refactor: remove deferred-fill user-mode OAuth flow support

[Pratham-Mishra04]

Summary

Removes the "deferred-fill" user-mode OAuth flow concept, where a user identity could be left nil at flow initiation and stamped in later at completion time. User-mode flows now require a valid user identity to be present in context at initiation, simplifying the flow lifecycle and eliminating ambiguous states.

Changes

• InitiateUserOAuthFlow now returns an error immediately if a user-mode flow is started without a user identity in context, rather than allowing a nil user_id to be stored and resolved later.
• CompleteUserOAuthFlow no longer attempts to pull a user identity from the completer's context as a fallback — the identity must already be on the session row.
• The UserID comment on TableOauthUserSession has been updated to reflect that it is only populated for user-mode rows and is nil for vk/session-mode rows.
• The list handler no longer skips deferred-fill user-mode rows (the concept no longer exists).
• The flowDetail handler no longer falls back to the signed-in caller's user identity when flow.UserID is nil.
• The loadAuthorizedFlow comment no longer references deferred-fill visibility semantics.
• The lookupID guard in InitiateUserOAuthFlow has been removed since lookupID is now always populated before the lookup.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./framework/oauth2/...
go test ./transports/bifrost-http/...

Attempt to initiate a user-mode OAuth flow without a user identity in context and confirm an error is returned. Initiate a user-mode flow with a valid user identity and confirm the flow proceeds and completes correctly with the identity already present on the session row.

Breaking changes

• Yes
• No

User-mode OAuth flows that previously relied on deferred identity stamping (initiating without a user identity and resolving it at completion) will now fail at initiation. Callers must ensure a user identity is present in context before calling InitiateUserOAuthFlow for user-mode flows.

Security considerations

This change tightens the identity model for user-mode OAuth flows. Previously, a flow row could exist with no associated user identity, which could allow any authenticated caller to claim the flow URL. Requiring identity at initiation ensures each flow is bound to a specific user from the start, removing the ambiguous ownership window.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (3)

• framework/configstore/tables/oauth.go is excluded by none and included by none
• framework/oauth2/main.go is excluded by none and included by none
• transports/bifrost-http/handlers/mcp_sessions.go is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8ceea431-2058-4a81-947b-ab8c2372aee4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-28-fix_removes_deferred_user_mode_in_mcp_sessions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Pratham-Mishra04]

• fix: gate user-mode flows on caller user_id and skip temp token mint #3841
• refactor: rename staticHeadersResolver/serverOAuthResolver to sharedHeadersResolver/sharedOAuthResolver #3840
• refactor: remove deferred-fill user-mode OAuth flow support #3839 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Confidence Score: 4/5

Safe to merge; the refactor is internally consistent across all three files and correctly enforces the new identity-at-initiation invariant.

The logic changes are coherent and correctly remove the deferred-fill path end-to-end. The lookupID guard removal is safe because every mode now guarantees a non-empty value before reaching the DB lookup. The removed in-memory audit stamp was never subsequently persisted in the completion path, so its removal has no observable effect.

framework/oauth2/main.go deserves a second look only to confirm that pre-existing null-UserID session rows in production databases are handled acceptably at the flowDetail and list endpoints post-deploy.

Important Files Changed

Filename	Overview
framework/configstore/tables/oauth.go	Comment-only change: updates the UserID field description to drop deferred-fill language, accurately reflecting the new invariant.
framework/oauth2/main.go	Core logic: InitiateUserOAuthFlow now errors on missing user identity; the lookupID guard is safely removed since all modes guarantee a non-empty lookupID; CompleteUserOAuthFlow drops deferred-fill context fallback and the in-memory audit stamp. The removed stamp-back was never persisted post-initiation, so its removal is safe.
transports/bifrost-http/handlers/mcp_sessions.go	Handler updates are consistent with the new model: list no longer skips nil-UserID rows (they won't be created anymore), flowDetail drops the caller-identity fallback, and comments are updated to remove deferred-fill references.

_{Reviews (1): Last reviewed commit: "fix: removes deferred user mode in mcp s..." | Re-trigger Greptile}

[akshaydeo]

Merge activity

• May 28, 12:21 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 28, 12:22 PM UTC: @akshaydeo merged this pull request with Graphite.