mirror of
https://github.com/BerriAI/litellm.git
synced 2026-08-28 05:25:59 +00:00
f1383f16fa
mcpTokenStore was the only OAuth path writing straight to window.sessionStorage; useMcpOAuthFlow, useToolsOAuthFlow, the callback page and the edit-screen UI state all already go through secureStorage. Align it so the OAuth surface has one storage format instead of two. The stored payload also carried a refresh_token that nothing ever read back. All three read sites take access_token only, and nothing reads the mcp-session-token: keys directly, so the field was write-only. Drop it from the store and from the four callers that populated it. The client-forwarded modes (true_passthrough and oauth_delegate) re-authorize rather than refresh, and authorization_code is unaffected because it persists through storeMCPOAuthUserCredential on the backend, which keeps its own refresh token. Entries written before this change decode to null and are treated as absent, which surfaces the normal Authorize prompt; they are session-scoped and expire in an hour. Add two regression tests that decode the stored value before asserting, so neither can pass merely because the payload is no longer plain text. |
||
|---|---|---|
| .. | ||
| litellm-dashboard | ||
| Dockerfile | ||
| nginx.conf | ||