feat: reserve the MCP paths

/mcp (the MCP endpoint) and /.well-known (the OAuth metadata documents)
join reservedPrefixes, so they answer a plain 404 here instead of the
student app; /connect stays a client route.
This commit is contained in:
2026-10-28 14:09:22 +01:00
parent 0ac83de8b2
commit 72043ac85e

View File

@@ -38,9 +38,11 @@ const defaultAdminPath = "/bmadmin"
// reservedPrefixes are the path prefixes the student app never answers: the
// APIs of the plugins (the chat plugins' included), the public uploads and
// /oauth (the social sign-in routes of golem15.sociallogin and their
// provider callbacks). The admin path is added from the configuration.
var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/_chat", "/_chatchannels", "/_chatbots", "/api", "/storage", "/oauth"}
// /oauth (the social sign-in routes of golem15.sociallogin, their provider
// callbacks and golem15.oauthserver's MCP authorization routes), /mcp (the
// MCP endpoint) and /.well-known (the OAuth metadata documents). The admin
// path is added from the configuration.
var reservedPrefixes = []string{"/_user", "/_bm", "/_quizzes", "/_presentations", "/_chat", "/_chatchannels", "/_chatbots", "/api", "/storage", "/oauth", "/mcp", "/.well-known"}
// errMissingIndex reports a tree without index.html (an unbuilt tree).
var errMissingIndex = errors.New("jz.bm: public/index.html missing; run the frontend build (cd frontend && npm ci && npm run build)")