Files
onyx/web
Wenxi 29bc370294 fix(plugins): restore token entry after MCP URL changes (#16458)
## Description

Restore API-token entry after an administrator changes an MCP server
URL. Saving the new URL clears old header values before opening
Authentication. The retained empty header previously prevented the form
from creating its token field.

Restore the default `Authorization: Bearer {api_key}` template when all
API-token header values are blank. Administrators can then enter a
replacement personal or shared token. Existing nonempty custom headers
remain intact.

This follow-up targets main after the MCP setup stack merged. Its
release backport requires the MCP backport stack ending at #16455.

## How Has This Been Tested?

- 102 MCP authentication, configuration, and detail component tests
passed.
- Regression cases cover replacement personal and shared tokens, the new
server URL, and the submitted authentication template.
- Changed-file pre-commit checks passed, including TypeScript typing and
coverage, lint, formatting, and feature-map integrity.

## Additional Options

- [x] [Optional] Please cherry-pick this PR to the latest release
version.


<!-- This is an auto-generated description by cubic. -->
---
## Summary by cubic
Fixes the MCP API-token field disappearing after an administrator
changes a server URL. Saving the new URL clears old header values, and a
fully blank header previously prevented the form from creating its token
field. The form now restores the default `Authorization: Bearer
{api_key}` template whenever all API-token header values are blank, so
administrators can enter a replacement personal or shared token.
Existing nonempty custom headers remain intact.

<sup>Written for commit d1d1caae84.
Summary will update on new commits.</sup>

<a
href="https://cubic.dev/pr/onyx-dot-app/onyx/pull/16458?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="View guided diff"
src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"></picture></a>
<a
href="https://www.cubic.dev/action/auto-fix/pr/onyx-dot-app/onyx/16458?returnTo=https%3A%2F%2Fgithub.com%2Fonyx-dot-app%2Fonyx%2Fpull%2F16458&source=description"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img
alt="Turn on auto-fix"
src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"></picture></a>

<!-- End of auto-generated description by cubic. -->



<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Bug Fixes**
* Restored the API-token authentication template when authentication
headers are empty or cleared after changing a server URL.
* Kept the replacement token field available for both user and
administrator authentication flows.
* Preserved the replacement server URL and generated the appropriate
credential payload during submission.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-10-21 23:54:33 +00:00
..
…
…

This is a Next.js project bootstrapped with create-next-app.

Getting Started

Install bun: https://bun.sh/docs/installation Install all dependencies: bun install.

Then, run the development server:

bun run dev

Open http://localhost:3000 with your browser to see the result.

Note: if you are having problems accessing the ^, try setting the WEB_DOMAIN env variable to http://127.0.0.1:3000 and accessing it there.

Tip

Packages are installed automatically when switching branches after package.json changes with pre-commit configured.

Connecting to a Cloud Backend

To test your local frontend development server against a cloud backend (e.g., staging or production), create a .env.local file in the web/ directory with the following configuration:

# Point local dev server to cloud backend
INTERNAL_URL=https://st-dev.onyx.app/api

# Debug auth cookie for authenticating against remote backend
# This cookie is automatically injected into API requests when in development mode
# To get this value:
#   1. Go to https://st-dev.onyx.app (or your target backend URL) and log in
#   2. Open DevTools (F12) → Application → Cookies → [your backend domain]
#   3. Find the "fastapiusersauth" cookie and copy its value
#   4. Paste the value below (without quotes)
# Note: This cookie may expire, so you may need to refresh it periodically
DEBUG_AUTH_COOKIE=your_cookie_value_here

By default, this does NOT override existing cookies, so if you've logged in previously, you may need to delete the cookies for the localhost domain.

Important notes:

  • The .env.local file should be created in the web/ directory (same level as package.json)
  • After creating or modifying .env.local, restart your development server for changes to take effect
  • The DEBUG_AUTH_COOKIE is only used in development mode (NODE_ENV=development)
  • If INTERNAL_URL is not set, the frontend will connect to the local backend at http://127.0.0.1:8080
  • Keep your .env.local file secure and never commit it to version control (it should already be in .gitignore)

Testing

This testing process will reset your application into a clean state. Don't run these tests if you don't want to do this!

Bring up the entire application.

  1. Install playwright dependencies (run bun install first so bunx resolves to the repo-pinned Playwright in node_modules instead of fetching the latest version)
bun install
bunx playwright install
  1. Run playwright (the playwright script expands to playwright test)
bun run playwright

To run a single test:

bun run playwright landing-page.spec.ts

If running locally, interactive options can help you see exactly what is happening in the test.

bun run playwright --ui
bun run playwright --headed
  1. Inspect results

By default, playwright.config.ts is configured to output the results to:

web/output/playwright/
  1. Visual regression screenshots

Screenshots are captured automatically during test runs and saved to web/output/screenshots/. To compare screenshots across CI runs, use:

ods screenshot-diff compare --project admin

For more information, see tools/ods/README.md.