Re-Review: Register Notion OAuth app

review-1046-2026-04-21-rereview Review

review approved

Project

Verdict: APPROVED

Ticket: board item #1046 — forgejo_admin/notion-mcp-remote#6 — feat: register public Notion OAuth integration for remote proxy

Prior review: review-1046-2026-04-21 (NEEDS_REFINEMENT). This is a targeted re-review checking only the three gaps flagged by the original reviewer.

Gap Verification

[x] [BODY] Redirect URI /callback → /oauth/callback — CLOSED. AC #3 now reads https://notion-mcp-remote.tail5b443a.ts.net/oauth/callback. AC #5 smoke curl uses the URL-encoded form %2Foauth%2Fcallback. Constraints cite the source of truth: mcp_remote_auth/routes.py:41 and provider.py:125,151.
[x] [BODY] /onboard/callback follow-up consideration — CLOSED (as follow-up flag, not blocker). Constraints section now includes: "Follow-up: when the onboarding flow story lands, decide whether to register /onboard/callback as a secondary redirect URI on this same integration (avoids a second UI trip) or create a separate integration." Appropriate disposition — the onboarding flow is a separate story, so registering the URI now is optional and correctly deferred with a clear decision point.
[x] [SCOPE] Reference arch-dataflow-notion-mcp-remote — CLOSED. Related section explicitly links arch-dataflow-notion-mcp-remote with the (OAuth handshake sequence) annotation. Confirmed the backing note exists (id 1547, active, architecture note). The "stale link" flag from the original gap list turned out to be a non-issue as reported — there was no stale link to replace, and the dataflow note is now properly cited as the arch reference.

Template Completeness

Unchanged from prior review — all sections of template-issue-feature still present and well-formed. No sections were dropped during refinement.

Traceability

[x] story:claude-ai-connect label — Connect Notion to claude.ai, story note verified (id 1543).
[x] arch:notion-oauth label — body now resolves this to the existing arch-dataflow-notion-mcp-remote note (id 1547) which documents the OAuth handshake sequence. Traceability link is satisfied in the body even though a dedicated arch-notion-oauth note does not exist under that exact slug; Ava previously indicated this resolution (citing the dataflow note) is acceptable.
[x] Forgejo issue — forgejo_admin/notion-mcp-remote#6, open.

File Targets

No repo file edits expected — credential provisioning ticket. Downstream consumers (server.py:19-20, .env.example:2-3, k8s/deployment.yaml:43-52) unchanged since prior review and re-verified against the current working tree. "Do not touch" list accurate.

Repo Placement

OK — issue is filed on forgejo_admin/notion-mcp-remote where the credentials are consumed. Sibling tickets (#7 secret provisioning, #9 E2E verify) correctly separated into their own issues.

Dependencies

Unchanged: this ticket blocks #7 (arch:k8s-secret) and #9 (arch:tailscale-funnel). Not blocked by anything currently in in_progress. Safe to advance.

Acceptance Criteria

All 5 ACs verifiable. AC #3 and AC #5 now testable against the real /oauth/callback endpoint. The redirect URI path fix closes the critical silent-failure mode flagged in the prior review.

Blast Radius

Risk profile improved from the prior review: the wrong-path silent-failure mode is eliminated by the AC #3/#5 fix. Remaining risks are the same as any OAuth credential provisioning — CLIENT_SECRET must stay out of git (Constraint #3 covers this), and BASE_URL / Tailscale Funnel hostname changes will require re-editing the Notion integration in the UI. Nothing new introduced by the refinement.

Decomposition Assessment

1 point, 5 ACs, no code edits, single UI flow. Well within the 5-minute rule. No decomposition needed.

Recommendation

All flagged gaps are addressed. Ticket is ready to move backlog → todo → next_up. No action needed.