Merge remote-tracking branch 'origin/main' into feat/workspace-root-routing

# Conflicts:
#	crates/mcpmux-gateway/src/oauth/dcr.rs

Author: its-mash

.github/workflows/e2e-desktop.yml

@@ -131,16 +131,54 @@ jobs:
         if: matrix.os == 'windows-latest'
         shell: pwsh
         run: |
-          # Tauri uses the WebView2 runtime, not Edge directly.
-          # msedgedriver must match the WebView2 runtime version, not the Edge browser version.
+          # Tauri uses the WebView2 runtime, not Edge directly, so msedgedriver must be
+          # compatible with the WebView2 runtime (matching the major version is sufficient).
+          # Microsoft does not publish a driver for every exact runtime build, so try the
+          # exact version first, then fall back to the latest driver for the same major
+          # version, then LATEST_STABLE. This keeps the job from breaking whenever the
+          # runner's WebView2 build outpaces the published Edge drivers.
+          $ErrorActionPreference = 'Stop'
           $wv2Key = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}'
           if (-not (Test-Path $wv2Key)) { $wv2Key = 'HKLM:\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}' }
           $wv2Version = (Get-ItemProperty $wv2Key).pv
-          Write-Host "WebView2 runtime version: $wv2Version"
-          $driverUrl = "https://msedgewebdriverstorage.blob.core.windows.net/edgewebdriver/$wv2Version/edgedriver_win64.zip"
+          $wv2Major = $wv2Version.Split('.')[0]
+          Write-Host "WebView2 runtime version: $wv2Version (major $wv2Major)"
+
+          # Microsoft locked down the old msedgewebdriverstorage blob (now returns HTTP 409
+          # "Public access is not permitted"); the current host is msedgedriver.microsoft.com.
+          $base = "https://msedgedriver.microsoft.com"
+
+          # Ordered list of candidate driver versions to try.
+          $candidates = [System.Collections.Generic.List[string]]::new()
+          $candidates.Add($wv2Version)
+          foreach ($marker in @("LATEST_RELEASE_${wv2Major}_WINDOWS", "LATEST_STABLE")) {
+            try {
+              $resolved = (Invoke-WebRequest -UseBasicParsing -Uri "$base/$marker").Content
+              # Markers are UTF-16/BOM encoded; keep only version characters.
+              $resolved = ($resolved -replace '[^0-9\.]', '').Trim()
+              if ($resolved) { $candidates.Add($resolved); Write-Host "marker $marker -> $resolved" }
+            } catch {
+              Write-Host "marker $marker unavailable: $($_.Exception.Message)"
+            }
+          }
+
           $zipPath = "$env:TEMP\edgedriver.zip"
           $extractDir = "$env:TEMP\edgedriver"
-          Invoke-WebRequest -Uri $driverUrl -OutFile $zipPath
+          $ok = $false
+          foreach ($v in ($candidates | Select-Object -Unique)) {
+            $driverUrl = "$base/$v/edgedriver_win64.zip"
+            Write-Host "Trying EdgeDriver $v -> $driverUrl"
+            try {
+              Invoke-WebRequest -UseBasicParsing -Uri $driverUrl -OutFile $zipPath
+              Write-Host "Downloaded EdgeDriver $v"
+              $ok = $true
+              break
+            } catch {
+              Write-Host "  not available: $($_.Exception.Message)"
+            }
+          }
+          if (-not $ok) { throw "No compatible msedgedriver found for WebView2 $wv2Version (tried: $($candidates -join ', '))" }
+
           Expand-Archive -Path $zipPath -DestinationPath $extractDir -Force
           $driverDir = "$extractDir\edgedriver_win64"
           if (-not (Test-Path "$driverDir\msedgedriver.exe")) { $driverDir = $extractDir }

crates/mcpmux-gateway/src/pool/oauth.rs

@@ -1654,3 +1654,54 @@ impl Default for OutboundOAuthManager {
         Self::new()
     }
 }
+
+#[cfg(test)]
+mod resource_param_tests {
+    use rmcp::transport::auth::{AuthorizationManager, AuthorizationMetadata};
+
+    /// The gateway delegates authorize-URL construction entirely to rmcp's
+    /// `AuthorizationManager::get_authorization_url` (via `create_auth_manager` /
+    /// `start_oauth_flow`). rmcp appends the RFC 8707 `resource` parameter itself, so the
+    /// gateway must NOT add a second one. This guards against re-introducing the removed
+    /// `add_resource_parameter` wrapper, which produced `?resource=...&resource=...` —
+    /// rejected by strict authorization servers (e.g. Supabase) and broke OAuth login.
+    #[tokio::test]
+    async fn authorize_url_has_exactly_one_resource_param() {
+        let base_url = "https://mcp.example.test/";
+
+        let mut manager = AuthorizationManager::new(base_url)
+            .await
+            .expect("construct AuthorizationManager");
+
+        manager.set_metadata(AuthorizationMetadata {
+            authorization_endpoint: "https://auth.example.test/authorize".to_string(),
+            token_endpoint: "https://auth.example.test/token".to_string(),
+            response_types_supported: Some(vec!["code".to_string()]),
+            code_challenge_methods_supported: Some(vec!["S256".to_string()]),
+            ..Default::default()
+        });
+        manager
+            .configure_client_id("test-client")
+            .expect("configure client id");
+
+        let auth_url = manager
+            .get_authorization_url(&["openid"])
+            .await
+            .expect("generate authorization url");
+
+        let parsed = url::Url::parse(&auth_url).expect("authorize url should parse");
+        let resource_values: Vec<String> = parsed
+            .query_pairs()
+            .filter(|(k, _)| k == "resource")
+            .map(|(_, v)| v.into_owned())
+            .collect();
+
+        assert_eq!(
+            resource_values.len(),
+            1,
+            "authorize URL must carry exactly one RFC 8707 resource param, \
+             got {resource_values:?} in {auth_url}"
+        );
+        assert_eq!(resource_values[0], base_url);
+    }
+}