fix(mcp): answer the discovery documents under the server address too

A client handed https://host/mcp as the server address looks for the
well-known documents below that path instead of asking the origin, and every
one of those probes fell through to the web app: 200 with an HTML body, which
reads to the client as "this server has no OAuth" (Open WebUI reports it as an
unexpected mimetype). The three documents are served under /mcp/.well-known
now, anything else there answers a JSON 404, and the RFC 8414 path-inserted
form /.well-known/oauth-authorization-server/mcp serves the metadata instead
of 404. The wiki says which redirect URI belongs to the client and that a
plain-HTTP APP_URL leaves the discovery document pointing at localhost.
This commit is contained in:
Maurice
2026-09-22 11:52:24 +02:00
parent a44df6cf11
commit da32eb8a3c
5 changed files with 102 additions and 5 deletions
+3 -3
View File
@@ -1,6 +1,6 @@
import { Module, type MiddlewareConsumer, type NestModule } from '@nestjs/common';
import { AddonsModule } from '../addons/addons.module';
import { DiscoveryController } from './discovery.controller';
import { DiscoveryController, McpResourceDiscoveryController } from './discovery.controller';
import { DiscoveryMetadataService } from './discovery-metadata.service';
import { mcpMetadataMiddlewareProvider } from './mcp-metadata.middleware';
import { ConsentCoopMiddleware } from './consent-coop.middleware';
@@ -23,8 +23,8 @@ import { ConsentCoopMiddleware } from './consent-coop.middleware';
*/
@Module({
imports: [AddonsModule],
controllers: [DiscoveryController],
providers: [DiscoveryMetadataService, mcpMetadataMiddlewareProvider, ConsentCoopMiddleware],
controllers: [DiscoveryController, McpResourceDiscoveryController],
providers: [DiscoveryMetadataService, DiscoveryController, mcpMetadataMiddlewareProvider, ConsentCoopMiddleware],
})
export class PlatformModule implements NestModule {
configure(consumer: MiddlewareConsumer): void {