Tencent/WeKnora · error

failed to record authorization completion: %w

Error message

failed to record authorization completion: %w

What it means

Returned by CompleteAuthorization when, after a successful token exchange, recording the completion (persisting tokens/linked client state via the manager's completion step) fails. The user is authorized upstream but the system has not durably saved it, so the connection appears incomplete.

Source

Thrown at internal/mcp/oauth_manager.go:219

		return frontendRedirect, serviceID, fmt.Errorf("failed to load MCP service: %w", err)
	}
	if service == nil {
		return frontendRedirect, serviceID, fmt.Errorf("MCP service not found")
	}

	h, err := m.newHandler(ctx, service, st.TenantID, principal, st.RedirectURI)
	if err != nil {
		return frontendRedirect, serviceID, err
	}
	// Re-prime the expected state so the library's CSRF check passes after
	// reconstructing the handler in this separate request.
	h.SetExpectedState(state)

	if err := h.ProcessAuthorizationResponse(ctx, code, state, st.CodeVerifier); err != nil {
		return frontendRedirect, serviceID, fmt.Errorf("token exchange failed: %w", err)
	}
	if err := m.states.CompleteAttempt(ctx, state); err != nil {
		return frontendRedirect, serviceID, fmt.Errorf("failed to record authorization completion: %w", err)
	}
	// ProcessAuthorizationResponse persists the token via the TokenStore.
	logger.GetLogger(ctx).Infof(
		"MCP OAuth authorized: service=%s principal=%s", st.ServiceID, principal.StorageID(),
	)
	return frontendRedirect, serviceID, nil
}

// IsAuthorizationAttemptComplete reports whether this exact authorization
// attempt completed for the requested principal and service. A pre-existing
// token must never satisfy a newly opened OAuth popup.
func (m *OAuthManager) IsAuthorizationAttemptComplete(
	ctx context.Context,
	tenantID uint64,
	principal types.Principal,
	serviceID, attemptID string,
) (bool, error) {
	attempt, err := m.states.Attempt(ctx, attemptID)

View on GitHub (pinned to 988cbb0330)

Solutions

1. Check the wrapped error for the storage/backend cause
2. Verify token persistence repository health and connectivity
3. Retry the completion; the provider session may allow re-running without re-consent

When it happens

Trigger: Thrown at internal/mcp/oauth_manager.go:219 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/ebc9d89d1c5887ea. Report an issue: GitHub.