adityamparikh opened a new pull request, #137:
URL: https://github.com/apache/solr-mcp/pull/137
## Summary
Adds `@McpPrompt` endpoints for the canonical Solr workflows and the
matching `@McpComplete` plumbing for both resource-template and prompt-argument
completion, plus a small native-http boot fix that surfaced during integration
testing.
This consolidates work that lived in two fork-only PRs
(adityamparikh/solr-mcp#86 + #87) plus the prompt-arg completion gap that only
shows up once the two are combined: `@McpComplete` was only bound to the schema
resource template, so MCP Inspector's `completion/complete` with a `ref/prompt`
reference (e.g. `search-collection`) returned `-32602
AsyncCompletionSpecification not found`.
## What's in this PR
**MCP prompts** — guided workflows for the canonical Solr operations:
- `explore-collections`, `setup-collection` (CollectionService)
- `search-collection` (SearchService)
- `index-data` (IndexingService)
- `view-schema`, `design-schema` (SchemaService)
Every prompt has `@PreAuthorize("isAuthenticated()")` so http-mode security
applies; a registration test enforces that going forward.
**Resource-template completion** — `@McpComplete(uri =
"solr://{collection}/schema")` filters collection names by the user-typed
prefix (case-insensitive), sorts, and caps results at 100 so the suggestion
list stays usable on large clusters.
**Prompt-argument completion** — `@McpComplete(prompt = ...)` handlers for
every prompt that takes a `collection` argument (`search-collection`,
`index-data`, `view-schema`, `design-schema`). Each delegates to the existing
`completeCollection` logic so behavior, sort order, and the 100-result cap are
shared. `setup-collection` (new-name arg) and `explore-collections` (no args)
intentionally have no binding.
**`PromptNames` constants class** — both `@McpPrompt(name = …)` and
`@McpComplete(prompt = …)` reference the same `public static final String`
constant, so a typo or rename surfaces as a compile error instead of a silent
runtime `-32602`. The registration test asserts the expected set of completion
bindings against those same constants.
**Annotation formatting + behavior-hint audit** — Spotless's Eclipse JDT
formatter is configured to render multi-argument annotations one-arg-per-line
(`alignment_for_arguments_in_annotation=48`, no force flag, so single-arg
annotations stay inline). Behavior-hint audit corrected two missing hints —
`add-fields` and `add-field-types` now declare `destructiveHint = false`
because they're additive-only schema operations.
**Native-http boot fix** — `015eedd` (secure-by-default) interacted badly
with Spring AOT: `@ConditionalOnProperty(http.security.enabled,
matchIfMissing=true)` is evaluated at AOT build time, so the secured
`SecurityFilterChain` bean is always selected in the native binary, and
`McpServerOAuth2Configurer.init()` builds `NimbusJwtDecoder` eagerly against
the configured issuer URL — crashing native-http boot whenever the placeholder
`https://your-auth0-domain.auth0.com/` default was in effect. JVM mode wasn't
affected because its conditional runs at startup.
Three coordinated changes:
- `application-http.properties` — drop the placeholder Auth0 default; unset
`OAUTH2_ISSUER_URI` now resolves to empty.
- `HttpSecurityConfiguration` — guard the `.with(McpServerOAuth2Configurer
...)` call with `StringUtils.hasText(issuerUrl)`. With no issuer set, every
non-`permitAll()` endpoint still falls through to Spring Security's default
401/403, just without a bearer-token validator.
- `DockerImageHttpIntegrationTest` — comment documents the runtime-guard
contract; no `HTTP_SECURITY_ENABLED=false` override needed (it would be
ineffective in native anyway).
## Test plan
- [x] `./gradlew build` — green locally.
- [x] `./gradlew bootBuildImage -Pnative -Pprofile=http` + manual `docker
run` — `/actuator/health` returns `{"status":"UP"}` with no `OAUTH2_ISSUER_URI`
(previously crashed with "Unable to resolve the Configuration with the provided
Issuer").
- [x] `McpToolRegistrationTest` —
`testCollectionCompletionsCoverSchemaResourceAndCollectionTakingPrompts`
asserts one `uri` binding + four `prompt` bindings via `PromptNames` constants;
`everyMcpEndpointIsPreAuthorized` enforces `@PreAuthorize` on every MCP entry
point.
- [x] `McpClientIntegrationTest` / `McpClientStdioIntegrationTest` — new
end-to-end tests exercise `PromptReference("search-collection")` and
`PromptReference("view-schema")` against a real `McpSyncClient` and
Testcontainers Solr. Both transports pass (39/39).
- [x] CI matrix on the fork (build-and-publish + native stdio + native http)
— green after the native-http fix.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
