sxh be34cc46d0
fix(mcp): fall back when a token response carries an unusable expires_in (#6473)
* fix(mcp): fall back when a token response carries an unusable expires_in

OAuthTokenManager._fetch_token() converted the token endpoint's
expires_in to a timedelta while guarding only TypeError/ValueError. Two
server-controlled inputs raised OverflowError, which escaped the parser and
failed the whole token fetch, so the MCP server never received its
Authorization header:

* int(float('inf')) raises OverflowError. json.loads accepts Infinity, so a
  non-finite expires_in reached it uncaught (NaN happened to be caught).
* int(1e30) succeeds, but timedelta is capped at 999_999_999 days and rejects
  the magnitude with OverflowError. A large JSON integer literal behaves the
  same way.

Catch OverflowError alongside TypeError/ValueError and treat a lifetime beyond
timedelta's own range as unusable, so both fall back to the documented
one-hour default like every other malformed value.

Fixes #6472

* fix(mcp): handle both token expiry overflow stages

---------

Co-authored-by: sxh313 <sxh313@users.noreply.github.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-10-08 10:44:10 +08:00
..