{"slug":"operations/OAUTH_RELEASE_QUICK_START","title":"OAuth Release Quick Start","section":"operations","sectionLabel":"Operations","status":"unclassified","type":"document","path":"operations/OAUTH_RELEASE_QUICK_START.mdx","bytes":6005,"description":null,"updated":null,"source":"integratewise/Integratewise-docs-wiki","content":"\n**TL;DR**: P0 blocker is implemented. OAuth is now ready for staged deployment: test → production → marketplace.\n\n---\n\n## What's Implemented\n\n✓ User membership binding (Descope auth validation)  \n✓ Tenant workspace resolution (OAuth flow)  \n✓ Redirect URI validation (parameter sanitization)  \n✓ Test environment enabled (flag = true)  \n✓ Production flag ready (flag = false, manual enable after test)  \n✓ 8 smoke tests (public OAuth flow coverage)  \n✓ Deployment checklists (test + prod runbooks)\n\n---\n\n## One-Line Summary\n\n**Then**: `MCP_EXTERNAL_OAUTH_ENABLED = \"false\"` + hard-coded Customer Zero = blocked for external use\n\n**Now**: Real user binding + tenant validation + enabled flag = ready for external clients\n\n---\n\n## Files to Review\n\n| File                                                  | Lines  | Purpose                          |\n| ----------------------------------------------------- | ------ | -------------------------------- |\n| `services/mcp-connector/src/lib/oauth-auth-server.ts` | +200   | User binding + tenant validation |\n| `services/mcp-connector/src/lib/oauth-clients.ts`     | +26    | Membership check function        |\n| `services/mcp-connector/src/index.ts`                 | +6     | Header injection from Gateway    |\n| `services/mcp-connector/wrangler.toml`                | 1 line | Test flag: false → true          |\n| `services/mcp-connector/src/oauth.test.ts`            | +104   | 8 new smoke tests                |\n\n**Docs** (for deployment team):\n\n- `docs/internal/operations/P0_OAUTH_RELEASE_BLOCKER_COMPLETE.md` (overview)\n- `docs/internal/operations/P0_OAUTH_RELEASE_BLOCKER_IMPLEMENTATION.md` (technical spec)\n- `docs/internal/operations/P0_OAUTH_TEST_DEPLOYMENT_CHECKLIST.md` (test validation)\n- `docs/internal/operations/P0_OAUTH_PRODUCTION_DEPLOYMENT.md` (prod runbook)\n\n---\n\n## Quick Deployment\n\n### Test Environment\n\n```bash\n# 1. Merge release/public-connector-go-live\ngit merge release/public-connector-go-live\n\n# 2. Dry-run to test\npnpm release:core --env test --service core --dry-run true\n\n# 3. Deploy to test\npnpm release:core --env test --service core --dry-run false\n\n# 4. Validate (20 checkpoints in checklist)\n# Expected: OAuth metadata shows \"availability: enabled\"\n```\n\n### Production Environment\n\n```bash\n# Prerequisites: Test deployment passed all checks\n# Have test workflow URL ready: https://github.com/integratewise/integratewise-live/actions/runs/XXXXX\n\n# 1. Enable flag (wrangler.toml [env.prod])\n# MCP_EXTERNAL_OAUTH_ENABLED = \"true\"\n\n# 2. Dry-run to prod\npnpm release:core --env prod --service core --dry-run true\n\n# 3. Deploy to prod\npnpm release:core --env prod --service core --dry-run false \\\n  --confirm_production true \\\n  --test_release_evidence \"https://github.com/integratewise/integratewise-live/actions/runs/XXXXX\"\n\n# 4. Smoke tests pass → external clients can connect\n```\n\n---\n\n## Test Workflow Validation (First 60 seconds)\n\n```bash\n# 1. OAuth enabled?\ncurl https://mcp.integratewise.ai/.well-known/oauth-authorization-server | jq '.integratewise_availability'\n# Expected: \"enabled\"\n\n# 2. Catalog loads?\ncurl https://mcp.integratewise.ai/.well-known/oauth-protected-resource | jq '.resource'\n# Expected: \"https://mcp.integratewise.ai\"\n\n# 3. Authorize page?\ncurl \"https://mcp.integratewise.ai/oauth/authorize?response_type=code&client_id=test&redirect_uri=https://example.com/callback\"\n# Expected: 200 (HTML)\n\n# 4. Token endpoint?\ncurl -X POST https://mcp.integratewise.ai/oauth/token -d \"grant_type=...\"\n# Expected: 200 or 400 (never 403 unless disabled)\n```\n\n---\n\n## If Something Goes Wrong\n\n### Rollback (< 5 minutes)\n\n```bash\n# 1. Disable flag in wrangler.toml\n# MCP_EXTERNAL_OAUTH_ENABLED = \"false\"\n\n# 2. Redeploy\npnpm release:core --env prod --service core --dry-run false --confirm_production true --test_release_evidence \"...\"\n\n# 3. Verify\ncurl https://mcp.integratewise.ai/.well-known/oauth-authorization-server | jq '.integratewise_availability'\n# Expected: \"private_alpha\"\n```\n\n### Debug\n\nCheck logs:\n\n```bash\nwrangler tail integratewise-mcp-connector --env prod\nwrangler tail integratewise-gateway --env prod\n```\n\nCommon issues:\n\n- **403 private_alpha**: Flag not set or didn't deploy\n- **Missing D1**: oauth_clients table not found (should exist)\n- **Redirect validation fails**: Client D1 record missing or redirect not in whitelist\n- **Tenant mismatch**: User's x-tenant-id ≠ client's registered tenant_id\n\n---\n\n## After Go-Live (P4 Marketplace)\n\nOnce production is stable for 24h:\n\n```bash\n# 1. Publish IntegrateWise MCP connector package\n# 2. Publish AI surface connector package\n# 3. Enable marketplace catalog\n# 4. Mark connectors as Available/Beta\n```\n\nExternal users can then:\n\n1. Add IntegrateWise connector → OAuth flow\n2. Sign in with Descope\n3. Authorize workspace access\n4. Read 65+ connectors without provider credentials\n5. Execute tasks via MCP interface\n\n---\n\n## Key Metrics\n\n**Deployment Impact**:\n\n- 0 breaking changes for existing customers\n- 0 database migrations\n- 0 secrets rotation\n- 1 feature flag enabled per environment\n\n**Blast Radius**:\n\n- Test: 65+ connectors + new OAuth interface\n- Production: Same, gated by feature flag\n\n**Rollback Time**: < 5 minutes\n\n**Success Criteria**:\n\n- External clients connect via OAuth\n- Tenant membership validated\n- No credential leaks\n- Existing flows unaffected\n\n---\n\n## Documentation Links\n\n- **Full Spec**: `docs/internal/operations/P0_OAUTH_RELEASE_BLOCKER_IMPLEMENTATION.md`\n- **Test Checklist**: `docs/internal/operations/P0_OAUTH_TEST_DEPLOYMENT_CHECKLIST.md`\n- **Prod Runbook**: `docs/internal/operations/P0_OAUTH_PRODUCTION_DEPLOYMENT.md`\n- **Completion Summary**: `docs/internal/operations/P0_OAUTH_RELEASE_BLOCKER_COMPLETE.md`\n\n---\n\n## Status\n\n✓ Implementation: COMPLETE  \n✓ Tests: PASSING  \n✓ Documentation: READY  \n⏳ Deployment: READY (awaiting release team)\n\n**Next**: Merge to `release/public-connector-go-live`, deploy to test, validate, promote to production.\n"}