golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(02-03): mask OAuth client_id and unix issued_at

Browse Source 
RFC 7591 registration returns a string client_id and unix client_id_issued_at; treating those as Carbon/integer foreign keys would fail PHP self-replay of MCP OAuth.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Jakub Zych
2026-09-17 13:36:30 +02:00
parent 8f94b07986
commit 22f02eed59
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tide/normalize.go
View File

@@ -55,16 +55,19 @@ func maskLeaf(path string, val any, step Step, diffs *[]Diff) any {
if key == "slug" || disabledPath(step, path, key) { if key == "slug" || disabledPath(step, path, key) {
return val return val
} }
if key == "collection_key" { if key == "collection_key" || key == "client_id" {
if val == nil { if val == nil {
return nil return nil
} }
if _, ok := val.(string); !ok { if _, ok := val.(string); !ok {
*diffs = append(*diffs, Diff{Path: path, Expected: "string collection_key", Actual: formatValue(val)}) *diffs = append(*diffs, Diff{Path: path, Expected: "string " + key, Actual: formatValue(val)})
return val return val
} }
return maskID return maskID
} }
if strings.HasSuffix(key, "_issued_at") {
return maskIDValue(path, val, diffs)
}
if isDateKey(key) { if isDateKey(key) {
return maskDate(path, val, diffs) return maskDate(path, val, diffs)
} }

6
tide/normalize_test.go
View File

@@ -41,6 +41,12 @@ func TestNormalizeDateIDAndDisable(t *testing.T) {
t.Fatalf("slug must stay exact: %+v", slugDiffs) t.Fatalf("slug must stay exact: %+v", slugDiffs)
} }
issuedA := []byte(`{"client_id":"aaa","client_id_issued_at":111}`)
issuedB := []byte(`{"client_id":"bbb","client_id_issued_at":222}`)
if diffs := compareBodies(Response{Headers: jsonCT(), Body: Body(issuedA)}, Response{Headers: jsonCT(), Body: Body(issuedB)}, step); len(diffs) != 0 {
t.Fatalf("oauth client_id/issued_at must mask: %+v", diffs)
}
disabled := Step{ID: "n", Normalize: []NormalizeRule{{Path: "created_at", Disable: true}}} disabled := Step{ID: "n", Normalize: []NormalizeRule{{Path: "created_at", Disable: true}}}
dDiffs := compareBodies(Response{Headers: jsonCT(), Body: Body(want)}, Response{Headers: jsonCT(), Body: Body(gotOK)}, disabled) dDiffs := compareBodies(Response{Headers: jsonCT(), Body: Body(want)}, Response{Headers: jsonCT(), Body: Body(gotOK)}, disabled)
if len(dDiffs) == 0 { if len(dDiffs) == 0 {