Altinity / altinity-mcp / 25440847973

82%

main: 79%

Build Type

Pull #101

github

Committed by BorisTyshkevich

Commit Message

oauth: emit canonical resource URL with trailing slash; tolerate either form on inbound aud

handleOAuthProtectedResource now returns "resource" in its canonical
RFC 9728 form (always trailing slash), produced by canonicalResourceURL.
This matches what most upstream IdPs (Auth0, Google) emit in `aud`
claims and what RFC 9728 §3.3 picks as the canonical resource
identifier. Strict OAuth clients (Claude.ai) compare the resource
metadata field literally, so the slash-less form caused mismatches.

audienceMatchesResource is a small helper that compares an audience
list against an expected resource URL with trailing-slash tolerance,
so tokens minted before this change (no slash) still validate, and
tokens minted after (with slash) also validate when admin config
keeps the no-slash form. Both validateOAuthClaims and the external-JWT
path use the helper.

Also adds:
- TestCanonicalResourceURL covering empty / whitespace / multi-slash
  inputs and path-suffixed bases.
- audience_trailing_slash_tolerant subtest in TestValidateOAuthClaims
  exercising both directions.
- Existing protected-resource tests updated to assert the canonical
  trailing-slash form.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #101: Wire OAuth config to CLI flags / env vars (closes #96)

Coverage Stats

166 of 183 new or added lines in 4 files covered. (90.71%)

6 existing lines in 1 file now uncovered.

4491 of 5477 relevant lines covered (82.0%)

1.22 hits per line