{"record":{"id":"2a16186cbe5f64e7","repo":"siyuan-note/siyuan","slug":"discover-oauth-authorization-server-w","errorCode":null,"errorMessage":"discover OAuth authorization server: %w","messagePattern":"discover OAuth authorization server: %w","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":214,"sourceCode":"\t\treturn fmt.Errorf(\"server returned %s\", resp.Status)\n\t}\n\tinteractive := h.interactive.Load()\n\tif interactive {\n\t\tdefer func() {\n\t\t\tif retErr != nil && !errors.Is(retErr, context.Canceled) {\n\t\t\t\tsetMCPRuntimeStateForContext(ctx, h.server.ID, \"authorization_required\", 0, retErr.Error(), \"\")\n\t\t\t}\n\t\t}()\n\t}\n\n\tprm, err := discoverProtectedResource(ctx, challenges, req.URL.String(), h.client)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tasm, err := auth.GetAuthServerMetadata(ctx, prm.AuthorizationServers[0], h.client)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"discover OAuth authorization server: %w\", err)\n\t}\n\tif asm == nil {\n\t\treturn fmt.Errorf(\"OAuth authorization server metadata not found\")\n\t}\n\tcredential, hasCredential := getOAuthCredential(h.server.ID, h.server.URL)\n\tif hasCredential && credential.Issuer == asm.Issuer {\n\t\tcredential.TokenEndpoint = asm.TokenEndpoint\n\t\tcredential.RevocationEndpoint = asm.RevocationEndpoint\n\t}\n\tif hasCredential && credential.Issuer == asm.Issuer && credential.RefreshToken != \"\" &&\n\t\tchallengeError != \"insufficient_scope\" && !credential.Rejected && !oauthClientRegistrationExpired(credential) {\n\t\trefreshed, permanent, refreshErr := refreshOAuthCredential(ctx, h.client, credential)\n\t\tif refreshErr == nil {\n\t\t\tif saveErr := putOAuthCredential(refreshed); saveErr != nil {\n\t\t\t\tlogging.LogWarnf(\"mcp oauth: save refreshed credentials failed: %s\", saveErr)\n\t\t\t}\n\t\t\th.sourceMu.Lock()\n\t\t\th.source = &storedOAuthTokenSource{credential: refreshed, client: h.client}","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L196-L232","documentation":"Returned by mcpOAuthHandler.Authorize when auth.GetAuthServerMetadata fails for the first authorization server advertised by the protected-resource metadata (prm.AuthorizationServers[0]). This is the step that fetches RFC 8414 metadata (issuer, token endpoint, grant types, etc.). The wrapped error (network, HTTP, JSON-decode) is preserved.","triggerScenarios":"discoverProtectedResource succeeded and produced at least one AuthorizationServers URL, but auth.GetAuthServerMetadata could not GET/parse that URL's metadata document within ctx — DNS failure, connection refused, TLS error, 404, or invalid JSON.","commonSituations":"Authorization server is on a private network unreachable from the kernel host; metadata endpoint path is wrong (returns HTML/404); TLS cert is untrusted or self-signed; corporate proxy blocks the metadata URL; auth server is temporarily down.","solutions":["From the kernel host, fetch the metadata URL directly (curl -i) and confirm it returns valid RFC 8414 JSON with an 'issuer' field.","Ensure the kernel host can resolve and reach the auth server; adjust HTTP_PROXY/HTTPS_PROXY and trust the TLS CA.","Verify prm.AuthorizationServers[0] is the correct issuer URL; a misconfigured resource server may advertise the wrong auth server.","If the auth server is down, retry later; this is a transient dependency failure."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Pre-flight reachability check to the auth server metadata URL.\nfunc probeAuthServer(ctx context.Context, issuer string) error {\n    // HTTP GET issuer + /.well-known/oauth-authorization-server (or as advertised)\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// Retry on transient network errors; surface TLS/DNS issues separately.\nvar netErr net.Error\nif errors.As(err, &netErr) && netErr.Timeout() {\n    // backoff and retry discovery\n}","preventionTips":["Ensure the kernel host can resolve and reach the auth server's metadata endpoint.","Trust the auth server's TLS CA; configure proxies accordingly.","Validate prm.AuthorizationServers[0] is the correct issuer."],"tags":["mcp","oauth","discovery","network","auth-server"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}