fix(mcp): restore downstream Asset authorization

[kl3inIT]

Outcome

• replace Spring Security's default JWT token type instead of appending a duplicate RFC 8693 parameter
• idempotently repair the existing Keycloak gateway client's standard token-exchange flag while preserving its full representation
• add regression coverage for the single token type and live Keycloak configuration drift

Evidence

• :apps:mcp:check
• test-keycloak-mcp-onboarding.sh
• production-shaped manual exchange: MCP audiences to orgmemory-web succeeded

Summary by CodeRabbit

• New Features

  • Added gateway client configuration for MCP authentication and token exchange.
  • OAuth token exchanges now consistently use access tokens and the configured API audience.

• Bug Fixes

  • Improved synchronization and verification of gateway client settings during deployment.
  • Added onboarding checks to detect and correct configuration drift.

• Tests

  • Added coverage verifying token-exchange parameters and gateway client configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 40695c05-6a08-4d01-8d9b-cc911adca48b

📥 Commits

Reviewing files that changed from the base of the PR and between 88baf91 and 04d329c.

⛔ Files ignored due to path filters (1)

• docs/runbooks/mcp-asset-delivery.md is excluded by !docs/**

📒 Files selected for processing (5)

• apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java
• apps/mcp/src/test/java/com/orgmemory/mcp/McpApiAuthorizationTests.java
• infrastructure/deployment/scripts/configure-keycloak-mcp.sh
• infrastructure/deployment/scripts/test-keycloak-mcp-onboarding.sh
• infrastructure/keycloak/mcp-gateway-client.json

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: Deployment contracts
• GitHub Check: Backend · Java 25

🧰 Additional context used

📓 Path-based instructions (2)

**/*

📄 CodeRabbit inference engine (CLAUDE.md)

**/*: Record current behavior in architecture/specification documentation only after it exists in code; keep intended behavior in vision, roadmap, or an active increment, and do not duplicate state.
Before using unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult current official documentation via Context7 and the project orgmemory-* verification skills.
Before retrieval, AI, MCP, permission, upload, graph, or export work, read docs/guidelines/agent-safety.md.
Never commit .env files, provider keys, tokens, or customer data.
Run the relevant verification gates from docs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treat bootRun as verification.

Files:

• infrastructure/keycloak/mcp-gateway-client.json
• infrastructure/deployment/scripts/configure-keycloak-mcp.sh
• apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java
• apps/mcp/src/test/java/com/orgmemory/mcp/McpApiAuthorizationTests.java
• infrastructure/deployment/scripts/test-keycloak-mcp-onboarding.sh

**/*.{java,kt}

📄 CodeRabbit inference engine (CLAUDE.md)

JetBrains IDE inspection is a verification gate for the Java backend.

Files:

• apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java
• apps/mcp/src/test/java/com/orgmemory/mcp/McpApiAuthorizationTests.java

🧠 Learnings (2)

📚 Learning: 2026-07-26T05:46:47.443Z

Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.

Applied to files:

• apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java

📚 Learning: 2026-07-26T05:46:49.308Z

Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpTransportConfiguration.java:34-43
Timestamp: 2026-07-26T05:46:49.308Z
Learning: In the MCP module, authentication should be captured at servlet-time in `McpTransportConfiguration` (via the servlet `contextExtractor`) and stored in `McpTransportContext` under `AUTHENTICATION_CONTEXT_KEY`. Any authorization code (e.g., `McpApiAuthorization`) must consume this stored `Authentication` from `McpTransportContext` rather than re-reading it from `SecurityContextHolder`. Preserve the existing validation behavior: treat missing authentication as `null`, and only proceed when the consumed authentication is non-null and `authentication.isAuthenticated()` is true.

Applied to files:

• apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java

🔇 Additional comments (5)

apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java (1)

18-68: LGTM!

apps/mcp/src/test/java/com/orgmemory/mcp/McpApiAuthorizationTests.java (1)

22-25: LGTM!

Also applies to: 102-119

infrastructure/keycloak/mcp-gateway-client.json (1)

1-7: LGTM!

infrastructure/deployment/scripts/configure-keycloak-mcp.sh (1)

13-13: LGTM!

Also applies to: 62-127

infrastructure/deployment/scripts/test-keycloak-mcp-onboarding.sh (1)

100-141: LGTM!

Also applies to: 161-179

---

📝 Walkthrough

Walkthrough

The MCP OAuth configuration now centralizes token-exchange parameter customization. Keycloak deployment automation provisions and verifies the orgmemory-mcp gateway client, while onboarding tests exercise attribute drift repair and validate the gateway-client contract.

Changes

OAuth token exchange and Keycloak gateway client

Layer / File(s)	Summary
Token-exchange parameter customization apps/mcp/src/main/java/com/orgmemory/mcp/McpDownstreamOAuthConfiguration.java, apps/mcp/src/test/java/com/orgmemory/mcp/McpApiAuthorizationTests.java	Token exchange requests now set the access-token subject type and API audience through a shared helper, with unit coverage for both parameters.
Gateway client synchronization infrastructure/keycloak/mcp-gateway-client.json, infrastructure/deployment/scripts/configure-keycloak-mcp.sh	Adds the desired gateway-client definition and synchronizes its attributes with the matching Keycloak client, including post-update verification.
Onboarding drift and contract verification infrastructure/deployment/scripts/test-keycloak-mcp-onboarding.sh	Removes the token-exchange attribute to test repair, then validates gateway-client attributes, client authentication type, and public-client status.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ConfigureScript
  participant GatewayClientConfig
  participant Keycloak
  ConfigureScript->>GatewayClientConfig: read desired clientId and attributes
  ConfigureScript->>Keycloak: locate and fetch orgmemory-mcp client
  ConfigureScript->>Keycloak: update merged attributes
  Keycloak-->>ConfigureScript: return updated client
  ConfigureScript->>ConfigureScript: verify desired attributes

Loading

Possibly related PRs

• kl3inIT/OrgMemory#61: Updates the same OAuth token-exchange parameter behavior.
• kl3inIT/OrgMemory#62: Uses the same Keycloak MCP onboarding automation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title matches the main change: restoring downstream MCP asset authorization via token-exchange and Keycloak fixes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kl3inIT/mcp-token-exchange-fix

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}