Yassin Kortam f3639a6fb3 fix(mcp): let a salt-key-orphaned OAuth credential be replaced by re-authorization (#37672) ... store_user_oauth_credential refused to overwrite any existing row that did not decode as an OAuth2 payload, which conflated two states: a live BYOK secret that reads back as plaintext, and ciphertext written under a LITELLM_SALT_KEY the proxy no longer holds. The second is unrecoverable by any caller, so refusing preserved nothing and instead wedged the user out of the OAuth flow permanently, since re-authorizing is their only recovery. The guard now raises only when the existing value is genuinely readable. An undecryptable row is logged and replaced by the newly authorized token. Both read paths were equally silent: get_user_oauth_credential and list_user_oauth_credentials (which backs the bulk prefetch) each dropped an undecryptable row indistinguishably from "user never authorized", so an operator saw an upstream 401 and no hint that a credential had failed to decrypt. Both now warn with the user and server ids, never the stored value.		2026-08-20 14:11:17 -07:00
..
mcp_server	fix(mcp): let a salt-key-orphaned OAuth credential be replaced by re-authorization (#37672)	2026-08-20 14:11:17 -07:00