get refreshable tokens

[bilogic]

Summary

use the short lived token to get a refreshable one

Type

• Feature
• Bug fix
• Hotfix (targeting main)
• Refactor
• Docs
• CI/CD

Target Branch

Checklist

• go build ./... passes
• go build -tags sqliteonly ./... passes (if Go changes)
• go vet ./... passes
• Tests pass: go test -race ./...
• Web UI builds: cd ui/web && pnpm build (if UI changes)
• No hardcoded secrets or credentials
• SQL queries use parameterized $1, $2 (no string concat)
• New user-facing strings added to all 3 locales (en/vi/zh)
• Migration version bumped in internal/upgrade/version.go (if new migration)

Test Plan

tested with dropbox

[clark-cant]

PR #1510 Review — "get refreshable tokens"

Summary: Adds ExtraAuthParams to StartFlowParams so provider-specific OAuth authorization parameters (e.g. Dropbox's token_access_type=offline) can be passed through without overriding standard OAuth params. Includes a Dropbox-specific helper dropboxOfflineAuthParam() and comprehensive tests.

Risk level: Low — +125/-13, 4 files, focused on MCP OAuth flow, well-tested.

Mandatory gates:

• Duplicate / prior implementation: ✅ clear — no prior PR or issue for Dropbox refresh tokens or ExtraAuthParams
• Project standards: ✅ generated baseline — follows Go conventions, proper error handling, idiomatic test structure
• Strategic necessity: ✅ clear value — fixes Dropbox OAuth tokens expiring after ~4h with no refresh, real user pain point

Findings:

• No critical or important issues
• Code is clean, well-documented, and defensive (nil checks, URL parse error handling)
• Tests cover happy path, edge cases (malformed URL, non-Dropbox host), and security (standard params cannot be overridden)
• Struct alignment changes in MCPOAuthHandlerDeps are cosmetic (go-fmt), not functional

Verdict: Approve — Low risk, well-scoped, good test coverage, solves a real problem.

Posted by /github-maintain at 2026-08-08T03:01:30Z