Fix multi-user credential switching in same session #253
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Adds dual-mode attachment support to send_gmail_message function: - Local file path attachments using multipart MIME - Public URL attachments embedded as HTML links Features: - Auto-detects MIME types for file attachments - Base64 encoding for binary files - Graceful error handling (logs warnings, continues on failure) - Backward compatible (all new parameters optional) - Comprehensive documentation with usage examples Implementation: - New helper: _prepare_gmail_message_with_file_attachments() - New helper: _prepare_gmail_message_with_url_attachments() - Enhanced: _prepare_gmail_message() routing logic - Updated: send_gmail_message() signature and docstring - Added imports: os, mimetypes, MIMEMultipart, MIMEBase, encoders Tests: All 3 automated tests passed - Local file attachments (multipart MIME) - Public URL attachments (HTML links) - Error handling (missing files) ~250 lines added with comprehensive docstrings and examples. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
Problem: The MCP server was binding each FastMCP session to a single user email via the session cache. When credentials were loaded by session_id, it would return the cached credentials regardless of the requested user_google_email parameter, causing all requests in the same session to use the first authenticated user's credentials. Solution: Modified get_credentials() in auth/google_auth.py to validate that cached credentials match the requested user. If the cached user differs from the requested user_google_email, the session cache is bypassed and credentials are loaded from the credential store instead. Changes: - Added validation after loading credentials from session cache - Uses OAuth21SessionStore.get_user_by_mcp_session() to get cached user - Compares cached user with requested user_google_email - Sets credentials to None (forces reload) if mismatch detected - Logs warning when bypassing cache for user mismatch - Preserves security model while enabling multi-user support Testing: This fix enables Claude Code to switch between multiple Google accounts (e.g., [email protected] and [email protected]) within the same session by respecting the user_google_email parameter in tool calls. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
Extended the multi-user credential fix to also validate the OAuth21SessionStore lookup path. The previous fix only handled load_credentials_from_session() but missed the earlier get_credentials_by_mcp_session() check. Problem: get_credentials() has two credential lookup paths: 1. OAuth21SessionStore.get_credentials_by_mcp_session() (lines 542-590) 2. load_credentials_from_session() (lines 623+) The first fix only validated path taylorwilsdon#2, so path taylorwilsdon#1 was still returning cached credentials for the wrong user, causing list operations to use incorrect credentials even though create operations worked. Solution: Added the same user validation logic to the OAuth21SessionStore lookup: - After getting credentials by mcp_session, validate cached user matches - If mismatch detected, set credentials = None to force reload - Properly indented refresh logic inside the validation block This ensures BOTH credential lookup paths respect user_google_email. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
|
OAuth2.1 mode is meant to behave this way specifically, where the client handles the credential flow and manages storage / caching / refresh (and potentially session switching) - binding a single session to a valid authorization token so that you can operate in a multi-user environment without risking inadvertent access. If you want to use multiple accounts in a trusted environment, you just don't set that env var and you can have multiple accounts authenticated and switch between them as desired. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR fixes a critical bug where the MCP server was unable to switch between multiple Google account credentials within the same session. The server would bind to the first authenticated user and ignore the
user_google_emailparameter on subsequent requests.Problem
The
get_credentials()function inauth/google_auth.pyhas two credential lookup paths:Both paths were returning cached credentials based solely on
session_id, without validating that the cached credentials matched the requesteduser_google_emailparameter. This caused all tool calls within a session to use the first authenticated user's credentials, even when a differentuser_google_emailwas specified.Solution
Added user validation to both credential lookup paths:
Changes to
auth/google_auth.pyPath 1: OAuth21SessionStore lookup (lines 546-590)
credentials = Noneto force reload from credential storePath 2: Session cache lookup (lines 623-648)
credentials = Noneto force reload from credential storeBoth validations use
OAuth21SessionStore.get_user_by_mcp_session()to determine the cached user email and compare it with the requesteduser_google_emailparameter.Testing
Verified the fix works correctly:
✅ Create operations - Can create tasks on different accounts:
✅ List operations - Returns correct data for each account:
✅ Account switching - Can alternate between accounts seamlessly without re-authentication
Impact
This fix enables:
user_google_emailparameterFiles Changed
auth/google_auth.py- Modifiedget_credentials()function to validate cached credentials match requested userCommits
1975ffd- Initial fix for session cache credential validation6b006c9- Complete fix for OAuth21SessionStore credential validation🤖 Generated with Claude Code