CI is red on `main` and on every open PR (including the Dependabot PRs #1531, #1552–#1554) with: ``` panic: file requires newer Go version go1.27 (application built with go1.26) golangci-lint exit with code 2 ``` ## Cause `actions/setup-go` with `go-version: 'stable'` started resolving to **go1.27.0**. The pinned golangci-lint **v2.11.4** release binary is built with **go1.26**, and its `go/types` refuses to typecheck source files declaring a newer language version. Nothing in the failing PRs is at fault. ## Fix Bump to **golangci-lint v2.13.1**, whose release binaries are built with go1.27, so linting works under `stable` again. That bump also pulls in newer linter versions, which surface 57 findings this tree did not have before. Handled as follows: | Linter | Count | Resolution | |---|---|---| | `goconst` | 50 | 39 were repeated literals in `_test.go` files — goconst started counting those in v2.12.0 (golangci-lint#6480 exposed `ignore-tests`). Fixture data like `"1.0.0"` (89 occurrences) is not a missing constant, so `goconst.ignore-tests: true`. The other 11 were real duplication in production code (OpenAPI tags, the `bearer` security scheme name, `$ref`, `http`/`https`) and became named constants. | | `gosec` G710 | 1 | **True positive, fixed.** See below. | | `staticcheck` SA1019 | 6 | Go 1.26 deprecated `ecdsa.PublicKey.X/Y` and `PrivateKey.D`. Annotated with the same targeted `nolint` + rationale already used for `ScalarBaseMult` in `cmd/publisher/auth/common.go`. | ### The open redirect is real `TrailingSlashMiddleware` copied the entire `*url.URL` before rewriting the path. For an absolute-form request URI — legal for a Go HTTP server to parse, e.g. `GET http://evil.com/foo/ HTTP/1.1` — `r.URL.Scheme` and `r.URL.Host` are populated, and they were echoed straight back in the `Location` header. The redirect target is now built from the cleaned path and query alone. The existing `path.Clean` hardening for GHSA-v8vw-gw5j-w7m6 (protocol-relative `//evil.com/`) is unchanged. ### Also Switched `gomodguard` → `gomodguard_v2`; the former is deprecated as of v2.12.0 and was emitting a warning on every run. ## Verification - `golangci-lint v2.13.1` against this tree: **0 issues**, no deprecation warnings - `make validate`: all validations passed - `go build ./...` and tests for every touched package pass (DB-backed tests need Postgres; left to CI) ## Note on migrating the ecdsa key paths Moving those six sites to `PublicKey.Bytes` / `ParseUncompressedPublicKey` / `crypto/ecdh` touches key parsing and signature verification. It should be its own reviewed PR rather than riding along on a CI unblock. Happy to open one. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
237 lines
9.1 KiB
Go
237 lines
9.1 KiB
Go
package v0
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"log"
|
|
"net/http"
|
|
"net/url"
|
|
"reflect"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/danielgtaylor/huma/v2"
|
|
"github.com/modelcontextprotocol/registry/internal/database"
|
|
"github.com/modelcontextprotocol/registry/internal/service"
|
|
apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0"
|
|
)
|
|
|
|
const errRecordNotFound = "record not found"
|
|
|
|
// OptionalBool tracks whether a bool query parameter was explicitly set
|
|
type OptionalBool struct {
|
|
Value bool
|
|
IsSet bool
|
|
}
|
|
|
|
// Schema implements huma.SchemaProvider - returns schema for the wrapped type
|
|
func (o OptionalBool) Schema(r huma.Registry) *huma.Schema {
|
|
return huma.SchemaFromType(r, reflect.TypeOf(o.Value))
|
|
}
|
|
|
|
// Receiver implements huma.ParamWrapper - exposes wrapped value to receive parsed value
|
|
func (o *OptionalBool) Receiver() reflect.Value {
|
|
return reflect.ValueOf(o).Elem().Field(0)
|
|
}
|
|
|
|
// OnParamSet implements huma.ParamReactor - tracks whether parameter was set in request
|
|
func (o *OptionalBool) OnParamSet(isSet bool, _ any) {
|
|
o.IsSet = isSet
|
|
}
|
|
|
|
// resolveIncludeDeleted handles the include_deleted parameter logic for list endpoints
|
|
// Returns the resolved value and an error if include_deleted=false conflicts with updated_since
|
|
func resolveIncludeDeleted(includeDeleted OptionalBool, hasUpdatedSince bool) (bool, error) {
|
|
if hasUpdatedSince {
|
|
// When updated_since is provided, include_deleted must be true for incremental sync
|
|
if includeDeleted.IsSet && !includeDeleted.Value {
|
|
return false, huma.Error400BadRequest("Cannot set include_deleted=false when using updated_since (incremental sync requires deleted servers)")
|
|
}
|
|
return true, nil
|
|
}
|
|
// Use provided value, defaults to false if not set
|
|
return includeDeleted.Value, nil
|
|
}
|
|
|
|
// ListServersInput represents the input for listing servers
|
|
type ListServersInput struct {
|
|
Cursor string `query:"cursor" doc:"Pagination cursor" required:"false" example:"server-cursor-123"`
|
|
Limit int `query:"limit" doc:"Number of items per page" default:"30" minimum:"1" maximum:"100" example:"50"`
|
|
UpdatedSince string `query:"updated_since" doc:"Filter servers updated since timestamp (RFC3339 datetime)" required:"false" example:"2025-08-07T13:15:04.280Z"`
|
|
Search string `query:"search" doc:"Search servers by name (substring match)" required:"false" example:"filesystem"`
|
|
Version string `query:"version" doc:"Filter by version ('latest' for latest version, or an exact version like '1.2.3')" required:"false" example:"latest"`
|
|
IncludeDeleted OptionalBool `query:"include_deleted" doc:"Include deleted servers in results (default: false, but always true when updated_since is provided)" required:"false"`
|
|
}
|
|
|
|
// ServerDetailInput represents the input for getting server details
|
|
type ServerDetailInput struct {
|
|
ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"`
|
|
}
|
|
|
|
// ServerVersionDetailInput represents the input for getting a specific version
|
|
type ServerVersionDetailInput struct {
|
|
ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"`
|
|
Version string `path:"version" doc:"URL-encoded server version" example:"1.0.0"`
|
|
IncludeDeleted bool `query:"include_deleted" doc:"Include deleted servers in results (default: false)" required:"false" default:"false"`
|
|
}
|
|
|
|
// ServerVersionsInput represents the input for listing all versions of a server
|
|
type ServerVersionsInput struct {
|
|
ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"`
|
|
IncludeDeleted bool `query:"include_deleted" doc:"Include deleted servers in results (default: false)" required:"false" default:"false"`
|
|
}
|
|
|
|
// RegisterServersEndpoints registers all server-related endpoints with a custom path prefix
|
|
func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service.RegistryService) {
|
|
// List servers endpoint
|
|
huma.Register(api, huma.Operation{
|
|
OperationID: "list-servers" + strings.ReplaceAll(pathPrefix, "/", "-"),
|
|
Method: http.MethodGet,
|
|
Path: pathPrefix + "/servers",
|
|
Summary: "List MCP servers",
|
|
Description: "Get a paginated list of MCP servers from the registry",
|
|
Tags: []string{tagServers},
|
|
}, func(ctx context.Context, input *ListServersInput) (*Response[apiv0.ServerListResponse], error) {
|
|
// Build filter from input parameters
|
|
filter := &database.ServerFilter{}
|
|
|
|
// Parse updated_since parameter
|
|
if input.UpdatedSince != "" {
|
|
// Parse RFC3339 format
|
|
if updatedTime, err := time.Parse(time.RFC3339, input.UpdatedSince); err == nil {
|
|
filter.UpdatedSince = &updatedTime
|
|
} else {
|
|
return nil, huma.Error400BadRequest("Invalid updated_since format: expected RFC3339 timestamp (e.g., 2025-08-07T13:15:04.280Z)")
|
|
}
|
|
}
|
|
|
|
// Handle search parameter
|
|
if input.Search != "" {
|
|
filter.SubstringName = &input.Search
|
|
}
|
|
|
|
// Handle version parameter
|
|
if input.Version != "" {
|
|
if input.Version == "latest" {
|
|
// Special case: filter for latest versions
|
|
isLatest := true
|
|
filter.IsLatest = &isLatest
|
|
} else {
|
|
// Future: exact version matching
|
|
filter.Version = &input.Version
|
|
}
|
|
}
|
|
|
|
// Handle include_deleted parameter
|
|
includeDeleted, err := resolveIncludeDeleted(input.IncludeDeleted, filter.UpdatedSince != nil)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
filter.IncludeDeleted = &includeDeleted
|
|
|
|
// Get paginated results with filtering
|
|
servers, nextCursor, err := registry.ListServers(ctx, filter, input.Cursor, input.Limit)
|
|
if err != nil {
|
|
return nil, ListServersError(ctx, err)
|
|
}
|
|
|
|
// Convert []*ServerResponse to []ServerResponse
|
|
serverValues := make([]apiv0.ServerResponse, len(servers))
|
|
for i, server := range servers {
|
|
serverValues[i] = *server
|
|
}
|
|
|
|
return &Response[apiv0.ServerListResponse]{
|
|
Body: apiv0.ServerListResponse{
|
|
Servers: serverValues,
|
|
Metadata: apiv0.Metadata{
|
|
NextCursor: nextCursor,
|
|
Count: len(servers),
|
|
},
|
|
},
|
|
}, nil
|
|
})
|
|
|
|
// Get specific server version endpoint (supports "latest" as special version)
|
|
huma.Register(api, huma.Operation{
|
|
OperationID: "get-server-version" + strings.ReplaceAll(pathPrefix, "/", "-"),
|
|
Method: http.MethodGet,
|
|
Path: pathPrefix + "/servers/{serverName}/versions/{version}",
|
|
Summary: "Get specific MCP server version",
|
|
Description: "Get detailed information about a specific version of an MCP server. Use the special version 'latest' to get the latest version.",
|
|
Tags: []string{tagServers},
|
|
}, func(ctx context.Context, input *ServerVersionDetailInput) (*Response[apiv0.ServerResponse], error) {
|
|
// URL-decode the server name
|
|
serverName, err := url.PathUnescape(input.ServerName)
|
|
if err != nil {
|
|
return nil, huma.Error400BadRequest("Invalid server name encoding", err)
|
|
}
|
|
|
|
// URL-decode the version
|
|
version, err := url.PathUnescape(input.Version)
|
|
if err != nil {
|
|
return nil, huma.Error400BadRequest("Invalid version encoding", err)
|
|
}
|
|
|
|
var serverResponse *apiv0.ServerResponse
|
|
// Handle "latest" as a special version
|
|
if version == "latest" {
|
|
serverResponse, err = registry.GetServerByName(ctx, serverName, input.IncludeDeleted)
|
|
} else {
|
|
serverResponse, err = registry.GetServerByNameAndVersion(ctx, serverName, version, input.IncludeDeleted)
|
|
}
|
|
|
|
if err != nil {
|
|
if err.Error() == errRecordNotFound || errors.Is(err, database.ErrNotFound) {
|
|
return nil, huma.Error404NotFound("Server not found")
|
|
}
|
|
log.Printf("get server details (%q/%q) failed: %v", serverName, version, err)
|
|
return nil, huma.Error500InternalServerError("Failed to get server details")
|
|
}
|
|
|
|
return &Response[apiv0.ServerResponse]{
|
|
Body: *serverResponse,
|
|
}, nil
|
|
})
|
|
|
|
// Get server versions endpoint
|
|
huma.Register(api, huma.Operation{
|
|
OperationID: "get-server-versions" + strings.ReplaceAll(pathPrefix, "/", "-"),
|
|
Method: http.MethodGet,
|
|
Path: pathPrefix + "/servers/{serverName}/versions",
|
|
Summary: "Get all versions of an MCP server",
|
|
Description: "Get all available versions for a specific MCP server",
|
|
Tags: []string{tagServers},
|
|
}, func(ctx context.Context, input *ServerVersionsInput) (*Response[apiv0.ServerListResponse], error) {
|
|
// URL-decode the server name
|
|
serverName, err := url.PathUnescape(input.ServerName)
|
|
if err != nil {
|
|
return nil, huma.Error400BadRequest("Invalid server name encoding", err)
|
|
}
|
|
|
|
// Get all versions for this server
|
|
servers, err := registry.GetAllVersionsByServerName(ctx, serverName, input.IncludeDeleted)
|
|
if err != nil {
|
|
if err.Error() == errRecordNotFound || errors.Is(err, database.ErrNotFound) {
|
|
return nil, huma.Error404NotFound("Server not found")
|
|
}
|
|
log.Printf("get server versions (%q) failed: %v", serverName, err)
|
|
return nil, huma.Error500InternalServerError("Failed to get server versions")
|
|
}
|
|
|
|
// Convert []*ServerResponse to []ServerResponse
|
|
serverValues := make([]apiv0.ServerResponse, len(servers))
|
|
for i, server := range servers {
|
|
serverValues[i] = *server
|
|
}
|
|
|
|
return &Response[apiv0.ServerListResponse]{
|
|
Body: apiv0.ServerListResponse{
|
|
Servers: serverValues,
|
|
Metadata: apiv0.Metadata{
|
|
Count: len(servers),
|
|
},
|
|
},
|
|
}, nil
|
|
})
|
|
}
|