pomerium / pomerium / 22503580043

45%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: add PRM path-prefix validation and DCR fallback option (#6153)

## Summary

- Replace strict `normalizeResourceURL()` exact matching with
`checkResourceAllowed()` path-prefix validation, ported from the [MCP
TypeScript SDK](https://github.com/modelcontextprotocol/typescript-sdk).
Same origin (scheme+host+port, case-insensitive per RFC 3986) required,
plus PRM resource path must be a prefix of the upstream server URL path.
Paths are cleaned (`path.Clean`) to prevent traversal bypasses.
- Add `WithAllowDCRFallback(true)` option: when the upstream AS does not
support `client_id_metadata_document`, allows `runUpstreamOAuthSetup` to
return an empty `ClientID` with `RegistrationEndpoint` populated, so
callers can fall back to RFC 7591 DCR.
- Propagate `RegistrationEndpoint` from AS metadata through
`discoveryResult`.

## Related issues

- ENG-3592

## User Explanation

<!-- No user-facing changes -->

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Run Details

62 of 78 new or added lines in 1 file covered. (79.49%)

24 existing lines in 7 files now uncovered.

33770 of 75317 relevant lines covered (44.84%)

116.49 hits per line