mcp_client try_refresh_bearer_token: same token-tier downgrade shape as PR #11 DEFECT 2

[mortonanalytics]

Latent, not newly reachable — deliberately scoped out of PR #11 (#12–#20). Recording so it carries a re-entry gate instead of dying in PR prose.

Defect

src/connectors/mcp_client.rs:239 try_refresh_bearer_token, reached from the 401-retry path at mcp_client.rs:87, refreshes and re-sends with a peer-level token on a 401. This is the same token-tier downgrade class that PR #11 DEFECT 2 fixed elsewhere (delegated request that 401s must not silently fall back to a broader-scope peer-global credential).

Here it is not currently reachable with a downgraded scope in the shipped call paths, so it was left out of the nine issues' acceptance criteria — but the shape is a security-shaped bug waiting on a caller that exercises it.

Fix direction

Apply the DEFECT 2 pattern: on 401, only retry with a token of the same or narrower scope as the original request; never escalate to a peer-global/global credential. Add a regression test mirroring the DEFECT 2 pre-fix red evidence (assert the retry does not put a broader-scope Bearer on the wire).

Ref: PR #11 DEFECT 2 (401 tier downgrade).

[mortonanalytics]

Severity correction — this is NOT latent. The original filing said "not currently reachable." That premise is false: auto_create_connector_for_peer never sets bearer_token, so every subscribed peer routes through this exact mcp_client.rs 401-retry path. The DEFECT 2 fix landed in peer_tokens.rs but not here — mcp_client.rs is the default path. This is a live token-tier downgrade on the primary code path, not a theoretical one.

Being fixed in the current PR #11 hardening wave; will close with that PR.

[mortonanalytics]

Fixed in PR #23.

try_refresh_bearer_token (src/connectors/mcp_client.rs:248) now gates the peer-global refresh on rejected.allows_peer_global_refresh() (:252) — the same ResolvedBearer/CredentialTier mechanism that fixed the sibling sites in peer_tokens.rs, not a second parallel mechanism.

One correction to this issue's premise: it says the downgrade was not currently reachable. It was, and on the default path. auto_create_connector_for_peer (src/services/peer.rs) creates connector config with no bearer_token, and nothing in src/ ever sets one — so self.bearer_token is empty for every subscribed peer, resolve_bearer_token took the full resolve_access_token chain, and a tier-1 delegated token that 401'd was retried with the peer-global grant. That is the intended production configuration for the identity broker (#12), so it was live rather than latent.

Regression tests, with pre-fix evidence showing the broader-scope bearer on the wire:

• connector_does_not_retry_a_401_delegated_token_with_the_peer_global_token
• connector_does_not_retry_a_401_workspace_credential_with_the_peer_global_token

Pre-fix: ["Bearer connector-delegated-that-gets-401", "Bearer peer-global-refreshed"] where only the first is permitted.