist