cyrilixandClaude Sonnet 5
e5468ef654
Adds a POST /mcp endpoint (github.com/modelcontextprotocol/go-sdk) with
three tools mirroring the existing /calendar logic: get_calendar_today,
get_calendar_for_date and get_holidays. Bumps go.mod to Go 1.25 (required
by the SDK) and vendors the new dependencies. Also fixes an unanchored
.gitignore rule ("domogeek") that was silently excluding all untracked
files under cmd/domogeek/.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Hu8wwahgecuCGfesTKCfEd
45 lines
1.7 KiB
Go
45 lines
1.7 KiB
Go
// Copyright 2026 The Go MCP SDK Authors. All rights reserved.
|
|
// Use of this source code is governed by an MIT-style
|
|
// license that can be found in the LICENSE file.
|
|
|
|
package oauthex
|
|
|
|
import "strings"
|
|
|
|
// MatchesResource reports whether any of claims matches resource under
|
|
// RFC 3986 §6.2.3 scheme-based normalization, narrowed to the empty-path
|
|
// case: a URI with an empty path is treated as equivalent to one with a
|
|
// path of "/". All other URI components (scheme, host case, port, query,
|
|
// fragment) must match exactly — this is intentionally narrower than the
|
|
// full §6.2.3 rung, which would also fold scheme/host case and default
|
|
// ports.
|
|
//
|
|
// RFC 9728 §3.3 normatively requires "simple string comparison" per
|
|
// RFC 3986 §6.2.1 (byte-equal). Callers that need strict byte-equal
|
|
// semantics should compare claims to resource directly:
|
|
//
|
|
// for _, c := range claims { if c == resource { return true } }
|
|
//
|
|
// Background: RFC 9728 §3.3 canonicalises the protected-resource
|
|
// identifier with a trailing slash, but RFC 8707 resource indicators
|
|
// sometimes omit it, and upstream IdPs vary in which form they emit in
|
|
// `aud` claims (Google trims, Auth0 retains, claude.ai round-trips
|
|
// whichever it received). Strict byte equality therefore fails routinely
|
|
// on legitimate setups; this helper is the most common pragmatic relaxation
|
|
// while keeping path/scheme/host strict so token confusion across distinct
|
|
// resources still fails closed.
|
|
//
|
|
// Returns false when claims is empty.
|
|
func MatchesResource(claims []string, resource string) bool {
|
|
expected := strings.TrimSuffix(resource, "/")
|
|
for _, c := range claims {
|
|
if c == resource {
|
|
return true
|
|
}
|
|
if strings.TrimSuffix(c, "/") == expected {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|