fix: handle account token auth when /user probe fails - #49
Merged
mattzcarey merged 4 commits intoMar 4, 2026
Conversation
Guard JSON parsing behind successful Cloudflare API responses so account-scoped tokens can authenticate when /accounts succeeds and /user returns a non-JSON 403 body. Document request_ip caveat for hosted MCP egress and cover mixed-success cases with tests.
Contributor
Author
|
/bigbonk review this |
Handle mixed-status /user and /accounts failures using combined status classification, normalize fetch failures to OAuthError, and safely parse payload schemas without throwing non-OAuth errors. Expand oauth-handler tests to cover status mappings, malformed/invalid JSON payloads, account fallback semantics, and global fetch stub cleanup.
Contributor
|
/bonk review this |
- Extract fetchCloudflareProbes helper to eliminate awkward let + semicolon-prefix pattern - Inline single-use parse helpers (parseCloudflareResponse, parseUserFromResponse, parseAccountsFromResponse) - Replace duplicate CloudflareUser/CloudflareAccount type aliases with schema-derived types from types.ts - Fix expectOAuthError test helper to catch once instead of awaiting rejected promise twice - Add clarifying comment for why OAuth callback rejects null user
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/userreturns 403 but/accountssucceeds — return{ user: null, accounts }soapi-token-mode.tscan use account-only auth/userand/accountsJSON bodies when the response isok, preventing crashes on non-JSON error bodies (e.g."Forbidden")safeParseinstead ofparseso malformed payloads log errors and degrade gracefully instead of throwingOAuthErrorviathrowCombinedCloudflareApiError(prioritizes 5xx > 429 > 401 > 403)fetchCloudflareProbeshelper to encapsulate the parallel fetch + network error handlingUserSchema,AccountSchema) fromtypes.tsinstead of duplicate local type aliasesTest plan
npm run check— format, lint, typecheck, and all 83 tests passoauth-handler.test.tscovers: account-scoped token fallback, user-only token, dual failures (401/403/429/500/mixed), invalid JSON fallback, invalid payload shape, empty accounts, fetch rejection