GET /oauth/authorize (authorizePage in src/web/pages/oauth.ts) is the page every MCP client sends a person to, and today its Server-Timing carries only the route total.
Done:
[ ] A signed-in GET /oauth/authorize with a valid client request answers with Server-Timing naming session, request (the parseAuthRequest read of the registered client) and render, using notePhase / timePhase from src/core/route_timing.ts the way src/web/pages/apps.ts does (#3403).
[ ] A refused request (unknown client, unregistered redirect) still names session and request.
[ ] The signed-out redirect to /signin is unchanged.
[ ] test/oauth-timing.test.ts asserts the phase names for both cases and would fail without the change; test/oauth-flow.test.ts still passes.
Files: src/web/pages/oauth.ts, test/oauth-timing.test.ts.
Risk: small; keep the consent page's CSP, allowReturnTo and same-origin behaviour exactly as they are.
GET /oauth/authorize(authorizePageinsrc/web/pages/oauth.ts) is the page every MCP client sends a person to, and today its Server-Timing carries only the route total.Done:
GET /oauth/authorizewith a valid client request answers with Server-Timing namingsession,request(theparseAuthRequestread of the registered client) andrender, usingnotePhase/timePhasefromsrc/core/route_timing.tsthe waysrc/web/pages/apps.tsdoes (#3403).sessionandrequest.test/oauth-timing.test.tsasserts the phase names for both cases and would fail without the change;test/oauth-flow.test.tsstill passes.Files:
src/web/pages/oauth.ts,test/oauth-timing.test.ts. Risk: small; keep the consent page's CSP,allowReturnToand same-origin behaviour exactly as they are.