modelcontextprotocol/rust-sdk
Watch
1
0
Fork
You've already forked rust-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: improve error logging and remove token secret from logs (#685)

Browse source
This commit is contained in:
Dale Seo 2026-02-26 10:05:43 -05:00 • committed by GitHub
commit b967c132ae
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
crates/rmcp/src/transport/auth.rs
View file

@ -992,6 +992,9 @@ impl AuthorizationManager {
} }
} }
// When expiry info is unavailable (e.g., credentials stored before
// token_received_at was tracked), skip the expiry check and return
// the token as-is.
Ok(creds.access_token().secret().to_string()) Ok(creds.access_token().secret().to_string())
} }
@ -1005,8 +1008,8 @@ impl AuthorizationManager {
tracing::info!("Refreshed access token."); tracing::info!("Refreshed access token.");
Ok(new_creds.access_token().secret().to_string()) Ok(new_creds.access_token().secret().to_string())
} }
Err(AuthError::AuthorizationRequired | AuthError::TokenRefreshFailed(_)) => { Err(e @ (AuthError::AuthorizationRequired | AuthError::TokenRefreshFailed(_))) => {
tracing::warn!("Token refresh not possible, re-authorization required."); tracing::warn!(error = %e, "Token refresh not possible, re-authorization required.");
Err(AuthError::AuthorizationRequired) Err(AuthError::AuthorizationRequired)
} }
Err(e) => Err(e), Err(e) => Err(e),
@ -1030,7 +1033,7 @@ impl AuthorizationManager {
let refresh_token = current_credentials.refresh_token().ok_or_else(|| { let refresh_token = current_credentials.refresh_token().ok_or_else(|| {
AuthError::TokenRefreshFailed("No refresh token available".to_string()) AuthError::TokenRefreshFailed("No refresh token available".to_string())
})?; })?;
debug!("refresh token: {:?}", refresh_token); debug!("refresh token present, attempting refresh");
let token_result = oauth_client let token_result = oauth_client
.exchange_refresh_token(&RefreshToken::new(refresh_token.secret().to_string())) .exchange_refresh_token(&RefreshToken::new(refresh_token.secret().to_string()))
@ -2680,6 +2683,8 @@ mod tests {
// -- get_access_token -- // -- get_access_token --
use super::{OAuthTokenResponse, StoredCredentials};
fn make_token_response(access_token: &str, expires_in_secs: Option<u64>) -> OAuthTokenResponse { fn make_token_response(access_token: &str, expires_in_secs: Option<u64>) -> OAuthTokenResponse {
use oauth2::{AccessToken, EmptyExtraTokenFields, basic::BasicTokenType}; use oauth2::{AccessToken, EmptyExtraTokenFields, basic::BasicTokenType};
let mut resp = OAuthTokenResponse::new( let mut resp = OAuthTokenResponse::new(
@ -2693,8 +2698,6 @@ mod tests {
resp resp
} }
use super::{OAuthTokenResponse, StoredCredentials};
#[tokio::test] #[tokio::test]
async fn get_access_token_returns_error_when_no_credentials() { async fn get_access_token_returns_error_when_no_credentials() {
let manager = AuthorizationManager::new("http://localhost").await.unwrap(); let manager = AuthorizationManager::new("http://localhost").await.unwrap();