From 49a2d7f7324e5aeb851f8081f0b91e59d7fc170c Mon Sep 17 00:00:00 2001
From: Ben Senescu <44480372+bensenescu@users.noreply.github.com>
Date: Wed, 13 May 2026 15:01:32 -0400
Subject: [PATCH] Set MCP access token TTL to 24 hours (#191)

---
 src/server/mcp/oauth-provider.ts | 8 ++++++--
 wrangler.jsonc                   | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/server/mcp/oauth-provider.ts b/src/server/mcp/oauth-provider.ts
index df42ba3..e32897d 100644
--- a/src/server/mcp/oauth-provider.ts
+++ b/src/server/mcp/oauth-provider.ts
@@ -37,7 +37,10 @@ const OAUTH_AUTHORIZATION_PARAM_NAMES = [
   "code_challenge_method",
   "resource",
 ] as const;
-const REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
+// Keep access tokens reasonably short-lived while allowing refresh tokens to
+// preserve MCP sessions across normal usage.
+const MCP_ACCESS_TOKEN_TTL_SECONDS = 60 * 60 * 24;
+const MCP_REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 30;
 
 export type OpenSeoOAuthEnv = Env & {
   OAUTH_KV: KVNamespace;
@@ -390,7 +393,8 @@ export function createOpenSeoOAuthProvider(appFetch: AppFetch) {
     tokenEndpoint: OAUTH_TOKEN_PATH,
     clientRegistrationEndpoint: OAUTH_REGISTER_PATH,
     scopesSupported: [...MCP_OAUTH_SCOPES],
-    refreshTokenTTL: REFRESH_TOKEN_TTL_SECONDS,
+    accessTokenTTL: MCP_ACCESS_TOKEN_TTL_SECONDS,
+    refreshTokenTTL: MCP_REFRESH_TOKEN_TTL_SECONDS,
     resourceMetadata: {
       scopes_supported: [...MCP_OAUTH_SCOPES],
       resource_name: "OpenSEO MCP",
diff --git a/wrangler.jsonc b/wrangler.jsonc
index 143b88d..adcc450 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -3,7 +3,7 @@
   "name": "open-seo",
   "main": "src/server.ts",
   "compatibility_date": "2025-09-02",
-  "compatibility_flags": ["nodejs_compat"],
+  "compatibility_flags": ["nodejs_compat", "global_fetch_strictly_public"],
   "observability": {
     "enabled": true,
   },