Sameer Kankute fe309ea0b0 fix(mcp): remove auth gate from OAuth broker authorize and token endpoints ... Browser-initiated OAuth flows cannot send an API key, so requiring user_api_key_auth on /server/oauth/{id}/authorize and /server/oauth/{id}/token caused a 401 for all end users. Remove the dependency from both endpoints and make user_api_key_dict optional in _get_cached_temporary_mcp_server_or_404 so unauthenticated OAuth browser flows skip the admin-view gate. Add regression tests: - unit tests for loopback validation, state round-trip, and token validation - respx HTTP integration tests covering the full authorize → callback → token flow - Playwright E2E: Layer 1 directly asserts /authorize returns !401 without an API key; Layer 2 asserts the full UI OAuth form flow succeeds - extend test-mcp.yml CI job to run both new test files Co-authored-by: Cursor <cursoragent@cursor.com>		2026-05-05 20:28:51 +05:30
..
litellm-dashboard	fix(mcp): remove auth gate from OAuth broker authorize and token endpoints	2026-05-05 20:28:51 +05:30