[abdulrafey1]

What

Open edX tools no longer take a password, an access token or LMS URLs from the model. The Open edX
client gets and caches its own access token with the user's stored settings, so the password never
reaches the chat prompt and the token never passes through the model.

Changes

• fix(plugins): OpenEdxClient(config, user_id) runs the OAuth2 password grant with the stored
  username and password on first use, then caches the token in Redis under
  openedx:access-token:<user_id>:<digest>. The digest is an HMAC-SHA256, keyed with SECRET_KEY, of
  the stored LMS URL, username and password. Saving new settings moves the user to a new key, and the
  old token expires on its own. The key shows none of the settings. The TTL is expires_in minus 60 s,
  or the cache default when Open edX sends no expiry.
• fix(plugins): on a 401 the client drops the cached token, grants a new one and retries once. A
  second 401 is reported. A token-response error never includes the response body, in the message or
  in a chained cause.
• fix(plugins): OpenEdxClient.studio_url gives the Studio base URL from the stored settings. The
  tools open a client through one _open_client() factory, which loads the caller's settings and user
  id. The tool helpers (create_basic_component, update_xblock_content, …) take the open client.
• fix(plugins): the openedx_authenticate and openedx_refresh_access_token tools are removed, and so
  is every auth field. openedx_get_user_info becomes openedx_check_settings (category
  openedx-settings): it takes no arguments, checks the stored settings and returns the signed-in account.
  openedx_add_plugin_content loads settings before resolving the contributor, so an unconfigured user
  never creates contributor content.
• fix(plugins): OpenEdxConfig drops to_lms_credentials_hint.
• feat(core): sparkth.lib.cache exposes CacheService and get_cache_service to plugins. Their
  docstrings now describe the API, and the API reference lists the module.
• test(core): sparkth.lib.testing gains FakeRedis and an opt-in fake_redis fixture that routes the
  shared CacheService to it. The email-verification test uses the same FakeRedis.

How to Test

1. uv run pytest sparkth/plugins/openedx tests/api/v1/test_auth_email_verification.py -v.
2. test_client.py checks that:
   • a token is granted once and reused;
   • two users never share a token;
   • saving new settings grants a new token under a new key;
   • the cache key shows none of the stored settings;
   • a 401 retries once with a fresh token, and a second 401 is reported;
   • the TTL never outlives expires_in;
   • an unreachable Redis still works;
   • a malformed token response never echoes its body.
3. Manual: with Open edX set up, create a course, then a section and unit in a later turn. No
   authenticate step happens, and every call succeeds.
4. Manual: save different Open edX settings, then call a tool. It acts as the new account.

Notes

Breaking for MCP clients: the two auth tools are gone and the Open edX tool schemas no longer accept
auth. On /ai/mcp no user is bound, so these tools fail with NoAuthenticatedUser.
The token is cached in Redis (REDIS_URL, already required) as plain text. It is a short-lived access
token whose cache entry expires with it, and the password is never cached. No new env var, no migration.

This description was written with the assistance of an LLM (Claude).

🤖 Generated with Claude Code

[hamza-56]

1 point:

[zaira-bibi]

looks good! please try to not have more than 10 files in the PRs.