Repository navigation
Conversation
neSpecc
reviewed
Oct 28, 2026
neSpecc
left a comment
neSpecc
left a comment
Member
There was a problem hiding this comment.
Основное:
- В контракте нет
code_challenge_methodиresource— без них API не сможет ни проверить метод PKCE, ни привязать токен к MCP-серверу. - Ответ с ошибкой не описан, и garage уводит пользователя на
/undefined. - Типы пока не используются ни в API, ни в garage.
Подробности в комментариях.
| /** | ||
| * Base64-URL-encoded string of the SHA256 hash of the code verifier | ||
| */ | ||
| code_challenge: string; |
Member
There was a problem hiding this comment.
В запросе не хватает code_challenge_method, resource (RFC 8707), scope и response_type — garage их не передаст, а API не сможет проверить.
- По OAuth 2.1 без
code_challenge_methodпо умолчанию считаетсяplain. Такой клиент пройдёт consent и только на обмене кода получит непонятныйinvalid_grant, потому что API всегда считает S256. - Спека MCP требует от клиентов параметр
resource. Без него токен нельзя привязать к MCP-серверу (audience) — это главный вопрос из ревью API (hawk.api.nodejs PR 681). - Без
scopeскоупы так и останутся декоративными.
Предлагаю добавить code_challenge_method: 'S256', resource?: string, scope?: string.
Author
There was a problem hiding this comment.
Done
- resource and scope parameters currently are not being used, but I still added them just in case
Member
|
Для UI помимо имени приложения еще неплохо бы иметь поле |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.