Jakob WennbergandClaude Sonnet 5
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
28 lines
1.2 KiB
TypeScript
28 lines
1.2 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { PUBLIC_OAUTH_METADATA_SCOPES } from '@/lib/auth/api-keys'
|
|
|
|
/**
|
|
* RFC 8414: OAuth 2.0 Authorization Server Metadata.
|
|
* Tells MCP clients where the authorize/token endpoints are.
|
|
*/
|
|
export async function GET() {
|
|
const appUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
|
|
|
|
return NextResponse.json({
|
|
issuer: appUrl,
|
|
authorization_endpoint: `${appUrl}/api/mcp-oauth/authorize`,
|
|
token_endpoint: `${appUrl}/api/mcp-oauth/token`,
|
|
registration_endpoint: `${appUrl}/api/mcp-oauth/register`,
|
|
response_types_supported: ['code'],
|
|
grant_types_supported: ['authorization_code', 'refresh_token'],
|
|
code_challenge_methods_supported: ['S256'],
|
|
token_endpoint_auth_methods_supported: ['none', 'client_secret_post'],
|
|
// Advertise only the safe read-only default scopes plus the coarse
|
|
// `mcp` marker. Destructive scopes (*:write, pending_operations:approve,
|
|
// bookkeeping:write) are still accepted by /authorize when requested
|
|
// explicitly, but enumerating them in public discovery aids
|
|
// scope-escalation reconnaissance (CC6.1, defense-in-depth).
|
|
scopes_supported: ['mcp', ...PUBLIC_OAUTH_METADATA_SCOPES],
|
|
})
|
|
}
|