[vishu-bh]

Summary

OAuth authorization on the MCP Servers page now opens the server's Components view, shows success inline, and reloads its tools, resources, and prompts. Failures display the provider's reason in a dialog with retry; dismissal leaves an Authorization needed status and an adjacent authorization action when no valid token exists.

• Keep authorization and component refresh independent, including refresh retries after successful authorization.
• Preserve valid tokens after failed reauthorization, handle cancellation and duplicate clicks, and keep late callbacks scoped to their initiating server.
• Add localized copy and keyboard/focus handling. Manual creation/editing and catalog OAuth flows retain their existing behavior.

Fixes IBM/mcp-context-forge#4684.

Validation

• Full unit suite: 227 files passed; 3,805 tests passed and 1 skipped.
• npm run build and npm run lint passed.
• Formatting and git diff --check passed for the changes.
• Four focused OAuth browser tests passed using installed Google Chrome, including failure → dismissal → retry → success with fresh components and the existing creation flow.
• Standalone e2e type checking still reports errors in unchanged e2e/tools.spec.ts and src/utils/errors.ts.

Manual verification

On an existing OAuth authorization-code server, deny consent, dismiss the failure dialog, retry from Authorization needed, and complete authorization. Confirm inline success and freshly loaded components, then use Refresh components without reopening OAuth. Also verify Escape dismisses only the dialog and closing a pending popup produces no failure dialog.

[a-effort]

Change requests inline; lmk if you want to discuss any of these proposals. 🙌

[a-effort]

Servers.tsx:311 already falls back to "Components could not be refreshed." when result.error is missing, so this line repeats the sentence. Store only the error reason; this line can add the sentence.

[a-effort]

A panel refresh now shows both a toast here and the inline warning in the Components tab. To reduce noise: only use the inline warning next to the list (includes the retry action). Only use the toast for the table action.

Line 380 writes sanitizeError(err) to the inline error before the 409 check at line 381. On a conflict, the toast says "A refresh is already running for X," but the inline text shows a generic error and a Retry refresh button while the refresh is still running. Move the write below the 409 branch so a conflict shows only the toast. Retrying cannot resolve a conflict.

[a-effort]

Suggestion: route this through ServerStatusIndicator instead. The bare span drops the status icon, the popover, and the ServerStatusDetail copy explaining that authorization is per person. The PR already adds authorizationNeeded and the table uses it, so the panel should too. #130 made this indicator the shared surface for server status and #160 is making its presentation reusable, so new status states belong inside it.

[a-effort]

If the page needs a separate state after a failed attempt, add it to ServerAvailability and PRESENTATION so every view uses. Otherwise, use authorization_required.

-->
Details:

This prop lets a caller replace the shared labels. When a caller sets authorizationNeeded, the component skips labelId and shortLabelId from PRESENTATION in serverStatus.ts and uses a fixed key instead, so the page chooses the wording rather than the server status. ServersTable is the sole caller, so this adds page-specific logic to the shared component, which #160 removes.

The override also catches the wrong cases. needsOAuthAuthorization includes authorization_expired, so an expired token shows "Authorization needed" instead of "Authorization expired." It also skips the compact branch, so the table cell shows the full text instead of "Auth."

[a-effort]

Drop this and reuse mcpServer.status.authRequired ("Authorization required").

[a-effort]

Suggestion: add a length limit. This returns the provider's errorDescription unchanged, which bypasses sanitizeError. The popup handler in servers.ts checks event.source but not event.origin, so any page loaded last in the popup can set this string. React renders it as text, so it cannot inject code, but an attacker can still place text of any length in the dialog.

[a-effort]

supportsAuthorization only confirms that the server supports authorization_code OAuth, so it passes when oauthStatus.state is "ready" with a valid token, and the oauthConfig fallback passes while the status loads. An active server then shows an authorize button at line 437. Use needsOAuthAuthorization, as ServerStatusIndicator does, so the button appears only when the server needs authorization.

Servers.tsx uses line 437 as the focus target for onCloseAutoFocus, so closing the failure dialog needs a different target when the token is valid.