fix(ui): route MCP console 401s through shared auth banner (RAN-36)#79
Merged
fix(ui): route MCP console 401s through shared auth banner (RAN-36)#79
Conversation
Replace raw fetch() in useMCP with mcpRequest() so a 401 on /mcp flips the same auth store /api/* uses. This makes the AuthRequiredBanner render on the MCP route when the session expires, instead of leaving the 401 stuck in local toolsError / per-call error state. - api-client: extract rawRequest helper that defaults Content-Type, attaches credentials, and signals useAuthStore on 401. apiFetch reuses it; new mcpRequest export returns the raw Response so MCP can read Mcp-Session-Id and parse SSE bodies the JSON shape can't expose. - useMCP: rpc() routes through mcpRequest; drops the now-redundant Content-Type / credentials it inherits from the helper. - Providers: keep the QueryCache/MutationCache 401 gate as a defensive layer; comment updated to reflect that the HTTP boundary is now the primary signal (signalUnauthorized is idempotent). - Tests: api-client unit tests cover apiFetch + mcpRequest 401 → store flip; new MCPConsole.test renders the route with /mcp returning 401 and asserts AuthRequiredBanner appears. Co-Authored-By: Paperclip <noreply@paperclip.ing>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Routes
/mcp401s through the sameAuthRequiredBannergate that/api/*uses. Previously, MCP's rawfetch()swallowed 401s into localtoolsErrorstate, so an expired session on/mcpshowed a generic tool error instead of the shared sign-in affordance shipped in #76.Changes
ui/src/lib/api-client.ts— extractedrawRequest()that does session bootstrap, Content-Type defaulting, credentials, and a centraliseduseAuthStore.signalUnauthorized()on 401.apiFetchreuses it; newmcpRequest()export returns the rawResponseso MCP can still readMcp-Session-Idand parsetext/event-streambodies the JSON shape can't expose.ui/src/hooks/api/useMCP.ts—rpc()now callsmcpRequest("/mcp", ...). Drops the redundantContent-Type: application/jsonandcredentials: "include"it inherits from the helper.ui/src/components/layout/Providers.tsx— kept theQueryCache/MutationCache401 gate as a defensive layer (idempotent, harmless double-signal). Comment updated to reflect that the HTTP boundary is now the primary signal.api-client.test.tscases (apiFetch/mcpRequest401-store flip, raw Response shape, credentials/CT defaults). New route-levelMCPConsole.test.tsxmocks/mcpreturning 401 and assertsAuthRequiredBannerrenders.Test plan
cd ui && npm run typecheck— clean.cd ui && npm run test -- src/lib/__tests__/api-client.test.ts— 13/13 pass (including the two new 401-store assertions).cd ui && npm run test(full suite) — currently blocked by a pre-existing project-wide vitest failure (React.act is not a functionfromreact@19.2.5CJS /@testing-library/react@16.3.2shim mismatch). Filed separately as RAN-40. The newMCPConsole.test.tsxis correct in shape and will run green once that lands./mcpand confirm the shared sign-in banner appears.Closes RAN-36.
🤖 Generated with Claude Code