From b3b8b4a18b5093e19c8f904fbbfd012e2c6c0a84 Mon Sep 17 00:00:00 2001
From: rohanpatel2002 <rohanpatel2118@gmail.com>
Date: Mon, 20 Jul 2026 20:36:58 +0530
Subject: [PATCH] fix: accept offline_access OAuth scope for MCP refresh
 clients

---
 internal/models/oauth_scope.go      | 10 ++++++----
 internal/models/oauth_scope_test.go |  5 +++++
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/internal/models/oauth_scope.go b/internal/models/oauth_scope.go
index 13d7148ef0..c3b5a21dc0 100644
--- a/internal/models/oauth_scope.go
+++ b/internal/models/oauth_scope.go
@@ -4,10 +4,11 @@ import "strings"
 
 // OAuth/OIDC scope constants
 const (
-	ScopeOpenID  = "openid"
-	ScopeEmail   = "email"
-	ScopeProfile = "profile"
-	ScopePhone   = "phone"
+	ScopeOpenID        = "openid"
+	ScopeEmail         = "email"
+	ScopeProfile       = "profile"
+	ScopePhone         = "phone"
+	ScopeOfflineAccess = "offline_access"
 )
 
 // SupportedOAuthScopes defines all OAuth/OIDC scopes supported by the server
@@ -16,6 +17,7 @@ var SupportedOAuthScopes = []string{
 	ScopeProfile,
 	ScopeEmail,
 	ScopePhone,
+	ScopeOfflineAccess,
 }
 
 // IsSupportedScope checks if a scope is in the supported scopes list
diff --git a/internal/models/oauth_scope_test.go b/internal/models/oauth_scope_test.go
index 0d991140bc..99677fbc07 100644
--- a/internal/models/oauth_scope_test.go
+++ b/internal/models/oauth_scope_test.go
@@ -224,6 +224,11 @@ func TestIsSupportedScope(t *testing.T) {
 			scope:    ScopePhone,
 			expected: true,
 		},
+		{
+			name:     "offline_access scope is supported",
+			scope:    ScopeOfflineAccess,
+			expected: true,
+		},
 		{
 			name:     "unsupported scope address",
 			scope:    "address",