jubnl 5b44fe68b1 fix(mcp): narrow OAuth scope to allowed intersection instead of rejecting ...

When a client requests scopes it is not permitted for, silently drop
them rather than failing the entire authorization flow. The token is
issued with only the intersection of requested and allowed scopes.

Also fix /authorize/validate to always return HTTP 200 so the consent
page can surface the actual error_description instead of a generic
axios failure message.

2026-04-09 23:48:05 +02:00

..

fixtures

Add comprehensive backend test suite (#339)

2026-04-03 13:17:53 +02:00

helpers

test(mcp): add tests for OAuth 2.1, addon gating, and budget reorder

2026-04-09 23:12:59 +02:00

integration

fix(mcp): narrow OAuth scope to allowed intersection instead of rejecting

2026-04-09 23:48:05 +02:00

unit

test(mcp): add tests for OAuth 2.1, addon gating, and budget reorder

2026-04-09 23:12:59 +02:00

websocket

test: expand test suite to 87.3% backend coverage

2026-04-06 20:08:30 +02:00

setup.ts

Add comprehensive backend test suite (#339)

2026-04-03 13:17:53 +02:00