Unclassified

P0: OAuth Test Deployment Checklist

Objective: Deploy the public OAuth release-blocker fixes to test environment and validate end-to-end flow.

Timeline: Execute after code review of release/public-connector-go-live branch

Pre-Deployment: Local Validation

Run smoke tests locally:
```
cd services/mcp-connector
pnpm test oauth.test.ts
```
Expect: All 8 new public OAuth tests pass
Check for TypeScript errors:
```
pnpm exec tsc --noEmit
```
Expect: No errors in oauth-auth-server.ts or oauth-clients.ts
Verify wrangler.toml changes:
```
grep "MCP_EXTERNAL_OAUTH_ENABLED" services/mcp-connector/wrangler.toml
```
Expect: "true" in [env.test], "false" in [env.prod]

Deployment Step 1: Dry-Run Release

Command:

pnpm release:core \
  --env test \
  --service core \
  --dry-run true

Expected Output:

✓ Release pipeline validated
✓ Connector service compiled
✓ MCP-Connector service compiled
✓ Connector-sync service compiled
✓ Knowledge service compiled
✓ Continuity service compiled
✓ Intelligence service compiled
✓ Workflow service compiled
✓ L2 service compiled
✓ Gateway service compiled

If fails: Check service build logs and fix compilation errors before proceeding.

Deployment Step 2: Live Release to Test

Command:

pnpm release:core \
  --env test \
  --service core \
  --dry-run false

Expected Output:

Cloudflare Workers deploy messages for each service
All services report "✓ Published"

Record: Screenshot or copy the workflow URL from GitHub Actions for prod deployment evidence.

Post-Deployment: Validation Checklist

OAuth Metadata Endpoints

Metadata Availability:

curl https://test-mcp.integratewise.ai/.well-known/oauth-authorization-server

Expected response:

{
  "issuer": "https://auth.integratewise.ai",
  "authorization_endpoint": "https://auth.integratewise.ai/oauth/authorize",
  "integratewise_availability": "enabled"
}

JWKS Availability:
```
curl https://test-mcp.integratewise.ai/.well-known/jwks.json
```
Expected: Array with public RSA keys, kid: "iw-oauth-key-1"

Connector Catalog

Catalog Loads:
```
curl https://test-mcp.integratewise.ai/tools
```
Expected: 401 with WWW-Authenticate header (requires bearer token for protected resource)
With Bearer Token:
Generate valid JWT with tenant_id: "iw-customer-zero" scope mcp:tools
```
curl -H "Authorization: Bearer <token>" https://test-mcp.integratewise.ai/tools
```
Expected: 200 with connector catalog (19 Continuity Bridge tools)

OAuth Authorize Flow

Authorize Page Loads:

curl "https://test-mcp.integratewise.ai/oauth/authorize?response_type=code&client_id=test&redirect_uri=https://client.example.com/callback&scope=mcp:tools&state=abc"

Expected: 200 HTML with consent form

Consent Form Shows User & Workspace:

curl -X GET "https://test-mcp.integratewise.ai/oauth/authorize" \
  -H "x-user-email: user@integratewise.ai" \
  -H "x-tenant-id: iw-customer-zero"

Expected: HTML form displays "User: user@integratewise.ai" and "Workspace: iw-customer-zero"

OAuth Token Exchange

Authorization Code Exchange:

Seed code in MCP_IDEMPOTENCY KV:

Key: oauth_code:code_test_123
Value: {"client_id":"test","tenant_id":"iw-customer-zero","scope":"mcp:tools","expires_at":1234567890}

Exchange code:

curl -X POST https://test-mcp.integratewise.ai/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=code_test_123&redirect_uri=https://client.example.com/callback"

Expected: 200 with access_token, token_type: "Bearer", expires_in: 3600

JWT Token Claims:
Decode the returned access_token (RS256 JWT)
Expected claims:

{
  "iss": "https://auth.integratewise.ai",
  "aud": "https://mcp.integratewise.ai",
  "tenant_id": "iw-customer-zero",
  "role": "Member",
  "scope": "mcp:tools"
}

Existing Customer Zero Flows

Customer Zero Clients Still Work:
Existing pre-provisioned iw-customer-zero clients should still authenticate
```
curl -H "x-tenant-id: iw-customer-zero" https://test-mcp.integratewise.ai/tools
```
Expected: 200 with tools (Gateway passes Customer Zero auth)
Existing Connectors Still Load:
Verify catalog in UI loads without error

Troubleshooting

Issue	Check	Fix
403 private_alpha	MCP_EXTERNAL_OAUTH_ENABLED not set	Verify wrangler.toml [env.test] has `MCP_EXTERNAL_OAUTH_ENABLED = "true"`
OAuth metadata shows "private_alpha"	Flag still false	Redeploy test with correct flag
Authorize page blank/error	Routing or CORS	Check Cloudflare Workers logs for mcp.integratewise.ai
Token exchange 400	Missing KV seed or format	Check MCP_IDEMPOTENCY KV has correct code structure
Tenant mismatch error	User tenant ≠ client tenant	Seed test code with tenant matching x-tenant-id header
Redirect URI validation fails	Not in whitelist	Ensure redirect_uri in request matches oauth_clients D1 record

Success Criteria

All checkmarks above complete → P0 blocker is resolved for test.

Next: Proceed to production deployment (Task 7) with this workflow URL as test evidence.

Rollback Plan (if validation fails)

Revert wrangler.toml MCP_EXTERNAL_OAUTH_ENABLED to "false" in test
Run pnpm release:core --env test --service core --dry-run false
Verify metadata endpoint again shows availability: "private_alpha"
Debug issue and re-run from Step 1

Notes for Release Team

This deployment enables public OAuth for test only. Production flag stays disabled.
No database migrations required (oauth_clients table already exists).
No secrets rotation required.
External clients can now test integration via test MCP endpoint.
Keep test endpoint URL for external client proof-of-concept later (Task 8).