fix: address oauth-status review feedback on catalog OAuth registration

Widen _build_oauth_config_from_credentials to carry redirect_uri,
username, password, audience, and resource, matching the field set
admin._assemble_oauth_config_from_fields already accepts, so a
catalog-registered OAuth gateway can get RFC 8707 resource/audience
and password-grant fields set at registration time.

Restore coverage for the requires_oauth_config boundary case removed
alongside the oauth_config listing column: a disabled OAuth gateway
must still requires_oauth_config even once oauth_config is persisted.

Addresses PR #6588 review feedback.

Signed-off-by: Marek Dano <mk.dano@gmail.com>

Author: marekdano

mcpgateway/services/catalog_service.py

@@ -417,7 +417,8 @@ def _build_oauth_config_from_credentials(oauth_credentials: Optional[Dict[str, A
 
         Args:
             oauth_credentials: Caller-supplied OAuth credential overrides (issuer, scopes, and
-                optionally client_id/client_secret/token_url/authorization_url), or None.
+                optionally client_id/client_secret/token_url/authorization_url/redirect_uri/
+                username/password/audience/resource), or None.
 
         Returns:
             A raw oauth_config dict with authorization_code/store_tokens/auto_refresh defaults
@@ -429,13 +430,19 @@ def _build_oauth_config_from_credentials(oauth_credentials: Optional[Dict[str, A
             "store_tokens": True,
             "auto_refresh": True,
         }
-        for key in ("issuer", "client_id", "client_secret", "token_url", "authorization_url"):
+        # Mirrors the field set admin._assemble_oauth_config_from_fields() accepts, so a
+        # catalog-registered gateway can carry the same RFC 8707 resource/audience and
+        # password-grant fields a manually-created gateway can (#5967 follow-up).
+        for key in ("issuer", "client_id", "client_secret", "token_url", "authorization_url", "redirect_uri", "username", "password", "audience"):
             value = oauth_credentials.get(key)
             if value:
                 raw_oauth_config[key] = value
         scopes = oauth_credentials.get("scopes")
         if scopes:
             raw_oauth_config["scopes"] = scopes if isinstance(scopes, list) else [str(scopes)]
+        resource = oauth_credentials.get("resource")
+        if resource:
+            raw_oauth_config["resource"] = resource if isinstance(resource, list) else str(resource)
         return raw_oauth_config
 
     async def register_catalog_server(

tests/unit/mcpgateway/services/test_catalog_service.py

@@ -218,6 +218,56 @@ async def test_get_catalog_servers_requires_oauth_config_enabled(service):
         assert server.requires_oauth_config is False
 
 
+@pytest.mark.asyncio
+async def test_get_catalog_servers_requires_oauth_config_true_even_when_oauth_config_set(service, test_db):
+    """A disabled OAuth gateway still requires_oauth_config even once oauth_config is persisted.
+
+    Catalog registration now persists oauth_config up front (#5967), so an unauthorized gateway
+    can have a populated oauth_config and still need the caller to complete the OAuth flow.
+    requires_oauth_config must key off enabled/auth_type alone, not oauth_config presence -
+    otherwise a genuinely unauthorized gateway would look fully configured to the caller.
+    """
+    # First-Party
+    from mcpgateway.db import Gateway as DbGateway
+
+    gateway = DbGateway(
+        id="gw-configured-disabled",
+        name="oauth-configured",
+        slug="oauth-configured",
+        url="http://oauth-configured.example.com",
+        description="OAuth server with oauth_config already set, still disabled",
+        capabilities={},
+        auth_type="oauth",
+        enabled=False,
+        oauth_config={"grant_type": "authorization_code", "issuer": "https://idp.example.com"},
+    )
+    test_db.add(gateway)
+    test_db.commit()
+
+    fake_catalog = {
+        "catalog_servers": [
+            {
+                "id": "1",
+                "name": "oauth-configured",
+                "url": "http://oauth-configured.example.com",
+                "category": "cat",
+                "auth_type": "OAuth2.1",
+                "provider": "prov",
+                "tags": [],
+                "description": "OAuth server",
+            },
+        ]
+    }
+    with patch.object(service, "load_catalog", AsyncMock(return_value=fake_catalog)), patch.object(service, "_get_registry_cache", return_value=None):
+        req = CatalogListRequest(offset=0, limit=10)
+        result = await service.get_catalog_servers(req, test_db)
+        assert result.total == 1
+        server = result.servers[0]
+        assert server.is_registered is True
+        assert server.gateway_id == "gw-configured-disabled"
+        assert server.requires_oauth_config is True
+
+
 @pytest.mark.asyncio
 async def test_register_catalog_server_not_found(service):
     with patch.object(service, "load_catalog", AsyncMock(return_value={"catalog_servers": []})):
@@ -546,6 +596,34 @@ def mock_refresh(obj):
     assert db_gateway.visibility == "private"
 
 
+def test_build_oauth_config_from_credentials_carries_resource_and_password_grant_fields(service):
+    """The catalog registration path must not drop RFC 8707 resource/audience or
+    password-grant fields that the equivalent admin.py OAuth form assembly accepts,
+    otherwise a catalog-registered gateway can never get them set at registration time."""
+    raw = service._build_oauth_config_from_credentials(
+        {
+            "issuer": "https://issuer.example.com",
+            "redirect_uri": "https://gateway.example.com/oauth/callback",
+            "username": "svc-account",
+            "password": "svc-secret",  # pragma: allowlist secret
+            "audience": "https://api.example.com",
+            "resource": "https://api.example.com/mcp",
+        }
+    )
+    assert raw["redirect_uri"] == "https://gateway.example.com/oauth/callback"
+    assert raw["username"] == "svc-account"
+    assert raw["password"] == "svc-secret"  # pragma: allowlist secret
+    assert raw["audience"] == "https://api.example.com"
+    assert raw["resource"] == "https://api.example.com/mcp"
+
+
+def test_build_oauth_config_from_credentials_resource_list_preserved(service):
+    """A caller-supplied multi-value ``resource`` (RFC 7519 aud-claim shape) round-trips as a
+    list rather than being coerced to str or dropped for not being a plain string."""
+    raw = service._build_oauth_config_from_credentials({"resource": ["https://a.example.com", "https://b.example.com"]})
+    assert raw["resource"] == ["https://a.example.com", "https://b.example.com"]
+
+
 @pytest.mark.asyncio
 async def test_register_oauth_skip_init_persists_oauth_credentials(service):
     """oauth_credentials submitted with the register request land on the gateway's