fix: makes mcp header temp token flow follow the UI toggle

[roroghost17]

Summary

The mcp_headers provider's tempTokens field was previously guarded by a sync.RWMutex. This PR replaces that mutex with an atomic.Pointer[temptoken.Service] for lock-free reads on the hot request path. Additionally, temp-token embedding in MCP per-user-headers auth links is now gated behind the MCPEnableTempTokenAuth client-config toggle, mirroring the existing OAuth surface behavior so the UI switch controls both per-user auth kinds uniformly.

Changes

• Replaced sync.RWMutex + *temptoken.Service field with atomic.Pointer[temptoken.Service] in mcp_headers.Provider, enabling lock-free reads during request handling.
• Added tempTokenService() helper for clean atomic load access.
• Added mcpTempTokenAuthEnabled() which reads the MCPEnableTempTokenAuth client-config flag, mirroring oauth2.OAuth2Provider.mcpTempTokenAuthEnabled, so the same toggle governs both OAuth and MCP headers auth link generation.
• InitiateUserSubmissionFlow now checks both that the service is set and that MCPEnableTempTokenAuth is enabled before minting a temp token fragment.
• Updated flake.lock to latest nixpkgs revision.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./framework/mcp_headers/...
go test ./framework/temptoken/...
go test ./...

Verify that:

• With MCPEnableTempTokenAuth disabled in client config, InitiateUserSubmissionFlow returns a URL without a temp-token fragment.
• With MCPEnableTempTokenAuth enabled and a valid temptoken.Service installed, the returned URL includes the auth fragment.
• No regressions in OAuth per-user auth flow behavior.

Breaking changes

• Yes
• No

Security considerations

Temp-token fragments in MCP per-user-headers auth URLs are now explicitly gated behind the MCPEnableTempTokenAuth client-config toggle. This ensures operators have a single, consistent control surface for enabling short-lived token embedding across both OAuth and MCP headers auth flows, reducing the risk of unintended token issuance.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (4)

• flake.lock is excluded by !**/*.lock and included by none
• framework/mcp_headers/main.go is excluded by none and included by none
• framework/mcp_headers/main_test.go is excluded by none and included by none
• framework/temptoken/scope.go is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 735169b7-aee0-4498-bc6b-93809137263f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-28-fix_makes_mcp_header_temp_token_flow_follow_the_ui_toggle

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[roroghost17]

• fix: makes mcp header temp token flow follow the UI toggle #3836 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[CLAassistant]

All committers have signed the CLA.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the refactor is mechanical and well-tested, with no behavioral changes beyond the intended toggle gate.

The atomic.Pointer swap is straightforward and matches the existing oauth2 pattern exactly. The new toggle gate is fail-closed, mirrors the OAuth surface faithfully, and is now covered by dedicated tests. No regressions were identified across the changed paths.

No files require special attention.

Important Files Changed

Filename	Overview
framework/mcp_headers/main.go	Replaces sync.RWMutex+pointer with atomic.Pointer[temptoken.Service] and adds mcpTempTokenAuthEnabled gate, correctly mirroring oauth2.OAuth2Provider
framework/mcp_headers/main_test.go	New test file covering mcpTempTokenAuthEnabled, toggle-gated URL fragment, nil-service, and config-read-error (fail-closed) cases
framework/temptoken/scope.go	Removes inline file-path reference from a comment; no functional change
flake.lock	Routine nixpkgs revision bump; no code impact

_{Reviews (2): Last reviewed commit: "fix: makes mcp header temp token flow fo..." | Re-trigger Greptile}

[Pratham-Mishra04]

Merge activity

• May 28, 10:01 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 28, 10:02 AM UTC: @Pratham-Mishra04 merged this pull request with Graphite.