Skip to content

fix: only show DCR hint for authorization_code grant type - #116

Open
marekdano wants to merge 1 commit into
mainfrom
6466-fix-display-hint-for-dcr-only
Open

fix: only show DCR hint for authorization_code grant type#116
marekdano wants to merge 1 commit into
mainfrom
6466-fix-display-hint-for-dcr-only

Conversation

@marekdano

@marekdano marekdano commented Sep 9, 2026

Copy link
Copy Markdown
Contributor

Closes IBM/mcp-context-forge#6466

Summary

"DCR hint shown on Client ID and Secret for the client credentials grant"

  • The DCR (Dynamic Client Registration) hint under Client ID/Client Secret was shown for every OAuth grant type, but DCR only applies to the authorization-code flow (backend /oauth/authorize/{gateway_id}). Users on client_credentials who followed the hint and left those fields blank hit an opaque "OAuth authentication failed" error from register_gateway.
  • Gate both dcrHelp hints on grantType === "authorization_code".
  • Reword the hint (en-US/es-ES/pt-BR) from "Not required for servers that support Dynamic Client Registration (DCR)" to "Optional. Some authorization servers issue these automatically when you authorize." to avoid implying the fields can be skipped.

Test plan

  • Added unit tests in OAuth2Auth.test.tsx covering hint visibility per grant type
  • npx vitest run src/components/mcp-servers/OAuth2Auth.test.tsx — 18 passed
  • npx tsc --noEmit clean

Signed-off-by: Marek Dano <mk.dano@gmail.com>

@vishu-bh vishu-bh left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 🚀

@a-effort a-effort left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the diff. No blockers.

The DCR hint is now gated on grantType === 'authorization_code' in both the Client ID and Client Secret fields. The hint text is also reworded to remove the DCR acronym and describe the actual behavior. The i18n strings are updated across all three locales consistently.

The test coverage is correct: it checks that the hint is absent for client_credentials and password grant, and present twice (once per field) for authorization_code. The existing test for the password grant legacy label is preserved and unaffected.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DCR hint shown on Client ID and Secret for the client credentials grant

3 participants