From c0b8b26d032ec3ab6f0a2691c44cea0dbd215309 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 14 Sep 2026 20:58:32 +0200 Subject: [PATCH] feat(auth): export Fingerprint for servers with their own accepted path gitea-mcp's PAT pass-through authenticates ahead of BearerMiddleware and emits its own `mcp auth accepted` line (gitea-mcp#60). It needs the same fingerprint, not an equivalent one: two different fingerprints for the same token across two log lines cannot be correlated, which is the entire purpose of the field. Co-Authored-By: Claude Opus 5 --- auth/bearer.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/auth/bearer.go b/auth/bearer.go index 85d0cac..3761223 100644 --- a/auth/bearer.go +++ b/auth/bearer.go @@ -176,6 +176,15 @@ func tokenType(raw string) string { } } +// Fingerprint is the exported form, for servers that authenticate on a path this +// middleware does not own — gitea-mcp's PAT pass-through, which runs ahead of +// BearerMiddleware and emits its own `mcp auth accepted` line. +// +// Exported rather than reimplemented per consumer: two different fingerprints +// for the same token across two log lines cannot be correlated, which is the +// entire purpose of the field. +func Fingerprint(raw string) string { return fingerprint(raw) } + // fingerprint is a short, non-reversible correlator (truncated SHA-256) so ops // can group repeated attempts from one client without ever logging token bytes. func fingerprint(raw string) string {