From 89e11d265ff3ec4b4516be5cfc22932dcedc5f4c Mon Sep 17 00:00:00 2001 From: YueGuobin Date: Wed, 15 Jul 2026 14:28:16 +0800 Subject: [PATCH] fix(mcp): pass user.token_version when generating temp JWT from API key _resolve_token generated a temp JWT with a hardcoded ver=0 after validating the API key. Users who had logged out at least once (token_version >= 1) would hit "Token has been revoked" 401 on every MCP tool call, because the REST auth chain rejects ver=0 when the user's token_version no longer matches. Fix: pass the user's actual token_version to create_access_token so the temp JWT carries the correct ver claim. --- gns3server/api/routes/mcp/__init__.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gns3server/api/routes/mcp/__init__.py b/gns3server/api/routes/mcp/__init__.py index 07c3e060f..dd70f0636 100644 --- a/gns3server/api/routes/mcp/__init__.py +++ b/gns3server/api/routes/mcp/__init__.py @@ -233,7 +233,7 @@ async def _resolve_token(token: str) -> str | None: user = await user_repo.get_user(db_key.user_id) if user: _jwt_username_var.set(user.username) - fresh_token = auth_service.create_access_token(user.username) + fresh_token = auth_service.create_access_token(user.username, token_version=user.token_version) return fresh_token except Exception: pass