From fcbfd93f268de2cebb7b5e3fc037a1bdb435cc5e Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Fri, 7 Nov 2025 09:51:51 +0100 Subject: [PATCH] Fix route mount for each requests Signed-off-by: Bryan Frimin --- go.mod | 3 +- go.sum | 8 ++--- pkg/probod/probod.go | 5 +++ pkg/server/api/api.go | 84 ++++++++++++++++++++++++------------------- pkg/server/server.go | 2 ++ 5 files changed, 61 insertions(+), 41 deletions(-) diff --git a/go.mod b/go.mod index 73bc9c867..6520d2bc6 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/google/jsonschema-go v0.3.0 github.com/jackc/pgx/v5 v5.7.5 github.com/jhillyerd/enmime v1.3.0 - github.com/modelcontextprotocol/go-sdk v1.0.0 + github.com/modelcontextprotocol/go-sdk v1.1.0 github.com/openai/openai-go v1.8.2 github.com/pdfcpu/pdfcpu v0.11.0 github.com/prometheus/client_golang v1.22.0 @@ -112,6 +112,7 @@ require ( go.yaml.in/yaml/v2 v2.4.2 // indirect golang.org/x/mod v0.25.0 // indirect golang.org/x/net v0.41.0 // indirect + golang.org/x/oauth2 v0.32.0 // indirect golang.org/x/sys v0.33.0 // indirect golang.org/x/text v0.26.0 // indirect golang.org/x/tools v0.34.0 // indirect diff --git a/go.sum b/go.sum index 4d410e146..f2124cc09 100644 --- a/go.sum +++ b/go.sum @@ -92,8 +92,6 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/jsonschema-go v0.2.1-0.20250825175020-748c325cec76 h1:mBlBwtDebdDYr+zdop8N62a44g+Nbv7o2KjWyS1deR4= -github.com/google/jsonschema-go v0.2.1-0.20250825175020-748c325cec76/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE= github.com/google/jsonschema-go v0.3.0 h1:6AH2TxVNtk3IlvkkhjrtbUc4S8AvO0Xii0DxIygDg+Q= github.com/google/jsonschema-go v0.3.0/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -144,10 +142,10 @@ github.com/mattermost/xml-roundtrip-validator v0.1.0/go.mod h1:qccnGMcpgwcNaBnxq github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI= github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc= github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= -github.com/modelcontextprotocol/go-sdk v0.4.0 h1:RJ6kFlneHqzTKPzlQqiunrz9nbudSZcYLmLHLsokfoU= -github.com/modelcontextprotocol/go-sdk v0.4.0/go.mod h1:whv0wHnsTphwq7CTiKYHkLtwLC06WMoY2KpO+RB9yXQ= github.com/modelcontextprotocol/go-sdk v1.0.0 h1:Z4MSjLi38bTgLrd/LjSmofqRqyBiVKRyQSJgw8q8V74= github.com/modelcontextprotocol/go-sdk v1.0.0/go.mod h1:nYtYQroQ2KQiM0/SbyEPUWQ6xs4B95gJjEalc9AQyOs= +github.com/modelcontextprotocol/go-sdk v1.1.0 h1:Qjayg53dnKC4UZ+792W21e4BpwEZBzwgRW6LrjLWSwA= +github.com/modelcontextprotocol/go-sdk v1.1.0/go.mod h1:6fM3LCm3yV7pAs8isnKLn07oKtB0MP9LHd3DfAcKw10= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec= @@ -269,6 +267,8 @@ golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w= golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww= golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw= golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= +golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY= +golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8= golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go index dcac7d0a8..a77fdd655 100644 --- a/pkg/probod/probod.go +++ b/pkg/probod/probod.go @@ -416,6 +416,11 @@ func (impl *Implm) Run( TokenType: impl.cfg.TrustAuth.TokenType, CookieSecure: impl.cfg.Auth.Cookie.Secure, }, + MCPConfig: api.MCPConfig{ + Version: "1.0.0", + RequestTimeout: 30 * time.Second, + MaxRequestSize: 10 * 1024 * 1024, // 10MB + }, }, ) if err != nil { diff --git a/pkg/server/api/api.go b/pkg/server/api/api.go index fa8460fa4..bd87882cc 100644 --- a/pkg/server/api/api.go +++ b/pkg/server/api/api.go @@ -65,15 +65,25 @@ type ( SAML *auth.SAMLService ConsoleAuth ConsoleAuthConfig TrustAuth TrustAuthConfig + MCPConfig MCPConfig ConnectorRegistry *connector.ConnectorRegistry SafeRedirect *saferedirect.SafeRedirect CustomDomainCname string Logger *log.Logger } + // MCPConfig holds configuration for MCP + MCPConfig struct { + Version string + RequestTimeout time.Duration + MaxRequestSize int64 + } + Server struct { - cfg Config - trustAPIHandler http.Handler + cfg Config + trustAPIHandler http.Handler + consoleAPIHandler http.Handler + mcpAPIHandler http.Handler } ) @@ -120,7 +130,6 @@ func NewServer(cfg Config) (*Server, error) { return nil, ErrMissingAuthzService } - // Create trust API handler once trustAPIHandler := trust_v1.NewMux( cfg.Logger.Named("trust.v1"), cfg.Auth, @@ -146,9 +155,41 @@ func NewServer(cfg Config) (*Server, error) { }, ) + consoleAPIHandler := console_v1.NewMux( + cfg.Logger.Named("console.v1"), + cfg.Probo, + cfg.Auth, + cfg.Authz, + console_v1.AuthConfig{ + CookieName: cfg.ConsoleAuth.CookieName, + CookieDomain: cfg.ConsoleAuth.CookieDomain, + SessionDuration: cfg.ConsoleAuth.SessionDuration, + CookieSecret: cfg.ConsoleAuth.CookieSecret, + CookieSecure: cfg.ConsoleAuth.CookieSecure, + }, + cfg.ConnectorRegistry, + cfg.SafeRedirect, + cfg.CustomDomainCname, + cfg.SAML, + ) + + mcpAPIHandler := mcp_v1.NewMux( + cfg.Logger.Named("mcp.v1"), + cfg.Probo, + cfg.Auth, + cfg.Authz, + mcp_v1.Config{ + Version: cfg.MCPConfig.Version, + RequestTimeout: cfg.MCPConfig.RequestTimeout, + MaxRequestSize: cfg.MCPConfig.MaxRequestSize, + }, + ) + return &Server{ - cfg: cfg, - trustAPIHandler: trustAPIHandler, + cfg: cfg, + trustAPIHandler: trustAPIHandler, + consoleAPIHandler: consoleAPIHandler, + mcpAPIHandler: mcpAPIHandler, }, nil } @@ -168,7 +209,6 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { Debug: false, } - // Default API security headers w.Header().Set("X-Frame-Options", "DENY") w.Header().Set("X-XSS-Protection", "0") w.Header().Set("X-Content-Type-Options", "nosniff") @@ -176,43 +216,15 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Security-Policy", "default-src 'self'") w.Header().Set("Permissions-Policy", "microphone=(), camera=(), geolocation=()") - // Default API security headers router := chi.NewRouter() router.MethodNotAllowed(methodNotAllowed) router.NotFound(notFound) router.Use(cors.Handler(corsOpts)) - // Mount the console API with authentication - router.Mount( - "/console/v1", - console_v1.NewMux( - s.cfg.Logger.Named("console.v1"), - s.cfg.Probo, - s.cfg.Auth, - s.cfg.Authz, - console_v1.AuthConfig{ - CookieName: s.cfg.ConsoleAuth.CookieName, - CookieDomain: s.cfg.ConsoleAuth.CookieDomain, - SessionDuration: s.cfg.ConsoleAuth.SessionDuration, - CookieSecret: s.cfg.ConsoleAuth.CookieSecret, - CookieSecure: s.cfg.ConsoleAuth.CookieSecure, - }, - s.cfg.ConnectorRegistry, - s.cfg.SafeRedirect, - s.cfg.CustomDomainCname, - s.cfg.SAML, - ), - ) - - // Mount the trust API with authentication + router.Mount("/console/v1", s.consoleAPIHandler) router.Mount("/trust/v1", s.trustAPIHandler) - - // Mount the MCP API - use Route instead of Mount to preserve path for handler - router.Mount( - "/mcp/v1", - mcp_v1.NewMux(s.cfg.Probo), - ) + router.Mount("/mcp/v1", s.mcpAPIHandler) router.ServeHTTP(w, r) } diff --git a/pkg/server/server.go b/pkg/server/server.go index 8800dc223..c3743c425 100644 --- a/pkg/server/server.go +++ b/pkg/server/server.go @@ -50,6 +50,7 @@ type Config struct { SAML *auth.SAMLService ConsoleAuth api.ConsoleAuthConfig TrustAuth api.TrustAuthConfig + MCPConfig api.MCPConfig ConnectorRegistry *connector.ConnectorRegistry Agent *agents.Agent SafeRedirect *saferedirect.SafeRedirect @@ -80,6 +81,7 @@ func NewServer(cfg Config) (*Server, error) { SAML: cfg.SAML, ConsoleAuth: cfg.ConsoleAuth, TrustAuth: cfg.TrustAuth, + MCPConfig: cfg.MCPConfig, ConnectorRegistry: cfg.ConnectorRegistry, SafeRedirect: cfg.SafeRedirect, CustomDomainCname: cfg.CustomDomainCname,