OAuth callback JWT token fix

mcp_auth_http_simple.py

@@ -160,21 +160,8 @@ async def oauth_callback(
                     except Exception as e:
                         logger.warning(f"Failed to generate JWT from cookie: {e}")
         
-        # Last resort - trust Clerk redirect
+        # Only generate authorization code if we have a real JWT token
-        if not user_authenticated:
+        if user_authenticated and real_jwt_token:
-            user_authenticated = True
-            logger.info("User authenticated via trusted redirect")
-            
-            # For trusted redirect, we can't generate real JWT without session
-            # This is expected behavior - real JWT only from JWT token flow
-            logger.warning("Trusted redirect authentication - no real JWT token available")
-        
-        if not user_authenticated:
-            return JSONResponse(
-                status_code=401,
-                content={"error": "access_denied", "error_description": "User not authenticated"}
-            )
-        
             # Generate authorization code
             auth_code = f"clerk_auth_{os.urandom(16).hex()}"
             
@@ -195,7 +182,7 @@ async def oauth_callback(
                 oauth_callback._code_storage = {}
             oauth_callback._code_storage[auth_code] = code_data
             
-        logger.info(f"Stored authorization code with JWT token: {bool(real_jwt_token)}")
+            logger.info(f"Stored authorization code with real JWT token")
             
             # Redirect back to client with authorization code
             redirect_params = {
@@ -207,6 +194,19 @@ async def oauth_callback(
             logger.info(f"Redirecting back to client: {final_redirect_url}")
             
             return RedirectResponse(url=final_redirect_url)
+        else:
+            # No JWT token yet - redirect back to sign-in page to wait for authentication
+            logger.info("No JWT token provided - redirecting back to sign-in to complete authentication")
+            
+            # Keep the same redirect URL so the flow continues
+            sign_in_params = {
+                "redirect_url": f"{request.url._url}"  # Current callback URL with all params
+            }
+            
+            sign_in_url = f"https://yargimcp.com/sign-in?{urlencode(sign_in_params)}"
+            logger.info(f"Redirecting back to sign-in: {sign_in_url}")
+            
+            return RedirectResponse(url=sign_in_url)
         
     except Exception as e:
         logger.exception(f"Callback processing failed: {e}")