From 3be9135aee4e9f9340109ecf6a1d7c69e63a76ab Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Wed, 16 Sep 2026 16:32:46 -0700 Subject: [PATCH] docs: correct the segment-decoding comment on the catch-all route MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review caught the stated invariant being false. Next splits the matched suffix on literal `/` before decoding each piece, so a segment can be empty (`api//mcp`) and a single segment can carry a decoded slash (`api%2Fmcp`). Neither reaches the allowlist — both fail closed — but the comment claimed an invariant the router does not provide. Co-Authored-By: Claude Opus 5 (1M context) --- .../oauth-protected-resource/[...path]/route.ts | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/apps/web/app/.well-known/oauth-protected-resource/[...path]/route.ts b/apps/web/app/.well-known/oauth-protected-resource/[...path]/route.ts index 728afa0..47d38b4 100644 --- a/apps/web/app/.well-known/oauth-protected-resource/[...path]/route.ts +++ b/apps/web/app/.well-known/oauth-protected-resource/[...path]/route.ts @@ -41,8 +41,11 @@ export async function GET( ctx: { params: Promise<{ path: string[] }> }, ): Promise { const { path } = await ctx.params; - // Segments arrive already percent-decoded and never empty, but join and - // compare on the same normalized form the allowlist is written in. + // Next splits the matched suffix on literal `/` and only then decodes each + // piece, so a segment can be empty (`api//mcp` -> ["api","","mcp"]) and a + // single segment can itself contain a decoded slash (`api%2Fmcp` -> one + // element, "api/mcp"). Join and compare on the same normalized form the + // allowlist is written in, and let anything else fail closed. const resourcePath = path.join("/"); if (!METADATA_RESOURCE_PATHS.has(resourcePath)) {