Add MCP OAuth 2.1 compliance — browser flow replaces copy-paste URLs#8

Merged

rianvdm merged 19 commits intomainfrom

feature/oauth-flow

Mar 16, 2026

Commits on Mar 15, 2026

Add OAuth flow redesign spec

rianvdm
and
claude
committed

Commits on Mar 16, 2026

Update OAuth flow spec after review iterations

rianvdm
and
claude
committed
feat: install @cloudflare/workers-oauth-provider
rianvdm
committed
feat: update Env type for OAuth provider, remove JWT_SECRET
rianvdm
committed
fix: remove OAuth signing key from console logs (security)

rianvdm
and
claude
committed
refactor: createMcpServer factory with setContext for OAuth + session paths

rianvdm
and
claude
committed
feat: add DiscogsOAuthHandler skeleton
rianvdm
committed
feat: implement /.well-known/oauth-protected-resource endpoint
rianvdm
committed
feat: implement /authorize — Discogs request token + KV store

rianvdm
and
claude
committed
feat: implement /discogs-callback — token exchange + completeAuthorization

rianvdm
and
claude
committed
feat: implement /login and /callback manual login path with CSRF

rianvdm
and
claude
committed
feat: add src/index-oauth.ts — MCP OAuth 2.1 entry point
rianvdm
committed
feat: point wrangler.toml at index-oauth.ts, delete jwt.ts

rianvdm
and
claude
committed
fix: update integration tests for OAuth flow

rianvdm
and
claude
committed
test: routing and 401 behavior for index-oauth.ts

rianvdm
and
claude
committed
test: full OAuth 2.1 round-trip integration test

rianvdm
and
claude
committed
test: manual login round-trip integration test
rianvdm
committed
Fix: Define SessionPayload locally in server.ts after removing jwt.ts

rianvdm
and
claude
committed
fix: add OAUTH_KV binding required by @cloudflare/workers-oauth-provider
rianvdm
committed