mathias/hyperguild
1
0
Fork 0
Code Issues 30 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix(ingestion): bump mcp-chassis to v0.7.1; label refused REST requests by route (#155) #181

Merged
mathias merged 2 commits from w3/155-chassis-bump into main 2026-10-05 14:40:20 +00:00
Conversation 2 Commits 2 Files Changed 10
+174 -290
2 Commits
Author SHA1 Message Date
mathiasandClaude Opus 5.5 e05a13ab08 test(ingestion): assert the bare token is absent from both auth log lines
CI / Lint / Test / Vet (pull_request) Successful in 1m8s
Details
CI / Mirror to GitHub (pull_request) Skipped
Details 
PR #181 review (comment 15483):
- TestBuildMuxLogsARESTAuthRejection asserted only that the "Bearer <tok>"
  header form was absent, which a field-logging chassis could never emit.
  Replaced by TestBuildMuxRejectionLogLineOmitsTheBarePresentedToken (a
  sentinel wrong token; neither it nor the static token may appear) and
  TestBuildMuxAcceptedLogLineOmitsTheBareStaticToken. A local chassis
  v0.7.1 copy logging rawToken as token_fp (deny, then accept) turns each red.
- labelRESTPattern doc: the label bound holds for refused requests only;
  the authenticated-404 raw-path gap is hyperguild#185.
- Remove internal/startupretry: nothing imports it since the chassis bump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 16:31:11 +02:00
mathiasandClaude Opus 5.5 474473c99f fix(ingestion): bump mcp-chassis to v0.7.1; label refused REST requests by route
CI / Lint / Test / Vet (pull_request) Successful in 54s
Details
CI / Mirror to GitHub (pull_request) Skipped
Details 
1. Rejections are logged. chassis v0.2.0 refused without a log line, so
   since #149 an unknown REST caller got silent 401s. v0.7.1 writes
   `mcp auth rejected` (reason, remote, token fingerprint, path) and
   `mcp auth accepted` per authenticated request. Tested through
   buildMux.

2. Fallout: since chassis v0.7 (mcp-chassis#4) NewJWTValidator no longer
   fails on OIDC discovery; the issuer resolves lazily and a JWT gets
   503-and-retry until it does. #83's boot retry loop therefore never
   retried, and its tests failed. buildJWTValidator now builds once and
   logs an issuer still unresolved at boot. Behaviour change: a
   misconfigured issuer no longer exits the process; JWTs get 503, the
   static bearer keeps working. internal/startupretry is now unused.

3. Metrics: authenticated REST requests were already labelled by route
   (the REST mux sets Pattern on the same *http.Request the middleware
   reads). Requests refused by auth never reached the REST mux and were
   labelled path="/". labelRESTPattern now sets the REST route's pattern
   before auth; unmatched paths keep "/", so the label set stays bounded.

Closes #155

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-05 09:38:41 +02:00