feat: removes SSO gate check for temp token auth

[roroghost17]

Summary

The "Allow Temp Token Auth Links" toggle in the MCP settings view was previously gated behind a SCIM/SSO enterprise check. This PR removes that gate so the setting is visible and configurable for all users, regardless of enterprise tier or SSO configuration.

Changes

• Removed the isSCIMEnabled conditional that wrapped the Temp Token Auth UI section, making it always visible in the MCP settings view.
• Removed the unused IS_ENTERPRISE import and useGetAuthTypeQuery hook from mcpView.tsx since they were only used to compute isSCIMEnabled.
• Minor formatting cleanup: removed a blank line at the start of InitiateUserOAuthFlow and reformatted a single-line mock method in the config test file.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Navigate to the MCP settings view in the Bifrost dashboard on a non-enterprise or non-SSO instance.
2. Confirm the "Allow Temp Token Auth Links" toggle is now visible and functional.
3. Toggle the setting and verify it saves correctly.

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Screenshots/Recordings

The "Allow Temp Token Auth Links" section should now appear unconditionally in the MCP settings view, rather than only when SCIM/SSO is enabled.

Breaking changes

• Yes
• No

Related issues

Security considerations

The Temp Token Auth feature issues short-lived scoped tokens to allow unauthenticated users to complete MCP OAuth flows. Exposing this toggle to all users does not change the underlying token security model, but operators should be aware of the implications of enabling this setting in their environment.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: dcf00a57-6dc0-480d-8ad9-58694eff1d31

📥 Commits

Reviewing files that changed from the base of the PR and between 9f4fc9d and c439f29.

📒 Files selected for processing (3)

• framework/oauth2/main.go
• transports/bifrost-http/lib/config_test.go
• ui/app/workspace/config/views/mcpView.tsx

💤 Files with no reviewable changes (1)

• framework/oauth2/main.go

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Enhanced OAuth flow management with improved per-user session handling and state security.
  • "Allow Temp Token Auth Links" setting is now consistently available in MCP configuration settings.

• Tests

  • Updated test formatting for configuration utilities.

Walkthrough

The PR reintroduces the InitiateUserOAuthFlow method in the OAuth2 backend framework and removes enterprise/SCIM gating from the MCPView frontend component. The backend method handles per-user OAuth session management with optional temp token minting; the frontend now unconditionally renders the temp token auth link control.

Changes

Per-user OAuth flow and temp token authentication

Layer / File(s)	Summary
OAuth flow initiation implementation framework/oauth2/main.go	InitiateUserOAuthFlow loads template OAuth config, resolves caller identity by flowMode, generates CSRF/PKCE credentials, performs per-user session row upsert (reusing pending rows), builds frontend auth URL, and optionally mints mcp_auth temp token in URL fragment.
MCPView temp token UI ungating ui/app/workspace/config/views/mcpView.tsx	Removed IS_ENTERPRISE constant and useGetAuthTypeQuery hook dependencies. Updated component initialization to derive config directly without isSCIMEnabled flag. Temp token auth section now always renders instead of conditionally, maintaining disabled state based on hasSettingsUpdateAccess.
Test mock formatting transports/bifrost-http/lib/config_test.go	Reformatted MockConfigStore.DeleteMCPPerUserHeaderFlow from single-line to multi-line stub; behavior and signature unchanged.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• maximhq/bifrost#3565: Refactors per-user OAuth flow handling around flowMode-driven InitiateUserOAuthFlow contract and mode/identity-based session/token lookup in the same OAuth2Provider APIs.
• maximhq/bifrost#3728: Tests toggling mcp_enable_temp_token_auth and asserting is-auth-enabled/token fields, aligning with the conditional temp-token minting now enabled in the OAuth2 user flow.

Suggested reviewers

• akshaydeo
• danpiths

Poem

🐰 OAuth flows now freed from gating chains,
Per-user sessions roam through cleaner lanes,
Temp tokens mint when enabled and bright,
Frontend controls step boldly into light—
hop toward seamless user delight! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main feature: removing the SSO/enterprise gate that previously restricted visibility of the temp token auth toggle.
Description check	✅ Passed	The description is comprehensive and well-structured, covering all key template sections including summary, changes, type, affected areas, testing, and security considerations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-27-feat_removes_sso_gate_check_for_temp_token_auth

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="[linters_context] typechecking error: pattern ./...: directory prefix . does not contain main module or its selected dependencies"

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[roroghost17]

• feat: removes SSO gate check for temp token auth #3814 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the change is a targeted UI gate removal with no logic mutations in the non-UI files.

All three files contain straightforward, complete changes: the unused imports and derived state are fully removed in the React file, and the Go files only touch whitespace. The toggle itself wires into the same standard config-save path used by every other setting on this page, so no new code paths are introduced.

No files require special attention.

Important Files Changed

Filename	Overview
ui/app/workspace/config/views/mcpView.tsx	Removes SSO/SCIM gate around temp token auth toggle; cleans up now-unused IS_ENTERPRISE import, useGetAuthTypeQuery hook call, and isSCIMEnabled variable
framework/oauth2/main.go	Removes a superfluous blank line at the start of InitiateUserOAuthFlow — no logic change
transports/bifrost-http/lib/config_test.go	Reformats DeleteMCPPerUserHeaderFlow mock stub from single-line to multi-line — no logic change

_{Reviews (1): Last reviewed commit: "feat: removes SSO gate check for temp to..." | Re-trigger Greptile}

[akshaydeo]

Merge activity

• May 27, 1:42 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 27, 1:43 PM UTC: @akshaydeo merged this pull request with Graphite.