feat: add edit functionality for OAuth metadata fields by simplesagar · Pull Request #1336 · speakeasy-api/gram

simplesagar · 2026-01-22T21:40:11Z

Summary

Add edit functionality for OAuth metadata fields so users don't have to delete and re-add configuration
Add updateExternalOAuthServer API endpoint to update external OAuth server metadata
Add updateOAuthProxyServer API endpoint to update OAuth proxy configuration
Add edit button and inline editing in the OAuth Details modal
Add server-side validation to reject empty authorization_endpoint and token_endpoint for custom OAuth proxy providers

Test plan

Test editing External OAuth Server metadata JSON
Test editing OAuth Proxy Server fields (authorization endpoint, token endpoint, scopes, auth method, environment)
Verify Gram OAuth type cannot be edited (intentional restriction)
Verify validation for required endpoints in external OAuth metadata
Verify server rejects empty authorization_endpoint or token_endpoint for custom providers

Closes AGE-1215

🤖 Generated with Claude Code

Add ability to update OAuth configuration without deleting and re-adding: - Add updateExternalOAuthServer and updateOAuthProxyServer API endpoints - Add edit button and inline editing UI in OAuthDetailsModal - Support editing authorization endpoint, token endpoint, scopes, auth method, and environment Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

linear · 2026-01-22T21:40:16Z

AGE-1215 Feat: Update metadata field by deleting and readding information?

changeset-bot · 2026-01-22T21:40:17Z

🦋 Changeset detected

Latest commit: 31b8a18

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
dashboard	Patch
@gram/client	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-01-22T21:40:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
gram	Ready	Preview, Comment	Jan 23, 2026 0:47am
gram-docs-redirect	Ready	Preview, Comment	Jan 23, 2026 0:47am

devin-ai-integration

Devin Review found 2 potential issues.

client/dashboard/src/pages/mcp/MCPDetails.tsx

devin-ai-integration · 2026-01-23T00:23:32Z

client/sdk/src/models/components/updateexternaloauthserverrequestbody.ts

+export type UpdateExternalOAuthServerRequestBody = {
+  /**
+   * The updated metadata for the external OAuth server
+   */
+  metadata?: any | undefined;
+};
+
+/** @internal */
+export type UpdateExternalOAuthServerRequestBody$Outbound = {
+  metadata?: any | undefined;
+};
+
+/** @internal */
+export const UpdateExternalOAuthServerRequestBody$outboundSchema: z.ZodType<
+  UpdateExternalOAuthServerRequestBody$Outbound,
+  z.ZodTypeDef,
+  UpdateExternalOAuthServerRequestBody
+> = z.object({
+  metadata: z.any().optional(),
+});


🟡 UpdateExternalOAuthServerRequestBody marks metadata optional despite API requiring it

The OpenAPI schema for UpdateExternalOAuthServerRequestBody marks metadata as required, but the generated TypeScript model makes it optional:

export type UpdateExternalOAuthServerRequestBody = { metadata?: any | undefined; };

client/sdk/src/models/components/updateexternaloauthserverrequestbody.ts:8-13

This violates the API contract: SDK consumers can construct requests without metadata, which will then fail server-side validation at runtime.

Actual: SDK allows omitting metadata.
Expected: metadata should be required in the SDK type and validation schema.

Recommendation: Regenerate/fix the OpenAPI->SDK generation so metadata is required (remove .optional() and make the TS field non-optional).

Was this helpful? React with 👍 or 👎 to provide feedback.

…m providers Addresses Devin review feedback: OAuth proxy update could persist empty endpoints because the server didn't validate that authorization_endpoint and token_endpoint are non-empty strings for custom provider types. This adds validation that matches the AddOAuthProxyServer behavior, rejecting requests that provide empty strings for these required fields. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

simplesagar · 2026-01-23T00:44:55Z

Addressed Devin Review Feedback

Issue 1 (🔴 Empty endpoints): Fixed in commit 31b8a18. Added server-side validation in UpdateOAuthProxyServer that rejects empty strings for authorization_endpoint and token_endpoint when the provider type is "custom". This matches the validation behavior in AddOAuthProxyServer.

Issue 2 (🟡 SDK metadata optional): The Goa design correctly marks metadata as required, and the server-generated validation code properly rejects requests without metadata (see ValidateUpdateExternalOAuthServerRequestBody in the generated code). The SDK showing it as optional is a Speakeasy SDK generation quirk when dealing with Any types - runtime behavior is correct since the server validates the field.

devin-ai-integration

Devin Review found 2 new potential issues.

View issues and 6 additional flags in Devin Review.

devin-ai-integration · 2026-01-23T00:50:13Z

client/dashboard/src/pages/mcp/MCPDetails.tsx

+    setJsonError(null);
+    updateExternalOAuthMutation.mutate({
+      request: {
+        slug: toolset.slug,
+        metadata: parsedMetadata,
+      },
+    });


🔴 Dashboard calls updateExternalOAuthServer with wrong request shape (missing updateExternalOAuthServerRequestBody wrapper)

The generated SDK operation updateExternalOAuthServer expects the JSON body under updateExternalOAuthServerRequestBody (see generated operation docs/types), but the dashboard mutation sends metadata at the top-level of request.

Code:

updateExternalOAuthMutation.mutate({ request: { slug: toolset.slug, metadata: parsedMetadata, }, });

client/dashboard/src/pages/mcp/MCPDetails.tsx:883-889

Actual behavior: the SDK will serialize a request body where UpdateExternalOAuthServerRequestBody is undefined (or omit it), causing client-side validation failures or a server 400/422 because the required metadata body field is missing.

Expected behavior: pass updateExternalOAuthServerRequestBody: { metadata: parsedMetadata } (and keep slug in the query).

Recommendation: Change the mutate call to:

updateExternalOAuthMutation.mutate({ request: { slug: toolset.slug, updateExternalOAuthServerRequestBody: { metadata: parsedMetadata }, }, });

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-01-23T00:50:13Z

client/dashboard/src/pages/mcp/MCPDetails.tsx

+
+    updateOAuthProxyMutation.mutate({
+      request: {
+        slug: toolset.slug,
+        authorizationEndpoint: proxyAuthorizationEndpoint,
+        tokenEndpoint: proxyTokenEndpoint,
+        scopesSupported: scopesArray,
+        tokenEndpointAuthMethodsSupported: [proxyTokenAuthMethod],
+        environmentSlug: proxyEnvironmentSlug,
+      },


🔴 Dashboard calls updateOAuthProxyServer with wrong request shape (missing updateOAuthProxyServerRequestBody wrapper)

The generated SDK operation updateOAuthProxyServer expects the JSON body under updateOAuthProxyServerRequestBody, but the dashboard mutation sends OAuth proxy fields at the top-level of request.

Code:

updateOAuthProxyMutation.mutate({ request: { slug: toolset.slug, authorizationEndpoint: proxyAuthorizationEndpoint, tokenEndpoint: proxyTokenEndpoint, scopesSupported: scopesArray, tokenEndpointAuthMethodsSupported: [proxyTokenAuthMethod], environmentSlug: proxyEnvironmentSlug, }, });

client/dashboard/src/pages/mcp/MCPDetails.tsx:897-906

Actual behavior: the SDK will serialize an empty/incorrect request body because UpdateOAuthProxyServerRequestBody is not provided, leading to client-side validation errors or server rejecting the request / not applying updates.

Expected behavior: wrap those fields in updateOAuthProxyServerRequestBody: { ... }.

Recommendation: Change the mutate call to:

updateOAuthProxyMutation.mutate({ request: { slug: toolset.slug, updateOAuthProxyServerRequestBody: { authorizationEndpoint: proxyAuthorizationEndpoint, tokenEndpoint: proxyTokenEndpoint, scopesSupported: scopesArray, tokenEndpointAuthMethodsSupported: [proxyTokenAuthMethod], environmentSlug: proxyEnvironmentSlug, }, }, });

Was this helpful? React with 👍 or 👎 to provide feedback.

simplesagar added enhancement New feature or request go Pull requests that update go code labels Jan 22, 2026

Create little-apricots-move.md

68bea5e

vercel bot deployed to Preview – gram-docs-redirect January 22, 2026 21:41 View deployment

vercel bot deployed to Preview – gram January 22, 2026 21:43 View deployment

simplesagar marked this pull request as ready for review January 23, 2026 00:18

simplesagar requested a review from a team as a code owner January 23, 2026 00:18

devin-ai-integration bot reviewed Jan 23, 2026

View reviewed changes

simplesagar requested a review from qstearns January 23, 2026 00:32

vercel bot deployed to Preview – gram-docs-redirect January 23, 2026 00:44 View deployment

vercel bot deployed to Preview – gram January 23, 2026 00:47 View deployment

devin-ai-integration bot reviewed Jan 23, 2026

View reviewed changes

simplesagar marked this pull request as draft February 6, 2026 15:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add edit functionality for OAuth metadata fields#1336

feat: add edit functionality for OAuth metadata fields#1336
simplesagar wants to merge 3 commits intomainfrom
oauth_metadata_update-

simplesagar commented Jan 22, 2026 •

edited

Loading

Uh oh!

linear bot commented Jan 22, 2026

Uh oh!

changeset-bot bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

vercel bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

Uh oh!

devin-ai-integration bot Jan 23, 2026

Uh oh!

simplesagar commented Jan 23, 2026

Uh oh!

devin-ai-integration bot left a comment

Uh oh!

devin-ai-integration bot Jan 23, 2026

Uh oh!

devin-ai-integration bot Jan 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

simplesagar commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

linear bot commented Jan 22, 2026

Uh oh!

changeset-bot bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

devin-ai-integration bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

simplesagar commented Jan 23, 2026

Addressed Devin Review Feedback

Uh oh!

devin-ai-integration bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration bot Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

simplesagar commented Jan 22, 2026 •

edited

Loading

changeset-bot bot commented Jan 22, 2026 •

edited

Loading

vercel bot commented Jan 22, 2026 •

edited

Loading