Alberto de la Cruz 718b226177 fix: discover MCP Protected Resource Metadata when server does not return 401 (#25980) ... get_protected_resource_metadata() only attempted RFC 9728 discovery when the anonymous `initialize` probe returned 401 with a WWW-Authenticate header. Some remote MCP servers — notably Google's Gmail/Drive/Calendar MCPs (gmailmcp.googleapis.com, etc.) — answer 200 to an anonymous initialize, so OAuth scope and authorization-server discovery silently failed and connections to them could not be established. Run the discovery regardless of the probe's HTTP status: prefer the resource_metadata URL from WWW-Authenticate when present, and otherwise fall back to the RFC 9728 §4.2 well-known URIs. The trade-off is a couple of extra well-known GETs during MCP connection setup for servers that expose no PRM document; behavior for 401-responding servers is unchanged.		2026-06-29 04:34:36 -05:00
..
access_control	Confer object-derived file write only for files the object owner owns (#26032)	2026-06-17 03:05:57 +02:00
images	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
mcp	refac	2026-06-19 15:34:43 +02:00
telemetry	refac(telemetry): drop deprecated semconv SpanAttributes subclass (#25784)	2026-06-29 02:05:34 -05:00
actions.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
anthropic.py	refac	2026-06-17 00:36:34 +02:00
asgi_middleware.py	refac	2026-06-17 02:52:35 +02:00
audit.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
auth.py	refac	2026-06-29 03:58:00 -05:00
automations.py	refac	2026-06-29 00:05:10 -05:00
calendar.py	feat: add repeat/recurrence dropdown to calendar event modal (#25865)	2026-06-29 02:16:19 -05:00
channels.py	refac	2026-03-17 17:58:01 -05:00
chat.py	Enforce per-model access on arena fallback before bypass_filter dispatch (#26046)	2026-06-16 22:45:42 +02:00
code_interpreter.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
context_compaction.py	refac	2026-06-24 14:13:58 +02:00
embeddings.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
files.py	perf(images): offload validate_url() DNS resolution with asyncio.to_thread (#25825)	2026-06-29 02:31:24 -05:00
filter.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
groups.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
headers.py	fix: strip whitespace from user info headers to prevent MCP connection failures (#26182)	2026-06-29 00:57:07 -05:00
logger.py	chore: format	2026-06-01 13:56:55 -07:00
memory.py	refac	2026-06-29 00:35:54 -05:00
middleware.py	refac	2026-06-29 03:13:17 -05:00
misc.py	Match WEB_FETCH_FILTER_LIST on hostnames with label boundaries, not URL suffix (CWE-693) (#25949)	2026-06-16 23:53:08 +02:00
models.py	refac	2026-06-23 00:25:21 +02:00
oauth.py	fix: discover MCP Protected Resource Metadata when server does not return 401 (#25980)	2026-06-29 04:34:36 -05:00
payload.py	refac	2026-06-29 00:18:40 -05:00
pdf_generator.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
plugin.py	refac	2026-06-25 14:37:05 +01:00
rate_limit.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
redis.py	fix(redis): use await asyncio.sleep() instead of time.sleep() in async generator (#25823)	2026-06-29 02:25:46 -05:00
response.py	refac	2026-06-23 23:35:44 +02:00
sanitize.py	refac	2026-03-17 17:58:01 -05:00
security_headers.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
session_pool.py	refac: modernize type annotations (PEP 604 / PEP 585)	2026-05-12 17:10:15 +09:00
task.py	refac	2026-06-19 00:16:06 +02:00
tools.py	refac	2026-06-29 04:03:06 -05:00
validate.py	chore: format	2026-06-01 13:56:55 -07:00
webhook.py	perf(images): offload validate_url() DNS resolution with asyncio.to_thread (#25825)	2026-06-29 02:31:24 -05:00