devin-ai-integration[bot] 62dee3d730 feat(claude_code_gateway): issue rotating refresh tokens and a revocation endpoint (#44635) ... * feat(claude_code_gateway): issue rotating refresh tokens and a revocation endpoint The Claude Code gateway's device-code grant now returns a refresh token alongside the session JWT, so a Claude Code session renews itself before the JWT expires instead of forcing the user back through the browser sign-in. grant_type=refresh_token re-mints the JWT from the live user row, rotates the refresh token, and refuses a replayed, foreign, or identity-only token with invalid_grant. The discovery document now advertises an RFC 7009 revocation endpoint, which Claude Code's /logout calls with both tokens, so sign-out burns the refresh token. The refresh token is the MCP gateway's sealed session refresh token bound to the fixed client id claude_code, so both front doors share one single-use record. * fix(claude_code_gateway): mint the whole credential before claiming the device code A refresh token that failed to mint answered 500 after the device code was already claimed and the login deleted, so the client could not redeem the completed sign-in again. The response is now built first, and the code is claimed only when it is a 200. * fix(claude-code-gateway): keep device sign-in working when session signing is unusable * feat(claude-code-gateway): end the whole refresh chain on a replay or a revocation * fix(mcp-gateway): fail the single-use peek closed on a Redis fault * fix(mcp-gateway): read the single-use marker under the cache namespace * fix(mcp-gateway): refuse a replayed refresh token without ending its chain A refresh token presented a second time is refused as already used and nothing else happens to the chain it was rotated from. Claude Code renews from its in-memory copy of the credential, so a second terminal on the same machine presents the token the first terminal already rotated and then recovers from the shared credential file; ending the chain there would sign both terminals out at every expiry. Only a revocation ends a chain, so the 503-on-unrecorded-chain-ending path and its tests go away. * fix(mcp-gateway): end the refresh chain before burning the revoked token --------- Co-authored-by: mateo-berri <277851410+mateo-berri@users.noreply.github.com>		2026-10-06 20:57:50 -07:00
..
auth	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
faults	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
guardrail_translation	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
outbound_credentials	feat(claude_code_gateway): issue rotating refresh tokens and a revocation endpoint (#44635)	2026-10-06 20:57:50 -07:00
__init__.py	ci: move provider-independent MCP tests into tests/unit and run mcp-integration from litellm-tests (#42904)	2026-09-24 23:07:48 +00:00
conftest.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_byok_credential_cache.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_byok_oauth_endpoints.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_callback_oauth_error_responses.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_capabilities.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_catalog.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_client_allowlist.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_contracts.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_db_credentials.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_discoverable_endpoints.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_gateway_dcr_flow.py	feat(claude_code_gateway): issue rotating refresh tokens and a revocation endpoint (#44635)	2026-10-06 20:57:50 -07:00
test_idp_token_exchange.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_is_tool_name_prefixed.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_jwt_mcp_enforcement.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_jwt_mcp_simple.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_auth_header_extraction.py	ci: move provider-independent MCP tests into tests/unit and run mcp-integration from litellm-tests (#42904)	2026-09-24 23:07:48 +00:00
test_mcp_auth_priority.py	ci: move provider-independent MCP tests into tests/unit and run mcp-integration from litellm-tests (#42904)	2026-09-24 23:07:48 +00:00
test_mcp_block_recording.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_mcp_chat_completions.py	refactor: expose core private helpers under public names (#44871)	2026-10-07 00:05:27 +00:00
test_mcp_client_unit.py	feat(mcp): configure protocol versions and capability discovery (#43169)	2026-09-25 13:13:52 -07:00
test_mcp_cost_calculator.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_custom_fields.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_debug.py	fix(security): remove the publicly known master key from the repo (#44718)	2026-10-06 10:55:24 -07:00
test_mcp_discovery.py	feat(mcp): add Microsoft 365 (Graph) server to the MCP catalog (#43099)	2026-10-02 02:50:29 +00:00
test_mcp_elicitation_handler.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_env_vars.py	refactor(types): replace Any with proven types in 137 files (#44478)	2026-10-05 11:01:45 -07:00
test_mcp_guardrail_usage_monitor.py	feat(mcp): hand listed-tool description and input schema to pre-call hooks per caller (#41162)	2026-10-04 00:53:58 -07:00
test_mcp_header_alias_utils.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_hook_extra_headers.py	fix(security): remove the publicly known master key from the repo (#44718)	2026-10-06 10:55:24 -07:00
test_mcp_logging.py	refactor(mcp): extract upstream preparation and support modern clients (#44232)	2026-10-02 16:04:11 -07:00
test_mcp_max_concurrent_requests.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_metadata_preservation.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_oauth_passthrough.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_oauth_passthrough_cold_start.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_oauth_passthrough_tools.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_partial_update.py	fix(security): remove the publicly known master key from the repo (#44718)	2026-10-06 10:55:24 -07:00
test_mcp_proxy_mode.py	feat(mcp): hand listed-tool description and input schema to pre-call hooks per caller (#41162)	2026-10-04 00:53:58 -07:00
test_mcp_sampling_completion_flow.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sampling_model_access.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sampling_model_resolution.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sampling_priority_selection.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sampling_request_builder.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sampling_response_conversion.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sampling_tool_conversion.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_server.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_mcp_server_identity_env.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_server_manager.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_mcp_server_tool_calls_and_headers.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_mcp_session_logging.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_mcp_sigv4_auth.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_mcp_stale_session.py	fix(security): remove the publicly known master key from the repo (#44718)	2026-10-06 10:55:24 -07:00
test_mcp_tool_search.py	feat(mcp): hand listed-tool description and input schema to pre-call hooks per caller (#41162)	2026-10-04 00:53:58 -07:00
test_mcp_toolset_scope.py	fix(mcp): resolve team-granted toolsets for non-admin keys and dashboard sessions (#43908)	2026-10-01 14:15:06 -07:00
test_oauth2_flow_backfill.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_oauth2_mcp_config.yaml	ci: move provider-independent MCP tests into tests/unit and run mcp-integration from litellm-tests (#42904)	2026-09-24 23:07:48 +00:00
test_oauth2_token_cache.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_oauth_identity_binding.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_oauth_issuer_stamp_backfill.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_openapi_spec_path_url.py	ci: move provider-independent MCP tests into tests/unit and run mcp-integration from litellm-tests (#42904)	2026-09-24 23:07:48 +00:00
test_openapi_to_mcp_generator.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_openapi_tool_auth.py	feat(mcp): hand listed-tool description and input schema to pre-call hooks per caller (#41162)	2026-10-04 00:53:58 -07:00
test_operations.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_per_user_oauth_cache.py	ci: move provider-independent MCP tests into tests/unit and run mcp-integration from litellm-tests (#42904)	2026-09-24 23:07:48 +00:00
test_proxy_api_credentials.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_rest_endpoints.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_result_conversion.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_semantic_tool_filter.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00
test_server_resolution.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_short_mcp_tool_prefix.py	fix(mcp): keep worker MCP configurations consistent via a catalog revision (#42568)	2026-10-06 18:21:29 -07:00
test_state_tokens.py	feat(mcp): add portable catalog pagination (#44446)	2026-10-06 18:54:50 -07:00
test_ui_session_utils.py	fix(mcp): resolve team-granted toolsets for non-admin keys and dashboard sessions (#43908)	2026-10-01 14:15:06 -07:00
test_utils.py	test(proxy): move proxy_server, _experimental and db tests into tests/unit/proxy (#44012)	2026-10-01 18:14:24 +00:00