golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(02-03): mask OAuth client_id and unix issued_at

Browse Source 
RFC 7591 registration returns a string client_id and unix client_id_issued_at; treating those as Carbon/integer foreign keys would fail PHP self-replay of MCP OAuth.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-09-17 13:36:30 +02:00
parent 8f94b07986
commit 22f02eed59
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tide/normalize.go
View File

@@ -55,16 +55,19 @@ func maskLeaf(path string, val any, step Step, diffs *[]Diff) any {
if key == "slug" || disabledPath(step, path, key) {
return val
}
if key == "collection_key" {
if key == "collection_key" || key == "client_id" {
if val == nil {
return nil
}
if _, ok := val.(string); !ok {
*diffs = append(*diffs, Diff{Path: path, Expected: "string collection_key", Actual: formatValue(val)})
*diffs = append(*diffs, Diff{Path: path, Expected: "string " + key, Actual: formatValue(val)})
return val
}
return maskID
}
if strings.HasSuffix(key, "_issued_at") {
return maskIDValue(path, val, diffs)
}
if isDateKey(key) {
return maskDate(path, val, diffs)
}