- Rename oauth-patterns.md to oauth-architecture-patterns.md for clarity
- Fix session-ownership.md test commands to run from mcp-server directory
- Update redisTransport.ts path reference to include mcp-server prefix
Simplified the repository to have a single OAuth pattern with separate auth and MCP servers at the top level. Preserved embedded OAuth documentation as an alternative pattern.
- Add express-rate-limit to custom endpoints for security:
- /introspect: 100 requests per 5 minutes
- /fakeupstreamauth/*: 20 requests per minute
- Static files: 25 requests per 10 minutes
- Add automated e2e testing npm scripts using concurrently:
- npm run test:e2e:integrated: Auto-starts server and runs test
- npm run test:e2e:separate: Auto-starts both servers and runs test
- Update README with automated testing approach documentation
- Update docs/streamable-http-design.md with current file structure
- Remove redundancy in README e2e testing documentation
- Verified: All tests, linting, and e2e scripts pass with rate limiting
- Update streamable-http-design.md with correct file references
- Reflect current dual transport architecture (SSE + Streamable HTTP)
- Update file paths to match actual implementation structure
- Clarify stateful session management approach
- Remove outdated research content, focus on current implementation
- Update tests to handle async session initialization
- Fix session ID retrieval from SSE/JSON responses
- Update DELETE request tests to match new behavior
- Remove references to deprecated startServerListeningToRedis
- Add proper waits for async operations
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
