golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(02-03): mask OAuth client_id and unix issued_at

Browse Source 
RFC 7591 registration returns a string client_id and unix client_id_issued_at; treating those as Carbon/integer foreign keys would fail PHP self-replay of MCP OAuth.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-09-17 13:36:30 +02:00
parent 8f94b07986
commit 22f02eed59
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
tide/normalize_test.go
View File

@@ -41,6 +41,12 @@ func TestNormalizeDateIDAndDisable(t *testing.T) {
t.Fatalf("slug must stay exact: %+v", slugDiffs)
}
issuedA := []byte(`{"client_id":"aaa","client_id_issued_at":111}`)
issuedB := []byte(`{"client_id":"bbb","client_id_issued_at":222}`)
if diffs := compareBodies(Response{Headers: jsonCT(), Body: Body(issuedA)}, Response{Headers: jsonCT(), Body: Body(issuedB)}, step); len(diffs) != 0 {
t.Fatalf("oauth client_id/issued_at must mask: %+v", diffs)
}
disabled := Step{ID: "n", Normalize: []NormalizeRule{{Path: "created_at", Disable: true}}}
dDiffs := compareBodies(Response{Headers: jsonCT(), Body: Body(want)}, Response{Headers: jsonCT(), Body: Body(gotOK)}, disabled)
if len(dDiffs) == 0 {