shadowdaoandClaude Opus 5 3be9135aee docs: correct the segment-decoding comment on the catch-all route ...

Review caught the stated invariant being false. Next splits the matched
suffix on literal `/` before decoding each piece, so a segment can be empty
(`api//mcp`) and a single segment can carry a decoded slash (`api%2Fmcp`).
Neither reaches the allowlist — both fail closed — but the comment claimed
an invariant the router does not provide.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-16 16:32:46 -07:00

..

oauth-protected-resource

docs: correct the segment-decoding comment on the catch-all route

2026-09-16 16:32:46 -07:00