This is an automated email from the ASF dual-hosted git repository. jamesbognar pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/juneau.git
commit 021994193951eaefff639b364717853ce900ed4f Author: James Bognar <[email protected]> AuthorDate: Sun Aug 16 15:33:34 2026 -0400 READY-384: Remove the MCP DCR requireSecure(false) plaintext escape hatch --- .../rest/client/mcp/auth/McpDynamicClientRegistrar.java | 14 +------------- .../client/mcp/auth/McpDynamicClientRegistrar_Test.java | 7 +++++++ 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/juneau-rest/juneau-rest-client-mcp-auth/src/main/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar.java b/juneau-rest/juneau-rest-client-mcp-auth/src/main/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar.java index 84eb649e65..7c892c40fb 100644 --- a/juneau-rest/juneau-rest-client-mcp-auth/src/main/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar.java +++ b/juneau-rest/juneau-rest-client-mcp-auth/src/main/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar.java @@ -102,7 +102,6 @@ public class McpDynamicClientRegistrar { boolean confidential; String clientName; Supplier<String> initialAccessTokenSupplier; - boolean requireSecure = true; Duration httpTimeout = DEFAULT_HTTP_TIMEOUT; Consumer<HTTPRequest> httpRequestConfigurator; @@ -254,17 +253,6 @@ public class McpDynamicClientRegistrar { return this; } - /** - * Whether to require the registration endpoint to use {@code https} (loopback exempt). Default <jk>true</jk>. - * - * @param value <jk>false</jk> to allow a plaintext registration endpoint (testing only). - * @return This object. - */ - public Builder requireSecure(boolean value) { - requireSecure = value; - return this; - } - /** * Sets the connect/read timeout applied to the registration request. Default 10 seconds. * @@ -303,7 +291,7 @@ public class McpDynamicClientRegistrar { throw isex("McpDynamicClientRegistrar requires applicationType(...) (SEP-837)"); if (redirectUris.isEmpty()) throw isex("McpDynamicClientRegistrar requires at least one redirectUri(...)"); - if (requireSecure && ! isSecureOrLoopback(registrationEndpoint)) + if (! isSecureOrLoopback(registrationEndpoint)) throw isex("McpDynamicClientRegistrar registration endpoint must use https (loopback exempt): " + registrationEndpoint); return new McpDynamicClientRegistrar(this); } diff --git a/juneau-rest/juneau-rest-client-mcp-auth/src/test/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar_Test.java b/juneau-rest/juneau-rest-client-mcp-auth/src/test/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar_Test.java index ee08186ef5..2656af6cc7 100644 --- a/juneau-rest/juneau-rest-client-mcp-auth/src/test/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar_Test.java +++ b/juneau-rest/juneau-rest-client-mcp-auth/src/test/java/org/apache/juneau/rest/client/mcp/auth/McpDynamicClientRegistrar_Test.java @@ -20,6 +20,7 @@ import static org.apache.juneau.BasicTestUtils.assertThrowsWithMessage; import static org.junit.jupiter.api.Assertions.*; import java.net.*; +import java.util.*; import org.apache.juneau.*; import org.junit.jupiter.api.*; @@ -81,6 +82,12 @@ class McpDynamicClientRegistrar_Test extends TestBase { .addRedirectUri(URI.create("http://127.0.0.1/callback";)).build()); } + @Test void a06_noRequireSecureEscapeHatch() { + var hasRequireSecure = Arrays.stream(McpDynamicClientRegistrar.Builder.class.getMethods()) + .anyMatch(m -> m.getName().equals("requireSecure")); + assertFalse(hasRequireSecure, "Builder must not expose a public requireSecure(...) escape hatch"); + } + // Request construction @Test void b01_emitsApplicationTypeNative() {
