- Merge auth-server and mcp-server into unified architecture under src/modules/
- Add configurable auth modes: internal (single process) and external (separate processes)
- Update example scripts to support OAuth discovery and both auth modes
- Consolidate OAuth documentation into comprehensive implementation guide
- Add configuration options for development vs production deployments
- Support both Redis-backed and in-memory session storage
- Create docs/customization-guide.md with guidance on replacing demo functionality
- Add customization section to main README
- Fix all references to renamed oauth-architecture-patterns.md
- Update repository structure comments to clarify what to replace vs keep
Consolidate three redundant 'Production Replacement' sections into
a single canonical location in docs/oauth-architecture-patterns.md.
Both server READMEs now point to this guide.
- Add /health endpoint to docs/endpoints.md for MCP server
- Document degraded mode behavior in Common Issues section
- Update OAuth metadata endpoint to mention 503 responses
- Rename oauth-patterns.md to oauth-architecture-patterns.md for clarity
- Fix session-ownership.md test commands to run from mcp-server directory
- Update redisTransport.ts path reference to include mcp-server prefix
Simplified the repository to have a single OAuth pattern with separate auth and MCP servers at the top level. Preserved embedded OAuth documentation as an alternative pattern.
- Add express-rate-limit to custom endpoints for security:
- /introspect: 100 requests per 5 minutes
- /fakeupstreamauth/*: 20 requests per minute
- Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
- npm run test:e2e:integrated: Auto-starts server and runs test
- npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
- Update streamable-http-design.md with correct file references
- Reflect current dual transport architecture (SSE + Streamable HTTP)
- Update file paths to match actual implementation structure
- Clarify stateful session management approach
- Remove outdated research content, focus on current implementation
- Update tests to handle async session initialization
- Fix session ID retrieval from SSE/JSON responses
- Update DELETE request tests to match new behavior
- Remove references to deprecated startServerListeningToRedis
- Add proper waits for async operations
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
