fix: allows for toggling non-auth users for MCP temp tokens by roroghost17 · Pull Request #3720 · maximhq/bifrost

roroghost17 · 2026-05-25T04:05:43Z

Summary

Adds a new mcp_enable_temp_token_auth client config flag that gates whether Bifrost mints and accepts scoped short-lived temp tokens for MCP per-user OAuth authorization pages. Previously, temp-token auth was implicitly enabled whenever the tempTokens service was wired up. This change makes it an explicit opt-in, defaulting to false, so deployments must consciously enable it.

Changes

Added MCPEnableTempTokenAuth bool field to ClientConfig, TableClientConfig, and all relevant migration/serialization paths, with a database migration to add the column.
OAuth2Provider.InitiateUserOAuthFlow now checks both that the tempTokens service is non-nil and that MCPEnableTempTokenAuth is true in client config before minting a temp token into the auth-page URL fragment.
AuthMiddleware gains a tempTokensEnabled atomic bool, initialized and updated via ReloadClientConfigFromConfigStore, so the X-Bifrost-Temp-Token fallback path in tryTempTokenOrUnauthorized is also gated by the same flag at runtime.
Added UpdateTempTokenAuthEnabled method on AuthMiddleware and wired it into ReloadClientConfigFromConfigStore so config changes take effect without a restart.
UI MCP settings view exposes a new "Allow Temp Token Auth Links" toggle, visible only when SSO/SCIM is enabled (IS_ENTERPRISE && authType === "sso"), with a descriptive label explaining the security trade-off.
Helm chart _helpers.tpl, values.yaml, and values.schema.json updated to expose mcpEnableTempTokenAuth.
transports/config.schema.json and the schema test updated to include mcp_enable_temp_token_auth.
Added TestMCPTempTokenAuthEnabled unit test covering the three states: no config, config with flag false, config with flag true.

Type of change

Affected areas

How to test

# Core/Transports
go test ./framework/configstore/... ./framework/oauth2/... ./transports/bifrost-http/...

# UI
cd ui
pnpm i
pnpm build

Manual validation:

Start Bifrost with mcp_enable_temp_token_auth: false (default). Initiate a per-user MCP OAuth flow and confirm the returned auth-page URL contains no # fragment.
Set mcp_enable_temp_token_auth: true. Repeat the flow and confirm the URL contains a #mcp_auth=<token> fragment.
Confirm that after the flow completes or expires, the temp token is cleaned up and the fragment link no longer works.
In the UI (enterprise SSO deployment), navigate to MCP settings and verify the "Allow Temp Token Auth Links" toggle appears and persists correctly.

New config field:

Field	Type	Default	Description
`mcp_enable_temp_token_auth`	`boolean`	`false`	When true, Bifrost mints and accepts scoped temp tokens for MCP per-user OAuth auth pages

Breaking changes

No

The flag defaults to false, preserving existing behavior. Deployments that previously relied on temp-token auth being implicitly active (when the service was wired) must explicitly set mcp_enable_temp_token_auth: true.

Security considerations

Temp tokens embedded in URL fragments grant unauthenticated access to a specific MCP OAuth flow page for the lifetime of the flow. Keeping this opt-in (false by default) ensures operators consciously accept this trade-off. The tokens are scoped to a single session_id resource and are deleted on flow completion or expiry. The feature is surfaced in the UI only for SSO-enabled enterprise deployments where per-user OAuth flows are most relevant.

Checklist

I read docs/contributing/README.md and followed the guidelines
I added/updated tests where appropriate
I updated documentation where needed
I verified builds succeed (Go and UI)
I verified the CI pipeline passes locally if applicable

coderabbitai · 2026-05-25T04:05:50Z

📝 Walkthrough

Summary by CodeRabbit

New Features
- Configurable "Allow Temp Token Auth Links" for MCP per-user OAuth flows (enterprise/SCIM-only switch).
- Per-user OAuth will include temp-token fragment only when the service is installed and the setting is enabled.
- Safer post-login redirect handling via validated "goto" parameter.
- Session API now returns frontend auth type.
Chores
- Persistence, schemas, Helm values and server/middleware updated to store and honor the setting.
Tests
- Tests and schema validations updated.

Walkthrough

Adds a persistent MCPEnableTempTokenAuth boolean and wires it through migrations, DB, transport schemas, Helm, UI, OAuth2 provider, and HTTP middleware to conditionally enable scoped temporary-token minting and validation for MCP per-user OAuth flows.

Changes

MCP Temp-Token Auth Enablement Flag

Layer / File(s)	Summary
Config data model and persistence `framework/configstore/clientconfig.go`, `framework/configstore/tables/clientconfig.go`, `framework/configstore/rdb.go`, `framework/configstore/migrations.go`	`ClientConfig` and `TableClientConfig` add `MCPEnableTempTokenAuth`. RDB read/write mappings updated. GenerateClientConfigHash includes the flag when enabled. Migration adds `mcp_enable_temp_token_auth` column and rehash paths.
OAuth2 temp-token conditional minting `framework/oauth2/main.go`, `framework/oauth2/sync_test.go`	OAuth2 provider stores TempToken service atomically, adds mcpTempTokenAuthEnabled(ctx); InitiateUserOAuthFlow mints `mcp_auth` only when service exists and flag is enabled. Tests add GetClientConfig and assert behavior.
HTTP middleware temp-token validation gating `transports/bifrost-http/handlers/middlewares.go`	`AuthMiddleware` adds an atomic `tempTokensEnabled` flag initialized from client config, exposes `UpdateTempTokenAuthEnabled`, and only attempts temp-token validation when service is present and the flag is true.
Config update handler and server sync `transports/bifrost-http/handlers/config.go`, `transports/bifrost-http/server/server.go`	Config update copies incoming `MCPEnableTempTokenAuth` into updated config; server reload syncs the flag to the auth middleware runtime toggle.
Transport-layer config schema and defaults `transports/bifrost-http/lib/config.go`, `transports/bifrost-http/lib/config_test.go`, `transports/config.schema.json`, `transports/schema_test/config_schema_test.go`	Transport schema adds `client.mcp_enable_temp_token_auth` (default false); default ClientConfig and schema tests updated to include and validate the field.
Helm values and templates `helm-charts/bifrost/values.schema.json`, `helm-charts/bifrost/values.yaml`, `helm-charts/bifrost/templates/_helpers.tpl`	Helm schema adds `bifrost.client.mcpEnableTempTokenAuth` (default false); values file adds commented example; template conditionally wires the flag into generated client config and fixes block termination.
UI types and schema `ui/lib/types/config.ts`, `ui/lib/types/schemas.ts`	`CoreConfig` and `DefaultCoreConfig` add `mcp_enable_temp_token_auth: boolean` (default false); Zod schema includes the new boolean.
UI MCP view and session pages `ui/app/workspace/config/views/mcpView.tsx`, `ui/app/workspace/mcp-sessions/auth/page.tsx`	MCPView conditionally shows an "Allow Temp Token Auth Links" switch for enterprise SSO and persists it. Auth page detects active temp tokens and renders SSO warning or "Log in instead" redirect preserving goto/search.
Login route loader `ui/app/login/layout.tsx`, `ui/lib/utils/loginGoto.ts`	Adds `getLoginGotoFromSearch`/`normalizeLoginGoto` to validate `goto` query values (allowlist `/workspace`) and redirects via computed `postLoginPath` using `redirect({ href })`.
Session API responses `transports/bifrost-http/handlers/session.go`, `ui/lib/store/apis/sessionApi.ts`	`/api/session/is-auth-enabled` now includes `auth_type` ("sso"

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~22 minutes

Possibly related PRs

maximhq/bifrost#3648: Modifies /login route behavior; related redirect/loader changes may overlap.
maximhq/bifrost#3603: Prior work on temp-token primitives and wiring that this flag gates.
maximhq/bifrost#3565: Related per-user OAuth flow changes overlapping in InitiateUserOAuthFlow and token handling.

Suggested reviewers

danpiths
Pratham-Mishra04
akshaydeo

Poem

🐰 A tiny flag tucked in a store,
Temp tokens wake when enterprises roar,
Scoped links minted, validated too,
Only when configs whisper "yes" — not askew,
Hop, hop — the auth rabbit cheers for you!

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 45.45% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title 'fix: allows for toggling non-auth users for MCP temp tokens' is somewhat vague and doesn't clearly convey the main change. The actual feature adds an explicit config flag to gate temp-token auth, not specifically about 'non-auth users'.	Clarify the title to better reflect the core change: consider 'feat: add mcp_enable_temp_token_auth config flag to gate temp-token auth' or 'feat: make MCP temp-token auth explicitly configurable'.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The PR description is comprehensive and well-structured, following the provided template with all major sections completed including Summary, Changes, Type of change, Affected areas, testing instructions, new config documentation, breaking changes, security considerations, and a filled checklist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch 05-23-fix_allows_for_toggling_non-auth_users_for_mcp_temp_tokens

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

🔧 Trivy (0.69.3)

Trivy execution failed: 2026-05-25T11:26:29Z FATAL Fatal error run error: fs scan error: scan error: scan failed: failed analysis: post analysis error: post analysis error: ansible scan error: fs filter error: fs filter error: walk error range error: stat .coderabbit-opengrep-fallback.yml: no such file or directory: range error: stat .coderabbit-opengrep-fallback.yml: no such file or directory

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

CLAassistant · 2026-05-25T04:05:51Z

All committers have signed the CLA.

roroghost17 · 2026-05-25T04:05:57Z

chore: add harness test for auth enabled #3728
fix: allows for toggling non-auth users for MCP temp tokens #3720 👈 (View in Graphite)
dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

greptile-apps · 2026-05-25T04:36:58Z

Confidence Score: 5/5

Safe to merge; all gating paths (OAuth flow, auth middleware, UI toggle) are correctly wired and the flag defaults to false, preserving existing behavior.

The core change is additive and well-contained: a new boolean flag that defaults to the safe value, backed by an atomic bool in AuthMiddleware and an atomic.Pointer in OAuth2Provider. DB migration is idempotent, the test covers all three states, and ReloadClientConfigFromConfigStore correctly propagates live config changes to AuthMiddleware. The only finding is a same-origin path-traversal gap in the new loginGoto validation helper, which is a hardening opportunity rather than an exploitable vulnerability in context.

ui/lib/utils/loginGoto.ts — the isWorkspaceRoute check allows /workspace/../ traversal sequences; all other files look correct.

Important Files Changed

Filename	Overview
framework/configstore/migrations.go	Adds idempotent migration for mcp_enable_temp_token_auth column with HasColumn guard; field propagated through all existing migration copy-structs
framework/oauth2/main.go	Replaces mutex-locked tempTokens field with atomic.Pointer; adds mcpTempTokenAuthEnabled config-store read; guards token minting and cleanup paths correctly
transports/bifrost-http/handlers/middlewares.go	Adds tempTokensEnabled atomic.Bool initialized from config at startup; tryTempTokenOrUnauthorized correctly gated by both service presence and flag value
transports/bifrost-http/server/server.go	ReloadClientConfigFromConfigStore now calls UpdateTempTokenAuthEnabled so runtime config changes propagate without restart
ui/lib/utils/loginGoto.ts	New login redirect helper with isWorkspaceRoute guard; allows paths starting with /workspace/ which includes path traversal sequences like /workspace/../other

_{Reviews (5): Last reviewed commit: "fix: allows for toggling non-auth users ..." | Re-trigger Greptile}

The merge-base changed after approval.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/app/workspace/mcp-sessions/auth/page.tsx`:
- Around line 203-208: The "Log in instead" interactive control (the Button
asChild wrapping <a href={loginHref}> with the LogIn icon) is missing a
data-testid; add a stable data-testid to the interactive element (e.g.,
data-testid="login-instead-button") so E2E selectors can target it, and do the
same for the other newly added interactive Button at the other location
mentioned (lines 236-242) — if using Button asChild ensure the data-testid is
applied to the rendered DOM element (anchor) so tests see it.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c20c000e-f7ae-408c-815a-5c072638295a

📥 Commits

Reviewing files that changed from the base of the PR and between 89b47ad and 63272c1.

📒 Files selected for processing (23)

framework/configstore/clientconfig.go
framework/configstore/migrations.go
framework/configstore/rdb.go
framework/configstore/tables/clientconfig.go
framework/oauth2/main.go
framework/oauth2/sync_test.go
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
transports/bifrost-http/handlers/config.go
transports/bifrost-http/handlers/middlewares.go
transports/bifrost-http/handlers/session.go
transports/bifrost-http/lib/config.go
transports/bifrost-http/lib/config_test.go
transports/bifrost-http/server/server.go
transports/config.schema.json
transports/schema_test/config_schema_test.go
ui/app/login/layout.tsx
ui/app/workspace/config/views/mcpView.tsx
ui/app/workspace/mcp-sessions/auth/page.tsx
ui/lib/store/apis/sessionApi.ts
ui/lib/types/config.ts
ui/lib/types/schemas.ts

✅ Files skipped from review due to trivial changes (1)

helm-charts/bifrost/values.yaml

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@transports/bifrost-http/handlers/session.go`:
- Around line 83-93: The endpoint currently maps auth_type using
authConfig.IsEnabled via dashboardAuthType(isEnabled) which only returns
"password" or "none" and never "sso"; change dashboardAuthType to derive its
return value from the actual configured auth mode (e.g. an authConfig.Mode or
authConfig.Type field) instead of IsEnabled, and update the call sites that pass
authConfig.IsEnabled to pass the real mode or the whole authConfig; implement
mapping to return "sso", "password", or "none" based on that mode and leave
existing behavior for backward-compatible values.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2ece0771-c06f-46cf-89c8-669db2293fb5

📥 Commits

Reviewing files that changed from the base of the PR and between 63272c1 and 8a4959a.

📒 Files selected for processing (24)

framework/configstore/clientconfig.go
framework/configstore/migrations.go
framework/configstore/rdb.go
framework/configstore/tables/clientconfig.go
framework/oauth2/main.go
framework/oauth2/sync_test.go
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
transports/bifrost-http/handlers/config.go
transports/bifrost-http/handlers/middlewares.go
transports/bifrost-http/handlers/session.go
transports/bifrost-http/lib/config.go
transports/bifrost-http/lib/config_test.go
transports/bifrost-http/server/server.go
transports/config.schema.json
transports/schema_test/config_schema_test.go
ui/app/login/layout.tsx
ui/app/workspace/config/views/mcpView.tsx
ui/app/workspace/mcp-sessions/auth/page.tsx
ui/lib/store/apis/sessionApi.ts
ui/lib/types/config.ts
ui/lib/types/schemas.ts
ui/lib/utils/loginGoto.ts

✅ Files skipped from review due to trivial changes (3)

ui/lib/store/apis/sessionApi.ts
transports/bifrost-http/lib/config_test.go
helm-charts/bifrost/values.yaml

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@framework/oauth2/main.go`:
- Around line 69-74: tempTokenService currently uses p.mu.RLock which can get
blocked by long-running write locks; replace the lock-based access with an
atomic pointer to avoid stalls: add a field like tempTokensAtomic of type
atomic.Pointer[temptoken.Service], update all places that set p.tempTokens to
instead store via p.tempTokensAtomic.Store(newPtr), and change
tempTokenService() to return p.tempTokensAtomic.Load() (cast to
*temptoken.Service) without taking p.mu; ensure any nil checks still work. Use
sync/atomic.Pointer[temptoken.Service] (or atomic.Value) so readers don't
contend with refresh write locks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: a2e2117c-6ed0-42ec-b89e-934a668f72de

📥 Commits

Reviewing files that changed from the base of the PR and between 8a4959a and bacaa5c.

📒 Files selected for processing (24)

framework/configstore/clientconfig.go
framework/configstore/migrations.go
framework/configstore/rdb.go
framework/configstore/tables/clientconfig.go
framework/oauth2/main.go
framework/oauth2/sync_test.go
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
transports/bifrost-http/handlers/config.go
transports/bifrost-http/handlers/middlewares.go
transports/bifrost-http/handlers/session.go
transports/bifrost-http/lib/config.go
transports/bifrost-http/lib/config_test.go
transports/bifrost-http/server/server.go
transports/config.schema.json
transports/schema_test/config_schema_test.go
ui/app/login/layout.tsx
ui/app/workspace/config/views/mcpView.tsx
ui/app/workspace/mcp-sessions/auth/page.tsx
ui/lib/store/apis/sessionApi.ts
ui/lib/types/config.ts
ui/lib/types/schemas.ts
ui/lib/utils/loginGoto.ts

✅ Files skipped from review due to trivial changes (1)

ui/lib/types/config.ts

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ui/lib/utils/loginGoto.ts`:
- Around line 3-16: normalizeLoginGoto currently validates the raw input before
any path normalization, so inputs like "/workspace/../login" bypass the
allowlist; change the function to first resolve/normalize the input path (e.g.,
use a robust path/URL normalization method to collapse ".." and "." segments and
remove duplicate slashes) and then run the existing checks (isWorkspaceRoute, no
backslashes/newlines, no leading "//") against the normalized result, returning
null for anything that falls outside the intended /workspace prefix; apply the
same normalize-then-validate fix to the analogous logic at the other occurrence
(lines 23-29) so both locations validate the resolved path rather than the raw
string.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6c1816fc-79c3-4a8b-aee9-8c5b411474a5

📥 Commits

Reviewing files that changed from the base of the PR and between bacaa5c and 737f4d1.

📒 Files selected for processing (24)

framework/configstore/clientconfig.go
framework/configstore/migrations.go
framework/configstore/rdb.go
framework/configstore/tables/clientconfig.go
framework/oauth2/main.go
framework/oauth2/sync_test.go
helm-charts/bifrost/templates/_helpers.tpl
helm-charts/bifrost/values.schema.json
helm-charts/bifrost/values.yaml
transports/bifrost-http/handlers/config.go
transports/bifrost-http/handlers/middlewares.go
transports/bifrost-http/handlers/session.go
transports/bifrost-http/lib/config.go
transports/bifrost-http/lib/config_test.go
transports/bifrost-http/server/server.go
transports/config.schema.json
transports/schema_test/config_schema_test.go
ui/app/login/layout.tsx
ui/app/workspace/config/views/mcpView.tsx
ui/app/workspace/mcp-sessions/auth/page.tsx
ui/lib/store/apis/sessionApi.ts
ui/lib/types/config.ts
ui/lib/types/schemas.ts
ui/lib/utils/loginGoto.ts

✅ Files skipped from review due to trivial changes (2)

ui/lib/store/apis/sessionApi.ts
helm-charts/bifrost/values.yaml

akshaydeo · 2026-05-25T16:37:25Z

Merge activity

May 25, 4:37 PM UTC: A user started a stack merge that includes this pull request via Graphite.
May 25, 4:37 PM UTC: @akshaydeo merged this pull request with Graphite.

## Summary Adds a new `mcp_enable_temp_token_auth` client config flag that gates whether Bifrost mints and accepts scoped short-lived temp tokens for MCP per-user OAuth authorization pages. Previously, temp-token auth was implicitly enabled whenever the `tempTokens` service was wired up. This change makes it an explicit opt-in, defaulting to `false`, so deployments must consciously enable it. ## Changes - Added `MCPEnableTempTokenAuth` bool field to `ClientConfig`, `TableClientConfig`, and all relevant migration/serialization paths, with a database migration to add the column. - `OAuth2Provider.InitiateUserOAuthFlow` now checks both that the `tempTokens` service is non-nil **and** that `MCPEnableTempTokenAuth` is `true` in client config before minting a temp token into the auth-page URL fragment. - `AuthMiddleware` gains a `tempTokensEnabled` atomic bool, initialized and updated via `ReloadClientConfigFromConfigStore`, so the `X-Bifrost-Temp-Token` fallback path in `tryTempTokenOrUnauthorized` is also gated by the same flag at runtime. - Added `UpdateTempTokenAuthEnabled` method on `AuthMiddleware` and wired it into `ReloadClientConfigFromConfigStore` so config changes take effect without a restart. - UI MCP settings view exposes a new "Allow Temp Token Auth Links" toggle, visible only when SSO/SCIM is enabled (`IS_ENTERPRISE && authType === "sso"`), with a descriptive label explaining the security trade-off. - Helm chart `_helpers.tpl`, `values.yaml`, and `values.schema.json` updated to expose `mcpEnableTempTokenAuth`. - `transports/config.schema.json` and the schema test updated to include `mcp_enable_temp_token_auth`. - Added `TestMCPTempTokenAuthEnabled` unit test covering the three states: no config, config with flag false, config with flag true. ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [ ] Plugins - [x] UI (React) - [ ] Docs ## How to test ```sh # Core/Transports go test ./framework/configstore/... ./framework/oauth2/... ./transports/bifrost-http/... # UI cd ui pnpm i pnpm build ``` **Manual validation:** 1. Start Bifrost with `mcp_enable_temp_token_auth: false` (default). Initiate a per-user MCP OAuth flow and confirm the returned auth-page URL contains **no** `#` fragment. 2. Set `mcp_enable_temp_token_auth: true`. Repeat the flow and confirm the URL contains a `#mcp_auth=<token>` fragment. 3. Confirm that after the flow completes or expires, the temp token is cleaned up and the fragment link no longer works. 4. In the UI (enterprise SSO deployment), navigate to MCP settings and verify the "Allow Temp Token Auth Links" toggle appears and persists correctly. **New config field:** | Field | Type | Default | Description | |---|---|---|---| | `mcp_enable_temp_token_auth` | `boolean` | `false` | When true, Bifrost mints and accepts scoped temp tokens for MCP per-user OAuth auth pages | ## Breaking changes - [x] No The flag defaults to `false`, preserving existing behavior. Deployments that previously relied on temp-token auth being implicitly active (when the service was wired) must explicitly set `mcp_enable_temp_token_auth: true`. ## Security considerations Temp tokens embedded in URL fragments grant unauthenticated access to a specific MCP OAuth flow page for the lifetime of the flow. Keeping this opt-in (`false` by default) ensures operators consciously accept this trade-off. The tokens are scoped to a single `session_id` resource and are deleted on flow completion or expiry. The feature is surfaced in the UI only for SSO-enabled enterprise deployments where per-user OAuth flows are most relevant. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [ ] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable

## ✨ Features - **Azure v1 API Migration** — Migrated Azure provider to the v1 API: removed the `api-version` query parameter and the `/openai/deployments/{model}/...` URL pattern in favor of `/openai/v1/{operation}`; the `api_version` field has been dropped from `AzureKeyConfig` (#3661, #3756) - **EnvVar Support for OTEL & Prometheus Configs** — `CollectorURL`, `MetricsEndpoint`, headers, push gateway URL, and basic auth credentials can now be sourced from environment variables (e.g., `env.OTEL_COLLECTOR_URL`); added a new `ConfigMarshallerPlugin` interface that lets plugins control storage/redaction round-trips (#3651) - **OTel Extra Header Forwarding** — `x-bf-eh-*` extra headers forwarded to upstream providers are now also emitted on the request span under `gen_ai.request.extra_header.*` for end-to-end tracing (#3730) - **OTel Semantic Conventions** — Aligned OTel attribute keys with the OpenTelemetry GenAI spec (canonical `gen_ai.*` and new `bifrost.*` attributes); legacy attributes are retained in parallel to avoid breaking existing dashboards (#3732) - **VK Quota with Provider Configs** — `GetVirtualKeyQuotaByValue` and the `getVirtualKeyQuota` HTTP response now include `provider_configs` with their budgets and rate limits (#3721) - **MCP Temp Token Non-Auth Toggle** — Added `mcp_enable_temp_token_auth` client config flag to gate short-lived MCP token minting for non-authenticated users (#3720) - **Responses Stream in JSON Parser** — `jsonparser` plugin now handles OpenAI Responses API streaming (`ResponsesStreamRequest`) in addition to chat completions (#3749) - **Session API Rework** — Logout now calls both the password-based session logout and OAuth logout endpoints and resets all RTK Query cache state (#3698) ## 🐞 Fixed - **Streaming Latency for Observability** — Deferred root span termination to the trace completer callback for streaming requests so request latency is no longer inflated by header-flush time (#3762) - **Stream Cancellation Race** — Set `BifrostContextKeyConnectionClosed` before closing the stream and short-circuit `idleTimeoutReader.Read` when the connection is already closed to avoid panics and hangs on cancellation (#3733) - **Bedrock Cache Points** — Strip cache points from Bedrock requests for models that do not support prompt caching (e.g., GLM, Llama) to avoid Converse API errors (#3754) - **Bedrock Empty Text Blocks** — Skip empty/nil text blocks during Bedrock response conversion to avoid invalid messages (#3747) - **Bedrock Reasoning + Tools** — Preserve reasoning content blocks on assistant turns that also contain tool calls in the Bedrock chat converter (#3690) - **Bedrock Search Content & Video** — Restored search content and video parts that were being dropped from Bedrock-native passthrough requests (#3729) - **Structured Output Stop Reason** — Fixed an incorrect `tool_calls` finish reason when structured output is combined with extended-thinking tools (#3685) - **Gemini Tool Schema Passthrough** — Forward full tool parameter schemas via `parametersJsonSchema` instead of the lossy `parameters` form; corrected tool response role to `user`; resolved structured output + tools conflict (#3761) - **Anthropic Stop Reason & Tool Versions** — Normalized stop reason mapping (`end_turn` to `stop`, `tool_use` to `tool_calls`, `max_tokens` to `length`) and upgraded `text_editor_20250124`/`str_replace_editor` to `text_editor_20250728` for computer-use tools (#3761) - **Azure Endpoint Redaction** — Fixed a panic when `AzureKeyConfig.Endpoint` is a literal value rather than an env reference (#3761) - **Auth Middleware Path Match** — Match temp-token auth middleware whitelist against the request path only, not the full URI with query parameters (#3737) - **Governance Blocked Models UI** — Restored the missing Blocked Models create/edit UI in the VK provider config sheet (#3750) - **Logging Plugin Cleanup Drain** — Fixed a shutdown race where `batchWriter` could drop in-flight log entries; `Cleanup` now drains both the recovered batch and remaining queue within a 30-second budget (#3717) - **Model Rankings Empty Entries** — Excluded entries with empty `model` values from model rankings matview queries so blank rows no longer surface in the UI (#3758) - **User Filter Duplicates** — Recreated `mv_filter_users` matview to require non-empty `user_name`, eliminating duplicate filter dropdown entries (#3764) - **User Filter Display Name** — Use `user_name` instead of `user_id` as the display label for users in logging filters (#3691) - **Large Numeric ID Precision** — Preserve large numeric IDs in URL search params by skipping JSON parsing for plain strings (#3692) ## 🔧 Refactors & Chores - **Error Propagation for GetAvailable\* APIs** — `GetAvailable*` methods on `LoggerPlugin`/`LogManager` now return wrapped errors instead of silently logging and returning empty slices (#3759) - **Governance Blocklist Matching** — Use `slices.Contains` for VK blocked-model matching for clearer code with identical semantics (#3727) - **Exported `ResolvePeriod`** — Renamed `resolvePeriod` to `ResolvePeriod` so external packages can reuse the period parsing (#3763) ## 📚 Docs - **OTEL Env Var Documentation** — Documented `env.VAR_NAME` support for `collector_url`, `metrics_endpoint`, and headers in OTEL/Prometheus plugin docs - **OTEL OSS Features & Examples** — Added OTEL documentation to the OSS features list with usage examples (#3731) - **Anthropic Auth Recommendation** — Recommend `ANTHROPIC_AUTH_TOKEN` over `ANTHROPIC_CUSTOM_HEADERS` for Claude Code authentication (#3686)

## Summary This PR releases Bifrost OSS `v1.5.5` and Enterprise `v1.4.4`, bumping all module pins from `v1.5.12`/`v1.3.12` to `v1.5.13`/`v1.3.13` across core, framework, and all plugins. It also hardens the Docker manifest shell scripts, expands CI egress allowlists, and updates documentation to reflect the new SCIM-based user provisioning feature. ## Changes - **Module version bumps**: All `go.mod`/`go.sum` files updated from `core v1.5.12` → `v1.5.13`, `framework v1.3.12` → `v1.3.13`, and all plugin versions incremented accordingly (`compat`, `governance`, `jsonparser`, `logging`, `maxim`, `mocker`, `otel`, `prompts`, `semanticcache`, `telemetry`). - **Docker manifest scripts**: Added `#!/usr/bin/env bash` shebang and `set -euo pipefail` to `create-docker-manifest.sh` and `create-docker-manifest-ubi9.sh`; quoted all variable expansions and switched `jq -r` to `jq -er` to fail on null digests. - **CI egress allowlist**: Added `production.cloudfront.docker.com:443` to Docker-related job allowlists, and added `_https._tcp.dl.google.com:443` and `motd.ubuntu.com:443` to the Ubuntu package job allowlist. - **Changelog files**: Cleared per-module `changelog.md` files (content moved into the new versioned docs). Added `docs/changelogs/v1.5.5.mdx` and `docs/changelogs/ent-v1.4.4.mdx` with full release notes, and registered both in `docs/docs.json`. - **Documentation**: Replaced the SSO Integration link with a User Provisioning (SCIM) link in both `README.md` and `transports/README.md`. - **Enterprise v1.4.4 highlights** (documented): Kafka and Google Cloud Pub/Sub observability sinks, chunked streaming with a 100 MB inter-node message ceiling, BigQuery custom labels via env vars using the new `ConfigMarshallerPlugin` interface, temporary access token expiry extensions, and a multi-node cluster integration harness. - **OSS v1.5.5 highlights** (documented): Azure v1 API migration, env-var support for OTel/Prometheus configs, OTel extra-header forwarding and semantic-convention alignment, virtual key quota including provider configs, Responses API streaming in `jsonparser`, and a batch of Bedrock, Gemini, Anthropic, Azure, and logging plugin fixes. ## Type of change - [ ] Bug fix - [x] Feature - [ ] Refactor - [x] Documentation - [x] Chore/CI ## Affected areas - [x] Core (Go) - [x] Transports (HTTP) - [x] Providers/Integrations - [x] Plugins - [ ] UI (React) - [x] Docs ## How to test ```sh # Core/Transports go version go test ./... # Verify Docker manifest scripts exit on error bash -n .github/workflows/scripts/create-docker-manifest.sh bash -n .github/workflows/scripts/create-docker-manifest-ubi9.sh ``` Validate that the new changelog pages (`changelogs/v1.5.5` and `changelogs/ent-v1.4.4`) render correctly in the docs site. ## Screenshots/Recordings N/A ## Breaking changes - [x] Yes - [ ] No The Azure provider no longer accepts `api_version` in `AzureKeyConfig` and has migrated to the `/openai/v1/{operation}` URL pattern. See the [v1.4.0 Migration Guide](https://docs.getbifrost.ai/enterprise/migration-guides/v1.4.0) for full details. ## Related issues #3661, #3756, #3651, #3730, #3732, #3754, #3747, #3690, #3729, #3685, #3733, #3761, #3735, #3721, #3720, #3749, #3698, #3762, #3750, #3727, #3717, #3759, #3758, #3764, #3691, #3692, #3737, #3763 ## Security considerations - The `ConfigMarshallerPlugin` interface redacts secrets (OTel collector URLs, Prometheus push gateway credentials, BigQuery labels) at config storage time and rehydrates them at load time, preventing plaintext secret persistence. - Docker manifest scripts now use `set -euo pipefail`, preventing silent failures that could result in malformed or missing image manifests being pushed. ## Checklist - [x] I read `docs/contributing/README.md` and followed the guidelines - [x] I added/updated tests where appropriate - [x] I updated documentation where needed - [x] I verified builds succeed (Go and UI) - [x] I verified the CI pipeline passes locally if applicable

roroghost17 marked this pull request as ready for review May 25, 2026 04:33

roroghost17 requested a review from a team as a code owner May 25, 2026 04:33

coderabbitai Bot requested a review from danpiths May 25, 2026 04:34

greptile-apps Bot reviewed May 25, 2026

View reviewed changes

Comment thread ui/app/workspace/config/views/mcpView.tsx Outdated

coderabbitai Bot previously approved these changes May 25, 2026

View reviewed changes

akshaydeo force-pushed the dev branch from fbbacdb to cb177ad Compare May 25, 2026 08:23

roroghost17 force-pushed the 05-23-fix_allows_for_toggling_non-auth_users_for_mcp_temp_tokens branch from 89b47ad to 63272c1 Compare May 25, 2026 08:40

coderabbitai Bot requested a review from akshaydeo May 25, 2026 08:41

greptile-apps Bot reviewed May 25, 2026

View reviewed changes

Comment thread transports/bifrost-http/handlers/session.go

coderabbitai Bot requested changes May 25, 2026

View reviewed changes

Comment thread ui/app/workspace/mcp-sessions/auth/page.tsx Outdated

roroghost17 force-pushed the 05-23-fix_allows_for_toggling_non-auth_users_for_mcp_temp_tokens branch from 63272c1 to 8a4959a Compare May 25, 2026 08:51

coderabbitai Bot requested a review from Pratham-Mishra04 May 25, 2026 08:53

coderabbitai Bot requested changes May 25, 2026

View reviewed changes

Comment thread transports/bifrost-http/handlers/session.go

roroghost17 force-pushed the 05-23-fix_allows_for_toggling_non-auth_users_for_mcp_temp_tokens branch from 8a4959a to bacaa5c Compare May 25, 2026 10:44

coderabbitai Bot requested changes May 25, 2026

View reviewed changes

Comment thread framework/oauth2/main.go Outdated

fix: allows for toggling non-auth users for MCP temp tokens

737f4d1

roroghost17 force-pushed the 05-23-fix_allows_for_toggling_non-auth_users_for_mcp_temp_tokens branch from bacaa5c to 737f4d1 Compare May 25, 2026 11:25

roroghost17 mentioned this pull request May 25, 2026

chore: add harness test for auth enabled #3728

Merged

18 tasks

coderabbitai Bot requested changes May 25, 2026

View reviewed changes

Comment thread ui/lib/utils/loginGoto.ts

coderabbitai Bot approved these changes May 25, 2026

View reviewed changes

akshaydeo approved these changes May 25, 2026

View reviewed changes

akshaydeo merged commit 0fe195e into dev May 25, 2026
13 of 14 checks passed

akshaydeo deleted the 05-23-fix_allows_for_toggling_non-auth_users_for_mcp_temp_tokens branch May 25, 2026 16:37

akshaydeo mentioned this pull request May 26, 2026

v1.5.5 #3771

Merged

akshaydeo mentioned this pull request May 27, 2026

readme fixes #3806

Merged

18 tasks

This was referenced Jun 17, 2026

refactor: rename EnvVar to SecretVar across Go modules and UIs #4461

Merged

ui: add OAuth2 consent page and MCP server auth mode settings #4510

Merged

This was referenced Jul 8, 2026

[Bug]: Toggling an MCP client's enable/disable switch corrupts its tool_sync_interval (nanoseconds resent as minutes) #5026

Closed

fix: warn callers not to truncate the #t= temp-token fragment on MCP inline-auth links #5104

Merged

Uh oh!

Conversation

roroghost17 commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Type of change

Affected areas

How to test

Breaking changes

Security considerations

Checklist

Uh oh!

coderabbitai Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Poem

❌ Failed checks (1 warning, 1 inconclusive)

Uh oh!

CLAassistant commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

roroghost17 commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

akshaydeo commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

roroghost17 commented May 25, 2026 •

edited

Loading

coderabbitai Bot commented May 25, 2026 •

edited

Loading

CLAassistant commented May 25, 2026 •

edited

Loading

roroghost17 commented May 25, 2026 •

edited

Loading

greptile-apps Bot commented May 25, 2026 •

edited

Loading

akshaydeo commented May 25, 2026 •

edited

Loading