test(mcp): unique client_id per oauth test config — port reuse poisoned the global token cache - #855
Conversation
…use poisoned the global token cache The oauth token cache is process-global, keyed by (token_url, client_id, secret, scopes). Every test spawns its endpoint on an ephemeral port, and the OS can hand a later test the port a finished test just released; with identical 'cid'/'s3cret' in every config the cache key collided and the later test was served the earlier test's token — its own endpoint recording zero hits. Observed as a CI flake on second_call_within_expiry_hits_the_cache (hits: left 0, right 1) on an unrelated PR (#853). config() now mints a unique client_id per call, keeping every test's cache slice disjoint however ports recycle. The exact-form assertion follows the cfg value, and same_client_different_scopes derives both configs from one base so it still tests same-client semantics.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 36 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
Comment |
1 participant
The oauth token cache is process-global, keyed by
(token_url, client_id, secret, scopes). Every test spawns its mock IdP on an ephemeral port — but the OS can hand a later test the port a finished test just released. With the identicalcid/s3cretevery test used, the cache key then collides and the later test is served the earlier test's cached token, its own endpoint recording zero hits. Observed as a CI flake onsecond_call_within_expiry_hits_the_cache(hits: left 0, right 1) on the unrelated #853.config()now mints a uniqueclient_idper call (the key includes it), keeping every test's cache slice disjoint no matter how ports recycle. Two touched tests: the exact-form assertion now follows the cfg value, andsame_client_different_scopes_mint_distinct_tokensderives both configs from one cloned base so it still exercises same-client semantics.Test-only change; no product code touched.