Fixed 5 instances of hardcoded "https://resource.example.com" in OAuth
protected resource metadata mocks to use the actual resourceBaseUrl.href.
This resolves test failures where the auth validation was rejecting
requests because the resource URL in the metadata didn't match the
actual test server URL.
The failing tests were:
- attempts auth flow on 401 during SSE connection
- attempts auth flow on 401 during POST request
- refreshes expired token during SSE connection
- refreshes expired token during POST request
- redirects to authorization if refresh token flow fails
All SSE tests now pass (17/17).
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Tests that when mcp-protocol-version header is missing, the middleware
uses DEFAULT_NEGOTIATED_PROTOCOL_VERSION when calling verifyAccessToken
- Ensures proper fallback behavior for protocol version negotiation
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Clarify that core server handlers only pass through resource parameter
- Emphasize that server URL validation is demonstrated in the demo provider
- Update issue references to show #592 is fixed, #635 is related
- Update examples to show DemoOAuthProviderConfig usage
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
- In mcpPostHandler,
- Get `mcp-session-id` header early so that it can be reported in every incoming request.
- Helpful for troubleshooting Inspector's ability to retain the session id for the Proxy <-> Server leg
