fix(oauth,services): port #152 — DCR redirect URI tolerance + clippy

Cherry-picks the two changes from upstream PR #152 (#152)
since `feat/workspace-root-routing` (PR #151, this branch's base) reworked
`dcr.rs` extensively and a direct merge would conflict.

- `validate_redirect_uris` now skips invalid URIs with a warn log and only
  fails registration when zero valid URIs remain. Unblocks Cursor 3.4.20,
  which sends a mixed-validity list (`cursor://`, `https://www.cursor.com`,
  `http://localhost`) in a single DCR request.
- `PrefixCacheService` uses `sort_by_key` for the `created_at` sort so
  `clippy::unnecessary_sort_by` doesn't fail `cargo clippy -D warnings`.

Adds two tests covering the mixed-validity case and the all-invalid case.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

crates/mcpmux-gateway/src/oauth/dcr.rs

@@ -227,6 +227,8 @@ pub fn validate_redirect_uris(uris: &[String]) -> Result<(), DcrError> {
         ));
     }
 
+    let mut valid_count = 0;
+
     for uri in uris {
         let is_loopback = uri.starts_with("http://127.0.0.1")
             || uri.starts_with("http://localhost")
@@ -237,20 +239,28 @@ pub fn validate_redirect_uris(uris: &[String]) -> Result<(), DcrError> {
         let is_custom_scheme = !uri.starts_with("http://") && !uri.starts_with("https://");
 
         if !is_loopback && !is_custom_scheme {
+            // Skip invalid URIs (e.g. https://www.cursor.com/agents/mcp/oauth/callback)
+            // rather than rejecting the entire registration — clients like Cursor send a
+            // mix of valid and invalid URIs and only ever use the valid ones in practice.
             warn!(
-                "[DCR] Rejected redirect_uri: {} (must be loopback or custom scheme)",
+                "[DCR] Skipping invalid redirect_uri: {} (must be loopback or custom scheme)",
                 uri
             );
-            return Err(DcrError::invalid_redirect_uri(
-                "Redirect URI must be loopback (http://127.0.0.1 or http://localhost) \
-                 or a custom URL scheme (e.g., cursor://, vscode://)",
-            ));
+            continue;
         }
 
         debug!(
             "[DCR] Validated redirect_uri: {} (loopback={}, custom_scheme={})",
             uri, is_loopback, is_custom_scheme
         );
+        valid_count += 1;
+    }
+
+    if valid_count == 0 {
+        return Err(DcrError::invalid_redirect_uri(
+            "No valid redirect_uris provided — must include at least one loopback \
+             (http://127.0.0.1 or http://localhost) or custom URL scheme (e.g., cursor://, vscode://)",
+        ));
     }
 
     Ok(())
@@ -462,6 +472,29 @@ mod tests {
         assert!(validate_redirect_uris(&["https://example.com/callback".to_string()]).is_err());
     }
 
+    #[test]
+    fn test_mixed_valid_and_invalid_uris_pass() {
+        // Real-world case: Cursor sends a mix of valid (custom scheme + loopback) and
+        // invalid (https) URIs. Registration must succeed as long as at least one valid
+        // URI is present — otherwise clients that send any non-loopback HTTPS URI cannot
+        // register at all.
+        let uris = vec![
+            "cursor://anysphere.cursor-mcp/oauth/callback".to_string(),
+            "https://www.cursor.com/agents/mcp/oauth/callback".to_string(),
+            "http://localhost:8787/callback".to_string(),
+        ];
+        assert!(validate_redirect_uris(&uris).is_ok());
+    }
+
+    #[test]
+    fn test_all_invalid_uris_fail() {
+        let uris = vec![
+            "https://www.cursor.com/agents/mcp/oauth/callback".to_string(),
+            "http://example.com/callback".to_string(),
+        ];
+        assert!(validate_redirect_uris(&uris).is_err());
+    }
+
     #[test]
     fn loopback_ignores_port_per_rfc_8252() {
         // Registered with one port, requested with another — must match.

crates/mcpmux-gateway/src/services/prefix_cache.rs

@@ -138,7 +138,7 @@ impl PrefixCacheService {
 
         // Sort by created_at (earliest first)
         // TODO: Add verified status priority when registry supports it
-        servers.sort_by(|a, b| a.created_at.cmp(&b.created_at));
+        servers.sort_by_key(|a| a.created_at);
 
         // Clear existing cache for this space
         self.clear_space(space_id).await;