Merge branch 'main' into fix/deep-link-dedupe-status-throttle

Author: its-mash

Cargo.lock

@@ -13,9 +13,14 @@ mod startup;
 mod state;
 
 // Exposed for integration tests that mount these routes against a real
-// ServiceContainer (e.g. asserting the OAuth-discovery endpoints 404 when
-// inbound auth is disabled). AppState is also used throughout this module.
-pub use handlers::{oauth_metadata, resource_metadata, AppState};
+// ServiceContainer — e.g. asserting the OAuth-discovery endpoints 404 when
+// inbound auth is disabled, and driving the full inbound OAuth flow
+// (register → authorize → consent → token → authenticated /mcp) end to end.
+// AppState is also used throughout this module.
+pub use handlers::{
+    oauth_authorize, oauth_consent_approve, oauth_metadata, oauth_register, oauth_token,
+    resource_metadata, AppState,
+};
 
 pub use dependencies::{DependenciesBuilder, GatewayDependencies};
 pub use handlers::PendingAuthorization;

crates/mcpmux-gateway/src/server/mod.rs

@@ -46,6 +46,11 @@ reqwest = { version = "0.13", features = ["json"] }
 # URL parsing for OAuth tests
 url = "2.5"
 
+# PKCE + JWT-secret material for the inbound-OAuth end-to-end test
+base64 = "0.22"
+sha2 = "0.10"
+zeroize = "1.8"
+
 # Sync primitives for tests
 parking_lot = "0.12"
 

tests/rust/Cargo.toml

@@ -133,6 +133,12 @@ impl Harness {
                 "/.well-known/oauth-protected-resource",
                 get(resource_metadata),
             )
+            // RFC 9728 resource-specific variant — this is the one editors like
+            // VS Code probe first (`/.well-known/oauth-protected-resource/mcp`).
+            .route(
+                "/.well-known/oauth-protected-resource/mcp",
+                get(resource_metadata),
+            )
             .route(
                 "/.well-known/oauth-authorization-server",
                 get(oauth_metadata),
@@ -211,8 +217,12 @@ async fn authless_gateway_does_not_advertise_oauth_discovery() {
     // without a token.
     let h = Harness::start(true).await;
     let client = reqwest::Client::new();
+    // Includes the RFC 9728 `/mcp` sub-path — the endpoint VS Code probes first
+    // (its 200 was what pushed editors into an OAuth flow against an authless
+    // gateway, leaving them stuck waiting on `initialize`).
     for path in [
         "/.well-known/oauth-protected-resource",
+        "/.well-known/oauth-protected-resource/mcp",
         "/.well-known/oauth-authorization-server",
     ] {
         let resp = client
@@ -230,12 +240,24 @@ async fn authless_gateway_does_not_advertise_oauth_discovery() {
 
 #[tokio::test]
 async fn auth_required_gateway_advertises_oauth_discovery() {
-    // The default (auth required) still serves discovery so real OAuth works.
+    // The default (auth required) still serves discovery so real OAuth works —
+    // every endpoint, including the RFC 9728 sub-path.
     let h = Harness::start(false).await;
-    let resp = reqwest::Client::new()
-        .get(format!("{}/.well-known/oauth-protected-resource", h.base))
-        .send()
-        .await
-        .expect("request");
-    assert_eq!(resp.status(), reqwest::StatusCode::OK);
+    let client = reqwest::Client::new();
+    for path in [
+        "/.well-known/oauth-protected-resource",
+        "/.well-known/oauth-protected-resource/mcp",
+        "/.well-known/oauth-authorization-server",
+    ] {
+        let resp = client
+            .get(format!("{}{path}", h.base))
+            .send()
+            .await
+            .expect("request");
+        assert_eq!(
+            resp.status(),
+            reqwest::StatusCode::OK,
+            "{path} must be served when auth is required"
+        );
+    }
 }