FreeOnePlus opened a new pull request, #116: URL: https://github.com/apache/doris-mcp-server/pull/116
## Summary - validate external OAuth access tokens with trusted RFC 7662 introspection before userinfo - enforce active, issuer, audience/resource, lifetime, subject, and required-scope checks while retaining only configured scopes - send the RFC 8707 resource indicator on authorization-code and refresh requests - add fail-closed configuration, deployment documentation, and a 2 issuer x 2 resource x 3 scope matrix ## Testing - [x] SEC-007 focused tests: 38 passed - [x] protocol matrix: 18 passed (10 Streamable HTTP, 6 real subprocess Stdio, 2 multiworker) - [x] real Doris transport matrix: 4 passed (Streamable HTTP and real subprocess Stdio) - [x] real Doris cleanup: 0 temporary tables, 0 temporary users - [x] full pytest: 454 passed, 61 skipped - [x] uv lock --check, compileall, uv build, wheel/sdist content checks - [x] new files strict Ruff/format; legacy changed-file baseline has no new findings -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
