mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-10-25 22:10:25 +00:00
xarmian
681780486f
Dave's ruling on TASK-3345 #1: a missing `resource` parameter is defaulted to /mcp's canonical audience, which lets a client registered through DCR replay a token cross-server. Phase 2, a release later, refuses such requests with invalid_target. Phase 1 measures who that would break, and changes no behaviour. - translateResourceToAudience now reports whether it DEFAULTED a missing resource. The authorize, decide and token handlers then call noteResourceMissing. - noteResourceMissing logs one WARN line naming the endpoint, client_id and the client's registered name, and increments the new pad_oauth_resource_missing_total{endpoint}. The label is the endpoint only, so cardinality stays bounded; the client is in the log. - Legs: with resource, nothing is counted; without, the request is still served and counted at authorize, decide and token. Mutants L1-L5 killed. Claude-Session: https://claude.ai/code/session_01H63zaWhkb5pAafx2WGjrVC