Jakob Wennberg 1307d4db2e fix(oauth): serve RFC 9728 resource metadata at the path-based locations Claude.ai fetches (#1915) ...

Claude.ai's connector setup derives the protected-resource metadata URL
from the MCP server URL and fetches it before any 401 challenge:
  /.well-known/oauth-protected-resource/api/extensions/ext/mcp-server/mcp
  /api/extensions/ext/mcp-server/mcp/.well-known/oauth-protected-resource
Both were 404 (only the root document our WWW-Authenticate header points
at existed), which the dialog reported as "Authorization with Accounted
failed". One shared builder now serves all three locations; the
path-based route answers 404 for any path other than the MCP endpoint.


Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-26 09:24:11 +02:00

..

__tests__

fix: protect public Auth flows from automated abuse (#1904)

2026-08-25 19:14:06 +02:00

api-keys.ts

feat(onboarding): company setup from the conversation and POST /api/v1/companies (#1814 PR 3) (#1864)

2026-08-25 12:41:02 +02:00

api-mfa-gate.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

bankid.ts

fix(selfhost): stop NEXT_PUBLIC_* flags being constant-folded out of the Docker build (#1656)

2026-08-19 19:52:31 +02:00

classify-auth-error.ts

feat(auth): inline, specific error states on login and signup (#1440)

2026-08-06 21:24:36 +02:00

consume-invite-cookie.ts

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

cron.ts

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

google-oauth.ts

fix(selfhost): stop NEXT_PUBLIC_* flags being constant-folded out of the Docker build (#1656)

2026-08-19 19:52:31 +02:00

has-password.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

invite-tokens.ts

feat: multi-tenant company refactor (GNU-19) (#153)

2026-03-31 16:41:52 +02:00

login-method.ts

feat(login): method-state login panel with quiet inline errors (#1469)

2026-08-08 16:33:50 +02:00

mfa.ts

fix(selfhost): stop NEXT_PUBLIC_* flags being constant-folded out of the Docker build (#1656)

2026-08-19 19:52:31 +02:00

oauth-allowlist.ts

Add/stripe connect transactions (#1139)

2026-07-24 01:16:20 +02:00

oauth-codes.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

protected-resource-metadata.ts

fix(oauth): serve RFC 9728 resource metadata at the path-based locations Claude.ai fetches (#1915)

2026-08-26 09:24:11 +02:00

rate-limit-http.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

require-auth.ts

Fix/fdb fr usrs (#1125)

2026-07-23 16:16:55 +02:00

require-write.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

safe-return-to.ts

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

scopes.ts

feat(reports): custom date ranges on report endpoints in REST v1 and MCP, plus PDF export via API (#1909)

2026-08-25 20:34:21 +02:00

session-timeout-shared.ts

fix(underlag): carry the phone photo that is too big to send, and say why when we cannot (#1550)

2026-08-13 09:39:23 +02:00

session-timeout.ts

feat(auth): make automatic logout an opt-in per-user setting (#1536)

2026-08-12 16:45:41 +02:00

turnstile.ts

fix: protect public Auth flows from automated abuse (#1904)

2026-08-25 19:14:06 +02:00

webmail-search.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00