{"record":{"id":"8732c50d6b653d71","repo":"siyuan-note/siyuan","slug":"oauth-authorization-server-metadata-not-found","errorCode":null,"errorMessage":"OAuth authorization server metadata not found","messagePattern":"OAuth authorization server metadata not found","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/mcp/client/oauth.go","lineNumber":217,"sourceCode":"\tif interactive {\n\t\tdefer func() {\n\t\t\tif retErr != nil && !errors.Is(retErr, context.Canceled) {\n\t\t\t\tsetMCPRuntimeStateForContext(ctx, h.server.ID, \"authorization_required\", 0, retErr.Error(), \"\")\n\t\t\t}\n\t\t}()\n\t}\n\n\tprm, err := discoverProtectedResource(ctx, challenges, req.URL.String(), h.client)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tasm, err := auth.GetAuthServerMetadata(ctx, prm.AuthorizationServers[0], h.client)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"discover OAuth authorization server: %w\", err)\n\t}\n\tif asm == nil {\n\t\treturn fmt.Errorf(\"OAuth authorization server metadata not found\")\n\t}\n\tcredential, hasCredential := getOAuthCredential(h.server.ID, h.server.URL)\n\tif hasCredential && credential.Issuer == asm.Issuer {\n\t\tcredential.TokenEndpoint = asm.TokenEndpoint\n\t\tcredential.RevocationEndpoint = asm.RevocationEndpoint\n\t}\n\tif hasCredential && credential.Issuer == asm.Issuer && credential.RefreshToken != \"\" &&\n\t\tchallengeError != \"insufficient_scope\" && !credential.Rejected && !oauthClientRegistrationExpired(credential) {\n\t\trefreshed, permanent, refreshErr := refreshOAuthCredential(ctx, h.client, credential)\n\t\tif refreshErr == nil {\n\t\t\tif saveErr := putOAuthCredential(refreshed); saveErr != nil {\n\t\t\t\tlogging.LogWarnf(\"mcp oauth: save refreshed credentials failed: %s\", saveErr)\n\t\t\t}\n\t\t\th.sourceMu.Lock()\n\t\t\th.source = &storedOAuthTokenSource{credential: refreshed, client: h.client}\n\t\t\th.sourceMu.Unlock()\n\t\t\tsetMCPRuntimeStateForContext(ctx, h.server.ID, \"oauth_retrying\", 0, \"\", \"\")\n\t\t\treturn nil","sourceCodeStart":199,"sourceCodeEnd":235,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/mcp/client/oauth.go#L199-L235","documentation":"Returned by mcpOAuthHandler.Authorize when auth.GetAuthServerMetadata completed without an error but returned a nil metadata object. The SDK treats nil-with-nil-err as a possible outcome (e.g. a successful HTTP response that decoded to nothing usable), and SiYuan treats it as a hard failure because subsequent steps dereference asm fields.","triggerScenarios":"auth.GetAuthServerMetadata(ctx, prm.AuthorizationServers[0], h.client) returns (nil, nil). The HTTP request succeeded but no metadata was materialized — empty 200 body, a non-JSON content type that the SDK silently skipped, or an SDK edge case.","commonSituations":"Auth server returned 200 with an empty body or HTML error page; content-type mismatch caused the SDK to skip decoding; auth server is a stub that responds 200 to everything; SDK version regression returning nil unexpectedly.","solutions":["curl the metadata URL and confirm it returns a non-empty JSON object containing at minimum 'issuer', 'authorization_endpoint', 'token_endpoint'.","Ensure the auth server's metadata endpoint sets Content-Type: application/json and a parseable body.","If the body is correct but nil is still returned, capture the go-sdk version and report the regression with the metadata payload.","As a workaround for a broken auth server, use static Authorization headers instead of OAuth."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Fetch the metadata document and assert it is non-empty JSON with an issuer.\nfunc probeMetadata(ctx context.Context, url string) error {\n    // GET url; json-decode; require Issuer != \"\"\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm the metadata endpoint returns Content-Type: application/json and a non-empty body.","If the auth server is a stub, switch to static Authorization headers."],"tags":["mcp","oauth","discovery","metadata","auth-server"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}