ci: assert WorkOS OAuth refresh metadata by dodeja · Pull Request #339 · Terminal49/API

dodeja · 2026-08-21T12:49:29Z

Summary

verify the live Terminal49 discovery path redirects to WorkOS metadata advertising refresh_token and offline_access
run the public metadata smoke independently of the authenticated preview credential
document the human refresh-token smoke using the local OAuth test client

Verification

git diff --check
workflow YAML parses successfully
exact live metadata assertion passes locally
all PR CI and Vercel checks pass, including the MCP preview 2026-07-28 refresh metadata assertion

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Greptile Summary

This PR adds an independent live assertion that production WorkOS metadata advertises refresh-token support and expands the OAuth setup runbook with automated and human refresh smoke procedures.

Runs preview discovery and commit verification without requiring the authenticated MCP evaluation credential.
Checks production authorization-server metadata for refresh_token and offline_access.
Documents refresh-capable dynamic registration and an end-to-end human token-refresh flow.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking documentation correction needed so the runbook accurately identifies production as the environment validated by CI.

The workflow’s live metadata check is consistent with the stated production-smoke intent, but the accompanying runbook incorrectly claims that the check follows the preview deployment’s redirect.

Files Needing Attention: packages/mcp/WORKOS_MCP_SETUP.md

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds a production refresh-metadata assertion and makes preview discovery independent of the authenticated smoke credential; no blocking workflow defect was established.
packages/mcp/WORKOS_MCP_SETUP.md	Adds detailed automated and human refresh smoke guidance, but inaccurately describes the production metadata assertion as validating the preview deployment’s redirect.

Prompt To Fix All With AI

### Issue 1
packages/mcp/WORKOS_MCP_SETUP.md:98-99
**Correct the validated environment**

This text says CI follows the preview deployment’s authorization-server redirect, but the workflow requests the fixed production `mcp.terminal49.com` URL. Maintainers can therefore mistake successful CI for evidence that preview-specific OAuth configuration advertises refresh support.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix: check live oauth metadata in previe..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Co-authored-by: Akshay Dodeja <dodeja@gmail.com>

vercel · 2026-08-21T12:49:35Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
api	Ready	Preview	Aug 21, 2026 12:53pm

Co-authored-by: Akshay Dodeja <dodeja@gmail.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de7aa90170

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-21T13:28:34Z

+CI follows the preview deployment's authorization-server metadata redirect and
+fails if `grant_types_supported` omits `refresh_token` or `scopes_supported`


Correct the claim that CI checks the preview redirect

The workflow does not follow the preview deployment’s metadata redirect: .github/workflows/ci.yml hard-codes https://mcp.terminal49.com/.well-known/oauth-authorization-server. Consequently, a preview with a broken redirect or incorrect WorkOS issuer can still pass while production remains healthy, so this operational guide gives maintainers false assurance about what CI validates; describe this as a production metadata check or change the workflow to query the resolved preview origin.

Useful? React with 👍 / 👎.

greptile-apps · 2026-08-21T13:29:13Z

+CI follows the preview deployment's authorization-server metadata redirect and
+fails if `grant_types_supported` omits `refresh_token` or `scopes_supported`


Correct the validated environment

This text says CI follows the preview deployment’s authorization-server redirect, but the workflow requests the fixed production mcp.terminal49.com URL. Maintainers can therefore mistake successful CI for evidence that preview-specific OAuth configuration advertises refresh support.

Prompt To Fix With AI

This is a comment left during a code review. Path: packages/mcp/WORKOS_MCP_SETUP.md Line: 98-99 Comment: **Correct the validated environment** This text says CI follows the preview deployment’s authorization-server redirect, but the workflow requests the fixed production `mcp.terminal49.com` URL. Maintainers can therefore mistake successful CI for evidence that preview-specific OAuth configuration advertises refresh support. --- For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

vorflux

Summary

Reviewed — found 2 issues in the CI workflow and WorkOS setup runbook. The new assertion correctly checks refresh-token metadata, but the workflow now makes secretless runs depend on unrelated Vercel preview steps, and the runbook describes the check as preview-specific even though it targets production.

Findings

`.github/workflows/ci.yml`

Restore the credential guard around preview-only deployment discovery and validation steps.

`packages/mcp/WORKOS_MCP_SETUP.md`

Describe the refresh metadata assertion as a production check rather than a preview redirect check.

Verdict

⚠️ Changes requested. The current workflow can fail secretless CI because of unrelated preview availability, and the runbook overstates PR-specific coverage.

Review with Vorflux

vorflux · 2026-08-21T13:30:40Z

@@ -193,7 +192,6 @@ jobs:
        if: steps.credential.outputs.available == 'true'
        run: npm ci
      - name: Wait for this commit's Vercel preview


Restore the credential guard around preview-only steps. The metadata assertion requests the fixed production URL in AUTHORIZATION_SERVER_METADATA_URL and does not consume either the Vercel deployment or steps.preview.outputs.endpoint. However, this change also removes if: steps.credential.outputs.available == 'true' from Wait for this commit's Vercel preview, Resolve Vercel preview endpoint, and Verify preview still belongs to this commit. When MCP_EVAL_TOKEN is unavailable, both matrix jobs now wait for and validate a Vercel preview even though the authenticated preview smoke is skipped; only the 2026-07-28 job then performs the independent production metadata check. A delayed deployment, missing Vercel status, or missing/churned bot comment can therefore fail CI for reasons unrelated to this assertion. Please restore the credential guard on those three preview-only steps so the production metadata assertion can run independently. Alternatively, if the preview is intended to be tested, use the resolved preview origin in the assertion.

vorflux · 2026-08-21T13:30:40Z

 #   aud == https://mcp.terminal49.com
 ```

+CI follows the preview deployment's authorization-server metadata redirect and


Describe this as a production metadata check. CI no longer follows the preview deployment's metadata redirect: the workflow hard-codes https://mcp.terminal49.com/.well-known/oauth-authorization-server, so it follows the production deployment's redirect instead. Please describe this as a live/production metadata check, or change the workflow to request the resolved preview origin. As written, maintainers may incorrectly assume a PR's redirect handler and preview environment configuration are covered.

ci: assert oauth refresh metadata

a5c1e06

Co-authored-by: Akshay Dodeja <dodeja@gmail.com>

vercel Bot deployed to Preview August 21, 2026 12:50 View deployment

fix: check live oauth metadata in preview CI

de7aa90

Co-authored-by: Akshay Dodeja <dodeja@gmail.com>

vercel Bot deployed to Preview August 21, 2026 12:53 View deployment

dodeja marked this pull request as ready for review August 21, 2026 13:26

dodeja merged commit 9d6851f into main Aug 21, 2026
22 checks passed

chatgpt-codex-connector Bot reviewed Aug 21, 2026

View reviewed changes

greptile-apps Bot reviewed Aug 21, 2026

View reviewed changes

vorflux Bot reviewed Aug 21, 2026

View reviewed changes

Navigation Menu

Uh oh!

ci: assert WorkOS OAuth refresh metadata - #339

ci: assert WorkOS OAuth refresh metadata#339
dodeja merged 2 commits into
mainfrom
cursor/assert-oauth-refresh-metadata-a570

dodeja commented Aug 21, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

vercel Bot commented Aug 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 21, 2026

Uh oh!

greptile-apps Bot Aug 21, 2026

Uh oh!

vorflux Bot left a comment

Uh oh!

vorflux Bot Aug 21, 2026

Uh oh!

vorflux Bot Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		CI follows the preview deployment's authorization-server metadata redirect and
		fails if `grant_types_supported` omits `refresh_token` or `scopes_supported`

Uh oh!

Conversation

dodeja commented Aug 21, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

vercel Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

vorflux Bot left a comment

Choose a reason for hiding this comment

Summary

Findings

.github/workflows/ci.yml

packages/mcp/WORKOS_MCP_SETUP.md

Verdict

Uh oh!

vorflux Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

vorflux Bot Aug 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dodeja commented Aug 21, 2026 •

edited by greptile-apps Bot

Loading

vercel Bot commented Aug 21, 2026 •

edited

Loading

`.github/workflows/ci.yml`

`packages/mcp/WORKOS_MCP_SETUP.md`