Source code for mindroot.coreplugins.admin.oauth_callback_router
"""OAuth callback router for MCP servers.
This router contains public routes that do not require authentication,
as external OAuth providers need to be able to redirect to these endpoints.
"""
from fastapi import APIRouter, Request
from fastapi.responses import HTMLResponse
from lib.route_decorators import public_route
# Create router without dependencies - routes will be public
router = APIRouter()
[docs]
@router.get("/mcp_oauth_cb")
@public_route()
async def mcp_oauth_callback(request: Request):
"""Handle OAuth callback for MCP servers.
This endpoint must be publicly accessible as external OAuth providers
will redirect to it without any authentication.
"""
try:
# Get query parameters
code = request.query_params.get('code')
state = request.query_params.get('state')
error = request.query_params.get('error')
if error:
# OAuth error occurred - avoid f-string issues
error_html = (
"<html><body>"
"<h2>OAuth Authorization Failed</h2>"
f"<p>Error: {error}</p>"
"<p>You can close this window.</p>"
"<script>window.close();</script>"
"</body></html>"
)
return HTMLResponse(error_html)
if code:
# Success - show completion page
state_value = state or ""
# Build HTML without f-string to avoid escaping issues
success_html = (
"<html><body>"
"<h2>OAuth Authorization Successful</h2>"
"<p>Authorization code received. You can close this window.</p>"
"<script>"
"if (window.opener) {"
"window.opener.postMessage({"
"type: 'oauth_callback',"
f"code: '{code}',"
f"state: '{state_value}'"
"}, '*');"
"}"
"setTimeout(() => window.close(), 2000);"
"</script>"
"</body></html>"
)
return HTMLResponse(success_html)
# No code or error - invalid callback
invalid_html = (
"<html><body>"
"<h2>Invalid OAuth Callback</h2>"
"<p>Missing authorization code or error parameter.</p>"
"<p>You can close this window.</p>"
"<script>window.close();</script>"
"</body></html>"
)
return HTMLResponse(invalid_html)
except Exception as e:
# Error handling - escape special characters
error_message = str(e).replace('"', '"').replace("'", "'")
error_html = (
"<html><body>"
"<h2>OAuth Callback Error</h2>"
f"<p>An error occurred processing the OAuth callback: {error_message}</p>"
"<p>You can close this window.</p>"
"<script>window.close();</script>"
"</body></html>"
)
return HTMLResponse(error_html)