ramu11 commented on PR #29592: URL: https://github.com/apache/camel/pull/29592#issuecomment-6794117142
Thanks @davsclaus for the follow-up review. I've addressed the remaining points in the latest commits. - Replaced `List.contains()`-based scope de-duplication with `LinkedHashSet` in both JWT validation and introspection, preserving insertion order and avoiding quadratic lookup. - Made JWT `scope`/`scp` array handling consistent with introspection by splitting whitespace-delimited values within individual array elements. Added test coverage for this case. - Moved the non-root `camel.server.path` validation from `DefaultMcpServerFactory` into `VertxMcpServerEngine`, where the actual selected platform HTTP context path is available. This also covers programmatically created bridges, not only Camel Main startup. Added a startup regression test. - Corrected the documentation to explain the RFC 9728 origin-root metadata discovery requirement and added the `camel-oauth` documentation link. - Added an explicit test assertion for nested OAuth claim immutability. The HTTPS-only resource URI requirement remains unchanged, as suggested. Any HTTP loopback exception can be considered separately in a follow-up JIRA. I reran the relevant build and test checks locally; all passed. The changes are pushed in: - `f0ceb80f7fc1` — `CAMEL-26356: Address remaining MCP OAuth review nits` - `94ec47ea846c` — `Regen` Thanks for the detailed review and guidance. Please take another look when convenient. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
