3 Commits

Include renames

Author	SHA1	Message	Date
mathiasandClaude Opus 5.5	e05a13ab08	test(ingestion): assert the bare token is absent from both auth log lines ... PR #181 review (comment 15483): - TestBuildMuxLogsARESTAuthRejection asserted only that the "Bearer <tok>" header form was absent, which a field-logging chassis could never emit. Replaced by TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken (a sentinel wrong token; neither it nor the static token may appear) and TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken. A local chassis v0.7.1 copy logging rawToken as token_fp (deny, then accept) turns each red. - labelRESTPattern doc: the label bound holds for refused requests only; the authenticated-404 raw-path gap is hyperguild#185. - Remove internal/startupretry: nothing imports it since the chassis bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 16:31:11 +02:00
mathiasandClaude Opus 5.5	474473c99f	fix(ingestion): bump mcp-chassis to v0.7.1; label refused REST requests by route ... 1. Rejections are logged. chassis v0.2.0 refused without a log line, so since #149 an unknown REST caller got silent 401s. v0.7.1 writes `mcp auth rejected` (reason, remote, token fingerprint, path) and `mcp auth accepted` per authenticated request. Tested through buildMux. 2. Fallout: since chassis v0.7 (mcp-chassis#4) NewJWTValidator no longer fails on OIDC discovery; the issuer resolves lazily and a JWT gets 503-and-retry until it does. #83's boot retry loop therefore never retried, and its tests failed. buildJWTValidator now builds once and logs an issuer still unresolved at boot. Behaviour change: a misconfigured issuer no longer exits the process; JWTs get 503, the static bearer keeps working. internal/startupretry is now unused. 3. Metrics: authenticated REST requests were already labelled by route (the REST mux sets Pattern on the same *http.Request the middleware reads). Requests refused by auth never reached the REST mux and were labelled path="/". labelRESTPattern now sets the REST route's pattern before auth; unmatched paths keep "/", so the label set stays bounded. Closes #155 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-05 09:38:41 +02:00
mathias	cfe3f24e25	fix(ingestion): authenticate the REST API; confine ingest paths to brain/raw/ (#149) (#152) ... Co-authored-by: Mathias <mthbqv@gmail.com>	2026-10-03 14:38:07 +00:00