Fix Unauthorized mcp issue

[Induwara04]

This pull request addresses a subtle but important distinction in error handling for authentication failures when proxying to upstream MCP servers. It ensures that a 401 Unauthorized response from an upstream MCP server is not mistaken for the user's own session expiring, which previously could have caused clients to log users out unnecessarily. The change introduces a new error code and status for this scenario, updates backend and frontend logic to handle it, and adds tests to pin the correct behavior.

Backend changes:

• Introduced a new error code MCP_PROXY_UPSTREAM_UNAUTHORIZED and corresponding error entry, ensuring that an upstream MCP server's 401 is surfaced as a 400 with a distinct code, not as a standard Unauthorized error. This prevents clients from logging out users when the error is not about their own session. [1] [2] [3]
• Added a backend test (TestFetchMCPServerInfoUpstream401IsNotOurUnauthorized) to verify that an upstream 401 is mapped to the new error code and does not result in a 401 to the client.

Frontend changes:

• Updated the handleUnauthorizedResponse function and all its call sites to only trigger a logout if the error code is exactly UNAUTHORIZED. 401 responses with other codes (such as MCP_PROXY_UPSTREAM_UNAUTHORIZED) no longer cause the session to be torn down. [1] [2] [3] [4] [5]
• Improved inline documentation to clarify the distinction between user session expiry and upstream authentication failures.

These changes together ensure that only genuine user session expiry logs the user out, while upstream authentication issues are surfaced as errors without disrupting the user's session.

[coderabbitai]

Warning

Review limit reached

@Induwara04, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0d25315e-3e33-4ca7-aa09-9ae69448506a

📥 Commits

Reviewing files that changed from the base of the PR and between 85956b0 and fdfa06d.

📒 Files selected for processing (1)

• platform-api/internal/utils/mcp_test.go

📝 Walkthrough

Walkthrough

The API now distinguishes upstream MCP credential rejection from caller authentication expiry. The workspace portal parses error codes before handling 401 responses and logs out only for caller authentication failures.

Changes

MCP authorization error handling

Layer / File(s)	Summary
Upstream error contract and API mapping platform-api/internal/apperror/catalog.go, platform-api/internal/apperror/codes.go, platform-api/internal/utils/mcp.go, platform-api/internal/utils/mcp_test.go	Adds CodeMCPProxyUpstreamUnauthorized and its client-safe catalog entry. MCP HTTP 401 responses now use this error, with regression coverage for the returned code and status.
Portal authorization filtering portals/ai-workspace/src/auth/logout.ts, portals/ai-workspace/src/apis/platformApis.ts, portals/ai-workspace/src/clients/choreoApiClient.ts, portals/ai-workspace/src/contexts/ChoreoUserContext.tsx	Error parsing now occurs before logout handling. Coded 401 responses trigger logout only for UNAUTHORIZED; other coded responses preserve the session.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MCPServer
  participant FetchMCPServerInfo
  participant APIError
  participant Portal
  participant LogoutHandler
  MCPServer-->>FetchMCPServerInfo: HTTP 401
  FetchMCPServerInfo->>APIError: MCPProxyUpstreamUnauthorized
  APIError-->>Portal: Error code
  Portal->>LogoutHandler: Response and error code
  LogoutHandler-->>Portal: Preserve session for coded upstream error

Loading

Possibly related PRs

• wso2/api-platform#3180: Modifies MCP error handling for upstream authentication failures.

Suggested reviewers: krishanx92

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change and tests, but it omits most required template sections, including security checks, documentation, user stories, samples, related PRs, and test environment.	Complete the required template sections and provide issue links, test coverage details, security-check results, documentation impact, related PRs, and the test environment.
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies the MCP unauthorized-error fix, which matches the pull request’s primary backend and frontend change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@platform-api/internal/utils/mcp_test.go`:
- Around line 127-130: Update the assertion in the MCP error test to require
appErr.HTTPStatus to equal http.StatusBadRequest exactly, rather than only
rejecting http.StatusUnauthorized. Preserve the existing error message context
while ensuring HTTP 403, 500, and other statuses fail the test.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 53e7b004-3e83-48be-b06c-f33d2422ee9f

📥 Commits

Reviewing files that changed from the base of the PR and between f8036ec and 85956b0.

📒 Files selected for processing (8)

• platform-api/internal/apperror/catalog.go
• platform-api/internal/apperror/codes.go
• platform-api/internal/utils/mcp.go
• platform-api/internal/utils/mcp_test.go
• portals/ai-workspace/src/apis/platformApis.ts
• portals/ai-workspace/src/auth/logout.ts
• portals/ai-workspace/src/clients/choreoApiClient.ts
• portals/ai-workspace/src/contexts/ChoreoUserContext.tsx