stacklok / toolhive / 18502123331

59%

Build Type

push

github

Committed by web-flow

Commit Message

Support RFC 9728 well-known paths with resource components (#2197)

The previous implementation used exact path matching for the well-known
OAuth protected resource metadata endpoint, which only accepted:
  /.well-known/oauth-protected-resource

This broke RFC 9728 Section 3.1 compliance for resources with path
components. When a resource is identified as "https://server.com/mcp",
clients must fetch metadata from:
  /.well-known/oauth-protected-resource/mcp

But the exact match would return 404, preventing proper OAuth discovery
for MCP servers with path-based resource identifiers.

Changed to prefix matching to support both:
- /.well-known/oauth-protected-resource (base path)
- /.well-known/oauth-protected-resource/mcp (with resource component)
- /.well-known/oauth-protected-resource/resource1 (multi-tenant)

This enables multi-tenant hosting configurations as specified in
RFC 9728 and ensures OAuth discovery works correctly for MCP servers
regardless of their path structure.

Note: The current implementation accepts all paths under the prefix
(e.g., /.well-known/oauth-protected-resource/*). In the future, this
could be tightened by having NewAuthInfoHandler parse the request path,
extract the resource component, and validate it matches the resourceURL
path before returning metadata. This would enforce stricter path
matching while maintaining RFC 9728 compliance.

Run Details

0 of 6 new or added lines in 1 file covered. (0.0%)

5 existing lines in 2 files now uncovered.

17552 of 37663 relevant lines covered (46.6%)

16.0 hits per line