zqr10159 opened a new pull request, #4279:
URL: https://github.com/apache/hertzbeat/pull/4279
## What changed
- require an operator-controlled approval credential in production mode
- validate the registered client and redirect before approval
- authenticate confidential clients during token exchange
- bind authorization codes to their approved client and consume each code
once
- redact authorization data from request logging
- document the production environment requirement, loopback container
binding,
and TLS expectation for remote deployments
## User and operator impact
Production deployments must set `MCP_OAUTH_APPROVAL_SECRET` to at least 32
characters and enter it on the approval page. Development mode remains
zero-configuration.
## Validation
- `cargo test` — 86 passed
- `cargo clippy --all-targets --all-features -- -D warnings`
- `cargo fmt --all -- --check`
- `git diff --check`
AI assistance: used for draft implementation and test iteration.
Human validation: full mcp-bash-server unit suite, Clippy, rustfmt, and diff
checks passed with Rust 1.88.0.
Risk notes: this intentionally adds a production configuration requirement;
remote deployments should terminate TLS before forwarding OAuth endpoints.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
