feat(workflow-executor): use stored OAuth credentials for MCP steps [PRD-367]#1665

Open

hercemer42 wants to merge 18 commits into

feat/prd-367-pr1-executor-oauth-credentialsfrom

feat/prd-367-pr2-executor-oauth-runtime

Commits on Jun 29, 2026

feat(workflow-executor): use stored OAuth credentials for MCP steps

hercemer42
and
claude
committed
fix(workflow-executor): write rotated refresh token to the current row

hercemer42
and
claude
committed
fix(ai-proxy): treat only 401 (not 403) as a refreshable MCP auth error

hercemer42
and
claude
committed
feat(workflow-executor): support OAuth MCP steps in the in-memory executor [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): repoint token service at the relocated credentials port [PRD-367]

hercemer42
and
claude
committed
feat(workflow-executor): re-consent on decrypt failure after key rotation [PRD-367]

hercemer42
and
claude
committed
feat(workflow-executor): add GET /list-mcp-tools design-time tool listing [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): guard against non-object token-endpoint responses [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): evict cached access token on credential disconnect [PRD-367]

hercemer42
and
claude
committed
fix(workflow-executor): address PR review on oauth2 runtime [PRD-624]

hercemer42
and
claude
committed
docs(workflow-executor): correct write-back-failure comment [PRD-624]

hercemer42
and
claude
committed
fix(workflow-executor): validate OAuth token endpoint against SSRF [PRD-624]

hercemer42
and
claude
committed
fix(workflow-executor): block IPv4-mapped IPv6 in token-endpoint guard [PRD-624]

hercemer42
and
claude
committed
docs(workflow-executor): use US spelling "defense" in refresh-grant comment [PRD-624]

hercemer42
and
claude
committed
docs(workflow-executor): rewrite token-endpoint guard comment [PRD-624]

hercemer42
and
claude
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(workflow-executor): use stored OAuth credentials for MCP steps [PRD-367]#1665

feat(workflow-executor): use stored OAuth credentials for MCP steps [PRD-367]#1665
hercemer42 wants to merge 18 commits into
feat/prd-367-pr1-executor-oauth-credentialsfrom
feat/prd-367-pr2-executor-oauth-runtime

Commits on Jun 29, 2026

feat(workflow-executor): use stored OAuth credentials for MCP steps

fix(workflow-executor): write rotated refresh token to the current row

fix(ai-proxy): treat only 401 (not 403) as a refreshable MCP auth error

feat(workflow-executor): support OAuth MCP steps in the in-memory executor [PRD-367]

fix(workflow-executor): repoint token service at the relocated credentials port [PRD-367]

feat(workflow-executor): re-consent on decrypt failure after key rotation [PRD-367]

feat(workflow-executor): add GET /list-mcp-tools design-time tool listing [PRD-367]

fix(workflow-executor): guard against non-object token-endpoint responses [PRD-367]

fix(workflow-executor): evict cached access token on credential disconnect [PRD-367]

fix(workflow-executor): address PR review on oauth2 runtime [PRD-624]

docs(workflow-executor): correct write-back-failure comment [PRD-624]

fix(workflow-executor): validate OAuth token endpoint against SSRF [PRD-624]

fix(workflow-executor): block IPv4-mapped IPv6 in token-endpoint guard [PRD-624]

docs(workflow-executor): use US spelling "defense" in refresh-grant comment [PRD-624]

docs(workflow-executor): rewrite token-endpoint guard comment [PRD-624]

Commits on Jun 30, 2026

fix(workflow-executor): block the unspecified address in token-endpoint guard [PRD-624]

fix(workflow-executor): reject localhost FQDN/.localhost aliases in token guard [PRD-624]

test(workflow-executor): cover trailing-dot IP forms in token-endpoint guard [PRD-624]