Make OAuth pending sign-ins storable outside the process

[senamakel]

Summary

OAuthFlow parked each sign-in's PKCE verifier and registered client in a Mutex<HashMap> inside the flow. The redirect could only be completed by the process that began it. A host running several instances behind one callback URL lands the redirect on whichever instance the load balancer picks, and the sign-in fails with "unknown or expired oauth state".

This makes the pending store pluggable:

• PendingAuthorizationStore (object-safe: park, atomic take, peek, count). A host backs it with a store all its instances share.
• MemoryPendingStore is the default, so existing hosts behave as before.
• OAuthFlow::with_pending_store(Arc<dyn PendingAuthorizationStore>).
• PendingAuthorization is now public, with serde, so a host can persist it. Its Debug redacts the verifier and client secret.
• PENDING_TTL_SECS is public so a store can expire entries itself (a TTL index). The flow also refuses any entry older than that, so a store that never expires cannot complete a stale sign-in.

Related issue

None.

API or behavior changes

• Breaking (pre-1.0): OAuthFlow::pending_server and OAuthFlow::pending_count are now async and return Result, because they read the store. No caller outside this crate's tests uses them (checked in OpenHuman).
• New public items: PendingAuthorizationStore, MemoryPendingStore, PendingAuthorization, PENDING_TTL_SECS, OAuthFlow::with_pending_store. They are re-exported from registry.
• No behavior change for hosts that keep the default store.

Validation

• cargo fmt --all -- --check: ok
• cargo clippy --all-targets --all-features -- -D warnings: ok
• cargo build --all-targets --all-features: ok
• cargo test --all-features: all pass
• RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --all-features: ok

Tests

• registry/oauth/pending_tests.rs covers the memory store: take once, peek does not consume, unknown state, expiry drop, expiry boundary, redacted Debug, and the pinned serde form.
• mod_host_store_tests.rs:
  • A sign-in begun on one flow completes on another flow sharing the store.
  • Two racing completions of one state exchange the code exactly once.
  • A store that never expires still cannot complete a stale entry.
• Existing tests are updated for the async pending_*.

Documentation

Module docs on registry/oauth/pending.rs and the oauth module overview.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints. The test file uses the same test-only #![allow(clippy::unwrap_used, ...)] header as every other *_tests.rs
• No secrets, tokens, or .env contents in the diff or the description

Summary by CodeRabbit

• New Features
  • OAuth sign-in requests can now share pending authorization state across application instances, enabling a sign-in started on one instance to be completed on another.
  • Pending authorizations are securely handled, expire after 10 minutes, and can be completed only once.

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Incomplete
Priority: none
Reviewed head: eaba68861b63
Updated: 2026-10-15T13:22:15Z

Review snapshot

Change surface	Files	Review signal	Count
Production	6	Active findings	0
Tests	5	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	0	Pending checks/questions	2

Completeness: Incomplete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

`crates/tinymcp/src/registry/oauth/pending.rs` is a new module defining `PendingAuthorization` (now public, serde-serializable, with a redacted `Debug` and an `expired_at` helper), the object-safe `PendingAuthorizationStore` trait with atomic `take`, and the default `MemoryPendingStore`, which prunes expired entries whenever touched and whose `Debug` shows only a parked count. `crates/tinymcp/src/registry/oauth/flow.rs` replaces the in-process `Mutex<HashMap<String, PendingAuthorization>>` with an `Arc<dyn PendingAuthorizationStore>` defaulting to `MemoryPendingStore`, adds `with_pending_store` for shared stores, routes `begin` through async `park`, and makes `complete` atomically `take` the state and reject entries that the flow itself judges expired — so a lazy store still cannot complete a stale sign-in. `pending_server` and `pending_count` become async, `Result`-returning methods, a breaking signature change reflected in all call sites. The `PendingAuthorization` struct is removed from `crates/tinymcp/src/registry/oauth/types.rs` in favor of the new public one, and the new items plus `PENDING_TTL_SECS` (replacing the private `PENDING_TTL`) are re-exported through `crates/tinymcp/src/registry/mod.rs` and `crates/tinymcp/src/lib.rs`.

Features

• Added — Pluggable pending-authorization store trait with memory-backed default: Hosts can persist pending authorizations in their own backend (e.g. a shared database) so a redirect landing on any instance behind a load balancer can complete the sign-in, while the common single-process case keeps the in-memory default. (crates/tinymcp/src/registry/oauth/flow.rs#impl OAuthFlow {, crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/mod.rs#pub use boot::{BootOutcome, connect_installed_servers};)
• Modified — `PendingAuthorization` made public and serializable, moved out of `types.rs`: A host can store parked authorizations in its own store; the serde shape is pinned by a test and secrets (PKCE verifier, client secret) are redacted from `Debug` output. (crates/tinymcp/src/registry/oauth/types.rs#use crate::error::{Error, Result};, crates/tinymcp/src/registry/oauth/pending.rs, crates/tinymcp/tests/public_reexports.rs#fn the_contract_types_resolve_at_the_crate_root_to_the_bus_definitions() {)
• Modified — `pending_server` and `pending_count` become async and fallible: Store failures are now reported through `Result` instead of being swallowed; this changes the signatures downstream callers use and propagates into the registry facade and tests. (crates/tinymcp/src/registry/oauth/flow.rs#impl OAuthFlow {, crates/tinymcp/src/registry/ops/mod_tests.rs#async fn the_facade_hands_out_the_pieces_a_host_drives_directly() {)
• Modified — Public `PENDING_TTL_SECS` constant: Exposes the parked-entry lifetime so a host store (e.g. a database TTL index) can use the same value, while the flow still enforces it independently. (crates/tinymcp/src/registry/oauth/pending.rs, crates/tinymcp/src/lib.rs#pub use config_servers::{, crates/tinymcp/src/registry/oauth/mod_tests.rs#async fn beginning_parks_exactly_one_pending_authorization() {)

Tests

• unit test with a custom store implementation — A store that never expires entries is parked with a stale `started_at`; peek returns `None`, complete fails with `Error::MalformedResponse`, and no exchange occurs.: Adequate: pins that the flow refuses stale entries regardless of store behavior. (crates/tinymcp/src/registry/oauth/mod_host_store_tests.rs#async fn a_guarded_flow_refuses_an_internal_authorization_server() {)
• unit tests (new `pending_tests.rs`) — Covers park/take-once, non-destructive peek, unknown states, expiry pruning on touch, the expiry boundary, redacted `Debug`, a pinned serde JSON representation, and that flow `Debug` never shows a state or verifier.: Adequate: directly exercises the new store's semantics, boundary behavior, and secret redaction. (crates/tinymcp/src/registry/oauth/pending_tests.rs)
• compile-time re-export pin (integration test) — Imports the new public items from the crate root and asserts `expired_at` at the TTL boundary.: Adequate: pins the public contract the PR introduces. (crates/tinymcp/tests/public_reexports.rs#fn the_contract_types_resolve_at_the_crate_root_to_the_bus_definitions() {)
• call-site test updates — Existing `pending_count`/`pending_server` assertions are updated to the async/`Result` signatures across flow and facade tests.: Adequate: the signature migration is applied consistently at all shown call sites. (crates/tinymcp/src/registry/oauth/mod_tests.rs#async fn a_state_is_consumed_even_when_the_exchange_fails() {, crates/tinymcp/src/registry/ops/mod_tests.rs#async fn the_facade_hands_out_the_pieces_a_host_drives_directly() {)

Findings

No active actionable findings.

Could not review: crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs

Before merge

• Complete the critique review for crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: incomplete; unanswered: crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs
• Lane summary: Reviewed 8 files; 0 findings. 2 files could not be reviewed: crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs.

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: Sensitive values are redacted from debug output: `PendingAuthorization`'s `Debug` redacts the PKCE verifier and client secret, and `MemoryPendingStore`'s `Debug` shows only a parked count, never a `state` (a bearer secret during sign-in).
• Lane summary: Reviewed 10 files; 0 findings.

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The change extracts pending sign-in state behind a `PendingAuthorizationStore` trait, adds a `MemoryPendingStore` default, and makes expiry the flow's own responsibility so a lazy host store cannot complete a stale sign-in. The new behaviour is covered by tests that would fail on regression: cross-instance completion (`a_sign_in_begun_on_one_instance_completes_on_another_sharing_its_store`), single-use state under a race (a hand-written non-atomic store would break `a_parked_authorization_is_taken_once` and `racing_completions_of_one_state_exchange_the_code_once`), expiry against a store that never expires anything (`an_expired_authorization_in_a_lazy_store_is_refused`, `expiry_is_measured_from_when_it_was_parked`), and redaction of the verifier, client secret and state in `Debug` output. The `OAuthFlow` doc claim that instances sharing a store may each complete what another began is pinned by the shared-store test, and the trait docs' atomicity requirement by the same-store tests. Public re-exports are pinned by the integration test. I found no reportable defect.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The PR description matches the change: it names the new public items, the async/`Result` change to `pending_server`/`pending_count`, the default memory store, the TTL behavior, and the added tests.
• Lane summary: The change makes the pending OAuth authorization store pluggable, and the description matches the diff: it names the new public items, the async/Result change to `pending_server`/`pending_count`, the default memory store, the TTL behaviour, and the tests that were added. I checked the expiry boundary against the surrounding flow code and found the semantics consistent (an entry expires strictly after `PENDING_TTL_SECS`), so I have no findings.

Evidence and run details

• Models: ladder/vectors-oai3, glm-5.3-flash, deepseek-v4.1-flash
• Spend: $0.023673
• Tokens: 787336 input · 28666 output · 71104 cached · 748 embedding

Head	State	Pass summary
bc3aea6cecd4	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T11:16:07Z)
40080aa060db	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T12:17:33Z)
afe01db50108	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T12:37:43Z)
eaba68861b63	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T13:22:15Z)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T12:24:39.617688Z	afe01db	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8a879977-f269-40d6-adce-034f750208c5

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 11f88405-2889-4555-93b3-f0e811cb4eed

📥 Commits

Reviewing files that changed from the base of the PR and between 7bdc741 and bc3aea6.

📒 Files selected for processing: 9

• crates/tinymcp/src/registry/mod.rs
• crates/tinymcp/src/registry/oauth/flow.rs
• crates/tinymcp/src/registry/oauth/mod.rs
• crates/tinymcp/src/registry/oauth/mod_host_store_tests.rs
• crates/tinymcp/src/registry/oauth/mod_tests.rs
• crates/tinymcp/src/registry/oauth/pending.rs
• crates/tinymcp/src/registry/oauth/pending_tests.rs
• crates/tinymcp/src/registry/oauth/types.rs
• crates/tinymcp/src/registry/ops/mod_tests.rs

💤 Files with no reviewable changes: 1

• crates/tinymcp/src/registry/oauth/types.rs

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

OAuth pending authorization state now uses a store interface with an in-memory default. OAuthFlow can share a store across instances, and its pending-state operations are asynchronous. New tests cover store behavior, expiry, and completion across shared flows.

Changes: OAuth Pending Authorization Storage

Layer / File(s)	Summary
Pending authorization store contract crates/tinymcp/src/registry/oauth/pending.rs, crates/tinymcp/src/registry/oauth/pending_tests.rs, crates/tinymcp/src/registry/oauth/types.rs, crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/mod.rs	Adds the pending authorization data type, 10-minute expiry rule, store interface, and in-memory implementation. Re-exports the new store types and tests expiry, redaction, serialization, and store operations.
OAuth flow store integration crates/tinymcp/src/registry/oauth/flow.rs	OAuthFlow uses a configurable shared store. Begin parks authorization data; complete takes and validates it. Pending-state lookup and count operations are asynchronous and return store errors.
OAuth flow and store validation crates/tinymcp/src/registry/oauth/mod_host_store_tests.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs, crates/tinymcp/src/registry/ops/mod_tests.rs	Updates pending-state assertions for asynchronous methods. Adds coverage for shared-flow completion, single-use concurrent completion, and expiration when a store retains an entry.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant OAuthFlow
  participant PendingAuthorizationStore
  participant TokenEndpoint
  OAuthFlow->>PendingAuthorizationStore: park pending authorization
  OAuthFlow->>PendingAuthorizationStore: take state during completion
  OAuthFlow->>TokenEndpoint: exchange authorization code

Loading

Suggested reviewers: oxoxdev

Merge Risk: ⚪ Minimal · up to bc3ae

No unresolved issue in the shared OAuth pending-state change was established; it is ready for normal merge checks.

Security architecture risk: 🟡 Moderate · up to bc3ae

Sharing sign-in state introduces a security assumption: callback handlers must preserve the initiating handler’s network restrictions. Mixed configurations can weaken those protections. The default remains process-local, while external storage protections and deployment configuration are not established here.

Retained concerns

• Medium · security · inferred: Shared pending state does not preserve the initiating flow’s endpoint restrictions. If guarded and unguarded flows share a store, a callback received by an unguarded flow exchanges the code using its unrestricted HTTP client. A hostile authorization server can then redirect the exchange or change DNS toward an internal destination that guarded completion would refuse. Previously, only the initiating flow held the pending record. This requires mixed-policy sharing; uniformly guarded instances retain protection, and no deployed mixed-policy configuration was demonstrated.

Security review details

Security Blast Radius

• inferred — The shared-store trust domain includes every flow able to retrieve its pending records and the backend holding their authentication material. The conditional endpoint-policy downgrade affects outbound access from the completing host, including reachable internal services. No cross-environment or cross-tenant deployment exposure was established.

Security Findings and Attack Paths

• inferred — A malicious OAuth server can initially advertise a public endpoint accepted by a guarded initiating flow. If a shared-store callback reaches an unguarded flow, completion omits public-address revalidation and uses redirect-capable HTTP. A changed DNS answer or redirect can therefore cross the initiating flow’s intended network boundary. The attack requires mixed-policy consumers; sharing exclusively among guarded flows preserves the control.

Trust Boundaries and Controls

• observed — The parked server identifier remains authoritative for token persistence and the returned completion identity. Tenant qualification and credential-store routing are explicitly host-owned responsibilities; pending_server recovers that routing key from state. The inspected registry completion path reconnects the returned server identifier, rather than accepting a replacement identifier from the callback.

Resilience and Maintainability Implications

• observed — Atomic one-time take is a required backend invariant, not something OAuthFlow can enforce across an arbitrary external store. Store failures propagate instead of being treated as missing state. The default implementation enforces atomic removal locally; external backend behavior under timeout, cancellation, failover, or recovery remains unverified.

Hardening Proposals

• proposed — Preserve required endpoint restrictions across shared completion by binding them to the transaction and enforcing the stronger policy, or by rejecting incompatible consumers. Validate the guarded-initiator to unguarded-completer case explicitly.
• proposed — For production shared-store adapters, make sealed-record protection, scoped access, expiry cleanup, and atomic-consumption behavior under failover explicit integration requirements. These are adapter validation needs, not observed defects in an existing production backend.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 68.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 41 functions across 8 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: making OAuth pending sign-in state persistable outside the process through pluggable storage.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit parks a state with care,
Then shares the store from here to there.
One take succeeds; the rest await,
Old entries pass beyond the gate.
The carrot code comes back at last.}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc3aea6cec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinymcp/src/registry/mod.rs, crates/tinymcp/src/registry/oauth/flow.rs, crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs, crates/tinymcp/src/registry/oauth/pending.rs, crates/tinymcp/src/registry/oauth/pending_tests.rs, crates/tinymcp/src/registry/ops/mod_tests.rs.

             $0.0196 · 445,548 in / 27,818 out · 8,960 cached (2%) · ladder/vectors-oai3, glm-5.3-flash,  · 760 embedded
critique:    $0.0175 · 233,240 in / 23,428 out · 0 cached (0%)     · glm-5.3-flash,
security:    $0.0014 · 156,666 in / 2,811 out  · 8,960 cached (6%) · glm-5.3-flash,
tests:       $0.0002 · 22,787 in  / 240 out    · 0 cached (0%)     · glm-5.3-flash
description: $0.0003 · 32,855 in  / 1,339 out  · 0 cached (0%)     · glm-5.3-flash

[senamakel]

The module-ci / supply-chain failure is not from this change: it fails on main too (run 38598670406). The cause is the rustls advisories RUSTSEC-2026-0346 and RUSTSEC-2026-0347 in the lockfile. Every other check is green.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 40080aa060

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0019 · 175,954 in / 8,836 out · 8,960 cached (5%)  · ladder/vectors-oai3, glm-5.3-flash · 763 embedded
critique:    $0.0006 · 48,492 in  / 4,330 out · 0 cached (0%)      · glm-5.3-flash
security:    $0.0004 · 44,714 in  / 889 out   · 0 cached (0%)      · glm-5.3-flash
tests:       $0.0005 · 47,943 in  / 3,049 out · 0 cached (0%)      · glm-5.3-flash
description: $0.0003 · 34,805 in  / 568 out   · 8,960 cached (26%) · glm-5.3-flash

[tinysweeper]

tinysweeper found nothing blocking. Approving.

             $0.0031 · 163,878 in / 9,903 out · 0 cached (0%) · ladder/vectors-oai3, glm-5.3-flash · 748 embedded
critique:    $0.0005 · 54,691 in  / 1,069 out · 0 cached (0%) · glm-5.3-flash
security:    $0.0006 · 53,959 in  / 3,879 out · 0 cached (0%) · glm-5.3-flash
tests:       $0.0002 · 23,862 in  / 1,035 out · 0 cached (0%) · glm-5.3-flash
description: $0.0002 · 15,893 in  / 923 out   · 0 cached (0%) · glm-5.3-flash

tinysweeper could not review the latest push, so its earlier approval no longer speaks for this pull request.

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinymcp/src/registry/oauth/mod.rs, crates/tinymcp/src/registry/oauth/mod_tests.rs.

             $0.0237 · 787,336 in / 28,666 out · 71,104 cached (9%)  · ladder/vectors-oai3, glm-5.3-flash, deepseek-v4.1-flash · 748 embedded
critique:    $0.0042 · 249,194 in / 6,201 out  · 15,488 cached (6%)  · glm-5.3-flash
security:    $0.0192 · 422,458 in / 19,257 out · 49,216 cached (12%) · glm-5.3-flash, deepseek-v4.1-flash
tests:       $0.0000 · 49,876 in  / 519 out    · 4,352 cached (9%)   · deepseek-v4.1-flash
description: $0.0000 · 34,331 in  / 405 out    · 2,048 cached (6%)   · deepseek-v4.1-flash