mirror of
https://github.com/garrytan/gbrain.git
synced 2026-07-31 04:07:52 +00:00
Garry TanandClaude Fable 5
d2a432dfd7
POST /register now accepts an optional token_ttl_seconds field (RFC 7591 extension). The server clamps it into an admin-configured window (oauth.dcr_ttl_min_seconds / oauth.dcr_ttl_max_seconds config keys; defaults 300s..7d), persists it as the client's per-client TTL override (oauth_clients.token_ttl), and echoes the EFFECTIVE value back as token_ttl_seconds in the registration response. Fail-safe posture: absent/malformed -> server default; out-of-range -> clamped, never rejected; pre-migration schemas without the token_ttl column keep registering (no echo). The MCP SDK's /register handler strips unknown body members before they reach the clients store, so serve-http parses the raw body in a middleware and carries the value through an AsyncLocalStorage context. Root-cause follow-through: the per-client token_ttl lookup moved from exchangeClientCredentials into issueTokens, so authorization_code (the DCR default grant) and refresh issuance honor the override too — previously only client_credentials did. Tests: clamp boundaries (below/at/in/at/above, floor, inverted window), store-level persistence + echo + no-context back-compat, cross-grant TTL enforcement (test/oauth-dcr-ttl.test.ts), and a DB-gated wire-level e2e in test/e2e/serve-http-oauth.test.ts. Docs: docs/mcp/DEPLOY.md. Reported-by: @asabirov (#2179) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>