{"slug":"connectors/P0_OAUTH_TEST_DEPLOYMENT_CHECKLIST","title":"P0: OAuth Test Deployment Checklist","section":"connectors","sectionLabel":"Connectors","status":"unclassified","type":"document","path":"connectors/P0_OAUTH_TEST_DEPLOYMENT_CHECKLIST.mdx","bytes":6839,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**Objective**: Deploy the public OAuth release-blocker fixes to test environment and validate end-to-end flow.\n\n**Timeline**: Execute after code review of release/public-connector-go-live branch\n\n---\n\n## Pre-Deployment: Local Validation\n\n- [ ] Run smoke tests locally:\n\n  ```bash\n  cd services/mcp-connector\n  pnpm test oauth.test.ts\n  ```\n\n  Expect: All 8 new public OAuth tests pass\n\n- [ ] Check for TypeScript errors:\n\n  ```bash\n  pnpm exec tsc --noEmit\n  ```\n\n  Expect: No errors in oauth-auth-server.ts or oauth-clients.ts\n\n- [ ] Verify wrangler.toml changes:\n  ```bash\n  grep \"MCP_EXTERNAL_OAUTH_ENABLED\" services/mcp-connector/wrangler.toml\n  ```\n  Expect: `\"true\"` in [env.test], `\"false\"` in [env.prod]\n\n---\n\n## Deployment Step 1: Dry-Run Release\n\n**Command**:\n\n```bash\npnpm release:core \\\n  --env test \\\n  --service core \\\n  --dry-run true\n```\n\n**Expected Output**:\n\n- ✓ Release pipeline validated\n- ✓ Connector service compiled\n- ✓ MCP-Connector service compiled\n- ✓ Connector-sync service compiled\n- ✓ Knowledge service compiled\n- ✓ Continuity service compiled\n- ✓ Intelligence service compiled\n- ✓ Workflow service compiled\n- ✓ L2 service compiled\n- ✓ Gateway service compiled\n\n**If fails**: Check service build logs and fix compilation errors before proceeding.\n\n---\n\n## Deployment Step 2: Live Release to Test\n\n**Command**:\n\n```bash\npnpm release:core \\\n  --env test \\\n  --service core \\\n  --dry-run false\n```\n\n**Expected Output**:\n\n- Cloudflare Workers deploy messages for each service\n- All services report \"✓ Published\"\n\n**Record**: Screenshot or copy the workflow URL from GitHub Actions for prod deployment evidence.\n\n---\n\n## Post-Deployment: Validation Checklist\n\n### OAuth Metadata Endpoints\n\n- [ ] **Metadata Availability**:\n\n  ```bash\n  curl https://test-mcp.integratewise.ai/.well-known/oauth-authorization-server\n  ```\n\n  Expected response:\n\n  ```json\n  {\n    \"issuer\": \"https://auth.integratewise.ai\",\n    \"authorization_endpoint\": \"https://auth.integratewise.ai/oauth/authorize\",\n    \"integratewise_availability\": \"enabled\"\n  }\n  ```\n\n- [ ] **JWKS Availability**:\n  ```bash\n  curl https://test-mcp.integratewise.ai/.well-known/jwks.json\n  ```\n  Expected: Array with public RSA keys, `kid: \"iw-oauth-key-1\"`\n\n### Connector Catalog\n\n- [ ] **Catalog Loads**:\n\n  ```bash\n  curl https://test-mcp.integratewise.ai/tools\n  ```\n\n  Expected: 401 with `WWW-Authenticate` header (requires bearer token for protected resource)\n\n- [ ] **With Bearer Token**:\n      Generate valid JWT with `tenant_id: \"iw-customer-zero\"` scope `mcp:tools`\n  ```bash\n  curl -H \"Authorization: Bearer <token>\" https://test-mcp.integratewise.ai/tools\n  ```\n  Expected: 200 with connector catalog (19 Continuity Bridge tools)\n\n### OAuth Authorize Flow\n\n- [ ] **Authorize Page Loads**:\n\n  ```bash\n  curl \"https://test-mcp.integratewise.ai/oauth/authorize?response_type=code&client_id=test&redirect_uri=https://client.example.com/callback&scope=mcp:tools&state=abc\"\n  ```\n\n  Expected: 200 HTML with consent form\n\n- [ ] **Consent Form Shows User & Workspace**:\n  ```bash\n  curl -X GET \"https://test-mcp.integratewise.ai/oauth/authorize\" \\\n    -H \"x-user-email: user@integratewise.ai\" \\\n    -H \"x-tenant-id: iw-customer-zero\"\n  ```\n  Expected: HTML form displays \"User: user@integratewise.ai\" and \"Workspace: iw-customer-zero\"\n\n### OAuth Token Exchange\n\n- [ ] **Authorization Code Exchange**:\n  1. Seed code in MCP_IDEMPOTENCY KV:\n     ```\n     Key: oauth_code:code_test_123\n     Value: {\"client_id\":\"test\",\"tenant_id\":\"iw-customer-zero\",\"scope\":\"mcp:tools\",\"expires_at\":1234567890}\n     ```\n  2. Exchange code:\n     ```bash\n     curl -X POST https://test-mcp.integratewise.ai/oauth/token \\\n       -H \"Content-Type: application/x-www-form-urlencoded\" \\\n       -d \"grant_type=authorization_code&code=code_test_123&redirect_uri=https://client.example.com/callback\"\n     ```\n     Expected: 200 with `access_token`, `token_type: \"Bearer\"`, `expires_in: 3600`\n\n- [ ] **JWT Token Claims**:\n      Decode the returned `access_token` (RS256 JWT)\n      Expected claims:\n  ```json\n  {\n    \"iss\": \"https://auth.integratewise.ai\",\n    \"aud\": \"https://mcp.integratewise.ai\",\n    \"tenant_id\": \"iw-customer-zero\",\n    \"role\": \"Member\",\n    \"scope\": \"mcp:tools\"\n  }\n  ```\n\n### Existing Customer Zero Flows\n\n- [ ] **Customer Zero Clients Still Work**:\n      Existing pre-provisioned `iw-customer-zero` clients should still authenticate\n\n  ```bash\n  curl -H \"x-tenant-id: iw-customer-zero\" https://test-mcp.integratewise.ai/tools\n  ```\n\n  Expected: 200 with tools (Gateway passes Customer Zero auth)\n\n- [ ] **Existing Connectors Still Load**:\n      Verify catalog in UI loads without error\n\n---\n\n## Troubleshooting\n\n| Issue                                | Check                              | Fix                                                                       |\n| ------------------------------------ | ---------------------------------- | ------------------------------------------------------------------------- |\n| 403 private_alpha                    | MCP_EXTERNAL_OAUTH_ENABLED not set | Verify wrangler.toml [env.test] has `MCP_EXTERNAL_OAUTH_ENABLED = \"true\"` |\n| OAuth metadata shows \"private_alpha\" | Flag still false                   | Redeploy test with correct flag                                           |\n| Authorize page blank/error           | Routing or CORS                    | Check Cloudflare Workers logs for mcp.integratewise.ai                    |\n| Token exchange 400                   | Missing KV seed or format          | Check MCP_IDEMPOTENCY KV has correct code structure                       |\n| Tenant mismatch error                | User tenant ≠ client tenant        | Seed test code with tenant matching x-tenant-id header                    |\n| Redirect URI validation fails        | Not in whitelist                   | Ensure redirect_uri in request matches oauth_clients D1 record            |\n\n---\n\n## Success Criteria\n\nAll checkmarks above complete → **P0 blocker is resolved for test**.\n\nNext: Proceed to production deployment (Task 7) with this workflow URL as test evidence.\n\n---\n\n## Rollback Plan (if validation fails)\n\n1. Revert wrangler.toml `MCP_EXTERNAL_OAUTH_ENABLED` to `\"false\"` in test\n2. Run `pnpm release:core --env test --service core --dry-run false`\n3. Verify metadata endpoint again shows `availability: \"private_alpha\"`\n4. Debug issue and re-run from Step 1\n\n---\n\n## Notes for Release Team\n\n- This deployment enables **public OAuth for test only**. Production flag stays disabled.\n- No database migrations required (oauth_clients table already exists).\n- No secrets rotation required.\n- External clients can now test integration via test MCP endpoint.\n- Keep test endpoint URL for external client proof-of-concept later (Task 8).\n"}