feat(actions): add passthrough auth #6665

Subash-Mohan · 2025-12-08T05:18:29Z

Description

This pull request introduces a new "OAuth Pass-through" authentication method for both MCP and OpenAPI connectors, improves the Action Card component's hover state management, and refines UI behaviors for authentication and server management actions. The most significant changes are grouped below by theme.

How Has This Been Tested?

Tested from UI

Additional Options

[Optional] Override Linear Check

Summary by cubic

Adds OAuth pass-through to MCP and OpenAPI so Onyx can forward the signed-in user’s token. Also replaces the legacy Actions page with dedicated MCP and OpenAPI pages and improves cards, tool lists, and loading states.

New Features
- Added “OAuth Pass-through” for MCP and OpenAPI; shown only when instance auth is OIDC or Google OAuth, and OpenAPI persists passthrough_auth.
- Tracked MCP server last_refreshed_at and exposed it via the API.
UI Improvements
- New MCP Actions and OpenAPI Actions pages (with sidebar entries and MCP icon) using a shared AdminPageLayout.
- ActionCard now has a shared hover context; added skeleton loaders, clearer modals/icons, and streamlined tool counts and controls.

^{Written for commit 5811fba. Summary will update automatically on new commits.}

greptile-apps · 2025-12-08T05:21:14Z

Greptile Overview

Greptile Summary

This PR introduces OAuth Pass-through authentication for MCP and OpenAPI connectors, allowing Onyx to forward user OAuth tokens directly to services that share the same identity provider. Additionally, it enhances the ActionCard component with improved hover state management using React Context.

Key Changes:

Added new pt-oauth authentication method to both MCP and OpenAPI authentication modals, conditionally displayed when OIDC/OAuth is enabled
Implemented ActionCardContext to centralize hover state management across ActionCard components
Enhanced UX with hover-based visibility transitions for disconnect/delete buttons and shadow effects on cards
Simplified rename functionality to work across all connection statuses
Updated authentication button styling from secondary to tertiary for pending state

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The implementation is well-structured, follows established patterns, and adheres to the repository's coding standards. The passthrough OAuth feature properly validates against instance auth configuration, and the UI enhancements use React Context appropriately. All changes are additive and don't introduce breaking changes.
No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
web/src/sections/actions/ActionCardContext.tsx	5/5	New context file to manage hover state across ActionCard components, following React best practices
web/src/sections/actions/ActionCard.tsx	5/5	Integrated hover context provider and added hover effects with shadow transitions
web/src/sections/actions/ActionCardHeader.tsx	5/5	Simplified hover logic using context, improved rename behavior to work across all statuses
web/src/sections/actions/Actions.tsx	5/5	Added hover-based visibility transitions for disconnect and delete buttons, changed pending auth button from secondary to tertiary
web/src/sections/actions/OpenApiPageContent.tsx	5/5	Added passthrough OAuth handling in connect flow, passing the flag through to modal component
web/src/sections/actions/modals/MCPAuthenticationModal.tsx	5/5	Added PT_OAUTH authentication type with conditional rendering based on instance OAuth configuration
web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx	5/5	Added pt-oauth authentication method, refactored UI to show method-specific sections conditionally

Sequence Diagram

sequenceDiagram
    participant User
    participant OpenAPIModal
    participant MCPModal
    participant useAuthType
    participant API
    participant Backend

    User->>OpenAPIModal: Select "OAuth Pass-through"
    OpenAPIModal->>useAuthType: Check if OAuth enabled
    useAuthType-->>OpenAPIModal: OIDC or Google OAuth
    OpenAPIModal->>OpenAPIModal: Show pt-oauth option
    User->>OpenAPIModal: Submit pt-oauth
    OpenAPIModal->>API: updateCustomTool(passthrough_auth: true)
    API->>Backend: PATCH /api/admin/tool/custom/{id}
    Backend-->>API: Success
    API-->>OpenAPIModal: Tool updated
    OpenAPIModal->>User: Show success message

    User->>MCPModal: Select "OAuth Pass-through"
    MCPModal->>useAuthType: Check if OAuth enabled
    useAuthType-->>MCPModal: OIDC or Google OAuth
    MCPModal->>MCPModal: Show PT_OAUTH option
    User->>MCPModal: Submit PT_OAUTH
    MCPModal->>API: Update MCP server config
    API->>Backend: Update auth_type: PT_OAUTH
    Backend-->>API: Success
    API-->>MCPModal: Server updated
    MCPModal->>User: Show success message

greptile-apps

_{7 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

cubic-dev-ai

3 issues found across 7 files

Prompt for AI agents (all 3 issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="web/src/sections/actions/modals/MCPAuthenticationModal.tsx">

<violation number="1" location="web/src/sections/actions/modals/MCPAuthenticationModal.tsx:434">
P2: The `PT_OAUTH` option is added but the `onValueChange` handler doesn&#39;t set `auth_performer` to `PER_USER` for this auth type. Since PT_OAUTH forwards the user&#39;s token, it should also be treated as per-user authentication. Update the condition at line 417 to include `PT_OAUTH`:
```tsx
if (value === MCPAuthenticationType.OAUTH || value === MCPAuthenticationType.PT_OAUTH) {
```</violation>
</file>

<file name="web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx">

<violation number="1" location="web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx:231">
P2: `passthroughOAuthEnabled` is used in `computedInitialValues` but is missing from the useMemo dependency array. The initial values won&#39;t recalculate when this prop changes. Add `passthroughOAuthEnabled` to the dependency array.</violation>

<violation number="2" location="web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx:377">
P1: The validation schema doesn&#39;t include &quot;pt-oauth&quot; in the allowed values. Form submission will fail when users select &quot;OAuth Pass-through&quot; because `authMethod.oneOf([&quot;oauth&quot;, &quot;custom-header&quot;])` at line 150 rejects &quot;pt-oauth&quot;. Update the schema to include the new auth method.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

web/src/sections/actions/modals/MCPAuthenticationModal.tsx

web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx

raunakab · 2025-12-17T04:15:07Z

web/src/sections/actions/ActionCardHeader.tsx

-              className="h-6 w-6"
-              aria-label={`Edit ${title}`}
+              onClick={handleRenameClick}
+              className="h-6 w-6 opacity-70 hover:opacity-100"


Hm, how come we have custom styling here?

I think we don’t need custom styling here, at least for now. If we need custom styling, we can introduce it as a prop.

Could you remove the custom styling if it's not needed then?

Sry, I misunderstood the question. We need this styling here.

…n OpenAPI and MCP modals

… hover context

…th and API token authentication

raunakab · 2025-12-17T18:33:44Z

web/src/sections/actions/ActionCardHeader.tsx

-              className="h-6 w-6"
-              aria-label={`Edit ${title}`}
+              onClick={handleRenameClick}
+              className="h-6 w-6 opacity-70 hover:opacity-100"


Could you remove the custom styling if it's not needed then?

raunakab · 2025-12-17T18:35:13Z

Please remember to remove the custom styling in web/src/sections/actions/ActionCardHeader.tsx prior to merging.

…r configuration

…no-auth flow test

Subash-Mohan requested a review from a team as a code owner December 8, 2025 05:18

greptile-apps bot reviewed Dec 8, 2025

View reviewed changes

cubic-dev-ai bot reviewed Dec 8, 2025

View reviewed changes

web/src/sections/actions/modals/MCPAuthenticationModal.tsx Outdated Show resolved Hide resolved

web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx Show resolved Hide resolved

web/src/sections/actions/modals/OpenAPIAuthenticationModal.tsx Show resolved Hide resolved

Subash-Mohan force-pushed the feat/add-passthrough-auth branch from 61efe68 to 29f8443 Compare December 8, 2025 06:20

raunakab reviewed Dec 17, 2025

View reviewed changes

Subash-Mohan added 3 commits December 17, 2025 11:01

feat(auth): add support for passthrough OAuth authentication method i…

a3dfb94

…n OpenAPI and MCP modals

feat(actions): implement MCP actions page and enhance ActionCard with…

b3b6c85

… hover context

feat(auth): enhance MCP and OpenAPI modals to support passthrough OAu…

9d2128d

…th and API token authentication

Subash-Mohan force-pushed the feat/add-passthrough-auth branch from 29f8443 to 9d2128d Compare December 17, 2025 05:43

raunakab approved these changes Dec 17, 2025

View reviewed changes

Subash-Mohan added 6 commits December 18, 2025 12:56

feat(mcp): auth and deletion changes (#6666)

a735501

Merge branch 'main' into feat/add-passthrough-auth

5fea6d0

fix: update Actions component props typing

fb6bcf0

fix(alembic): update down_revision for last refreshed at migration

9ad432e

refactor(tests): update modal dialog selectors for web search provide…

25f7166

…r configuration

refactor(tests): remove redundant tool attachment step in MCP client …

5811fba

…no-auth flow test

Subash-Mohan added this pull request to the merge queue Dec 18, 2025

Merged via the queue into main with commit b273d91 Dec 18, 2025
68 checks passed

Subash-Mohan deleted the feat/add-passthrough-auth branch December 18, 2025 11:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(actions): add passthrough auth #6665

feat(actions): add passthrough auth #6665

Uh oh!

Subash-Mohan commented Dec 8, 2025 •

edited by cubic-dev-ai bot

Loading

Uh oh!

greptile-apps bot commented Dec 8, 2025

Uh oh!

greptile-apps bot left a comment

Uh oh!

cubic-dev-ai bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

raunakab Dec 17, 2025

Uh oh!

Subash-Mohan Dec 17, 2025

Uh oh!

raunakab Dec 17, 2025

Uh oh!

Subash-Mohan Dec 18, 2025

Uh oh!

raunakab Dec 17, 2025

Uh oh!

raunakab commented Dec 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

feat(actions): add passthrough auth #6665

feat(actions): add passthrough auth #6665

Uh oh!

Conversation

Subash-Mohan commented Dec 8, 2025 • edited by cubic-dev-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How Has This Been Tested?

Additional Options

Summary by cubic

Uh oh!

greptile-apps bot commented Dec 8, 2025

Greptile Overview

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

raunakab Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Subash-Mohan Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

raunakab Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

Subash-Mohan Dec 18, 2025

Choose a reason for hiding this comment

Uh oh!

raunakab Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

raunakab commented Dec 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Subash-Mohan commented Dec 8, 2025 •

edited by cubic-dev-ai bot

Loading