mirror of
https://github.com/we-promise/sure.git
synced 2026-09-08 08:04:15 +00:00
WeekendsuperHero
be779fff08
* fix(mcp): accept native-app redirect URIs during OAuth DCR Dynamic client registration only allowed https and loopback http, so Cursor's cursor:// callback failed POST /register. One custom scheme in a mixed list (cursor:// + localhost + https) rejected the whole client. Accept RFC 8252 private-use schemes while still rejecting javascript/data/file and non-loopback http. PKCE and the consent screen remain in place. Loopback-only Cursor registrations already worked; this unblocks the default mixed payload. * fix(mcp): harden OAuth DCR redirect URI validation Reject empty trailing fragments (URI.parse yields "") that present? missed, and forbid tel/sms/intent handler schemes. Localize the invalid-redirect error_description. Native app schemes (cursor://, vscode://, reverse-domain) stay allowed. * test(mcp): cover native DCR token exchange and documented URIs Exchange the PKCE authorization code at /oauth/token in the native-app flow. Lock hosting docs to Cursor's desktop, loopback, and web callbacks and register each documented redirect URI. * docs(mcp): add method comments for OAuth DCR helpers CodeRabbit's docstring coverage check only counted comments on methods touched by the diff. Document create and the redirect URI helpers.