pomerium / pomerium / 25144406852

45%

Build Type

push

github

Committed by web-flow

Commit Message

mcp: strip default ports when comparing PRM resource to upstream URL (#6309)

## Summary

When the ingress controller emits an upstream URL with an explicit
`:443` (its standard form for ExternalName services), the PRM resource
check fails origin equality against a canonical PRM resource that omits
the port. As a result, every Kubernetes-routed MCP server backed by an
HTTPS `ExternalName` service falls through to "no upstream OAuth" and
returns 401.

Strip the scheme's default port (RFC 3986 §6.2.3) before comparing
scheme+host in `checkResourceAllowed`, and apply the same
canonicalization in `originOf` so the resource identifier used as the
OAuth audience is canonical. Path-prefix matching handles the residual
`mcp_server_path` case once the port mismatch is resolved.

## Related issues

-
[ENG-3963](https://linear.app/pomerium/issue/ENG-3963/pomerium-mcp-prm-resource-check-fails-on-default-ports-every-https)

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [x] add appropriate label (\`bug\`)
- [ ] ready for review

Coverage Stats

26 of 26 new or added lines in 1 file covered. (100.0%)

27 existing lines in 7 files now uncovered.

35565 of 78216 relevant lines covered (45.47%)

114.33 hits per line