fix: follow the next-page cursor when paginating via the request executor

The resilient list_applications/list_group_apps path fetches pages through the
request executor, which returns the raw aiohttp response. extract_after_cursor
only understood the typed-SDK shapes (ApiResponse.headers / OktaAPIResponse._next),
so on the executor response it found no cursor and pagination stopped after the
first page — listings silently truncated to one page (e.g. fetch_all returned only
20 items) on accounts/groups with more.

Root cause: Okta returns 'self' and 'next' as SEPARATE Link headers, so a multidict
headers.get('Link') yields only 'self'. aiohttp already parses them into .links
(rel-keyed), which is what the SDK itself uses (OktaAPIResponse.extract_pagination).

extract_after_cursor now reads response.links['next'] first (raw executor response),
then falls back to a Link-header string via .headers / get_headers() / _resp_headers
(ApiResponse and other shapes), then the SDK v2 has_next()/_next path. Adds tests for
the aiohttp .links shape and the header-accessor fallbacks.

Refs #48

Author: kstlouis

src/okta_mcp_server/utils/pagination.py

@@ -25,15 +25,53 @@ def extract_after_cursor(response) -> Optional[str]:
     Returns:
         str: The 'after' cursor value, or None if no next page
     """
-    # --- Okta SDK v3: ApiResponse with Link header ---
-    if response and hasattr(response, "headers") and response.headers:
+    # --- Raw aiohttp response (returned by the request executor) ---
+    # The request executor returns aiohttp's response object directly. aiohttp
+    # pre-parses the (possibly multiple) Link headers into ``.links``, a mapping
+    # keyed by rel — e.g. ``links["next"]["url"]`` is a yarl URL. This is what the
+    # SDK itself uses (OktaAPIResponse.extract_pagination). Reading the raw
+    # ``headers.get("Link")`` is NOT enough: Okta sends ``self`` and ``next`` as
+    # SEPARATE Link headers, and a multidict ``.get`` returns only the first
+    # (self), so the next cursor would be missed.
+    links = getattr(response, "links", None) if response is not None else None
+    if links:
+        try:
+            nxt = links.get("next")
+            url = nxt.get("url") if nxt is not None and hasattr(nxt, "get") else None
+            if url is not None:
+                cursor = parse_qs(urlparse(str(url)).query).get("after", [None])[0]
+                if cursor:
+                    return cursor
+        except Exception as e:
+            logger.warning(f"Failed to parse aiohttp links cursor: {e}")
+
+    # --- Okta SDK v3: Link-header cursor ---
+    # Resolve a headers mapping from whichever response shape we got:
+    #   * ApiResponse exposes a ``.headers`` attribute
+    #   * OktaAPIResponse (what the request executor returns) exposes headers via
+    #     ``get_headers()`` / ``_resp_headers`` and does NOT have ``.headers``
+    # Reading both ensures the cursor is found regardless of how the page was
+    # fetched (typed client vs. raw request executor).
+    headers = None
+    if response is not None:
+        if getattr(response, "headers", None):
+            headers = response.headers
+        elif hasattr(response, "get_headers"):
+            try:
+                headers = response.get_headers()
+            except Exception:
+                headers = None
+        if not headers and getattr(response, "_resp_headers", None):
+            headers = response._resp_headers
+
+    if headers:
         link_header = ""
         try:
-            link_header = response.headers.get("Link", "") or response.headers.get("link", "")
+            link_header = headers.get("Link", "") or headers.get("link", "")
         except Exception:
-            for key in response.headers:
+            for key in headers:
                 if key.lower() == "link":
-                    link_header = response.headers[key]
+                    link_header = headers[key]
                     break
 
         if link_header and 'rel="next"' in link_header:

tests/test_pagination.py

@@ -106,6 +106,43 @@ def test_handles_multiple_link_rels(self):
         }
         assert extract_after_cursor(response) == "cursor99"
 
+    def test_reads_link_from_okta_api_response_get_headers(self):
+        """OktaAPIResponse (request-executor result) exposes headers via
+        get_headers(), not a .headers attribute, and leaves _next unset — the
+        cursor must still be extracted from the Link header."""
+        response = MagicMock(spec=["get_headers"])
+        response.get_headers.return_value = {
+            "link": '<https://test.okta.com/api/v1/apps?after=execcursor1>; rel="next"'
+        }
+        assert extract_after_cursor(response) == "execcursor1"
+
+    def test_reads_link_from_resp_headers_attr(self):
+        """Fallback to the private _resp_headers mapping when neither .headers
+        nor get_headers() yields a usable header set."""
+        response = MagicMock(spec=["_resp_headers"])
+        response._resp_headers = {
+            "Link": '<https://test.okta.com/api/v1/apps?after=execcursor2>; rel="next"'
+        }
+        assert extract_after_cursor(response) == "execcursor2"
+
+    def test_reads_next_from_aiohttp_links(self):
+        """The request executor returns the raw aiohttp response, whose .links
+        is a rel-keyed mapping ({'next': {'url': <yarl URL>}}). Okta sends self
+        and next as separate Link headers, so this parsed mapping — not a raw
+        headers.get('Link') — is the reliable source of the next cursor."""
+        response = MagicMock(spec=["links"])
+        response.links = {
+            "self": {"url": "https://test.okta.com/api/v1/apps?limit=20"},
+            "next": {"url": "https://test.okta.com/api/v1/apps?after=aiocursor1&limit=20"},
+        }
+        assert extract_after_cursor(response) == "aiocursor1"
+
+    def test_no_next_in_aiohttp_links_returns_none(self):
+        """Only a self link (last page) → no cursor."""
+        response = MagicMock(spec=["links"])
+        response.links = {"self": {"url": "https://test.okta.com/api/v1/apps?limit=20"}}
+        assert extract_after_cursor(response) is None
+
 
 # ---------------------------------------------------------------------------
 # extract_after_cursor — SDK v2 path