@zuplo/lint-win32-x64 7.7.16 → 7.7.17

package/bin/schemas/policy-options.schema.json

@@ -3662,7 +3662,7 @@
                         },
                         "clientSecret": {
                           "type": "string",
-                          "examples": ["$env(MCP_AUTH0_CLIENT_SECRET)"],
+                          "examples": ["$env(AUTH0_CLIENT_SECRET)"],
                           "description": "The Auth0 client_secret. Use $env(...) to source from a secret environment variable."
                         },
                         "scope": {
@@ -5047,7 +5047,7 @@
                               "examples": [
                                 "https://my-tenant.us.auth0.com/authorize"
                               ],
-                              "description": "The IdP /authorize endpoint to redirect the user to. For local development on loopback, use http://127.0.0.1:9000/oauth/dev-login."
+                              "description": "The IdP /authorize endpoint to redirect the user to. For local development on loopback, use http://127.0.0.1:9000/__zuplo/oauth/dev-login (the gateway's default basePath is /__zuplo; adjust if the plugin is configured with a different one)."
                             },
                             "tokenUrl": {
                               "type": "string",
@@ -5805,6 +5805,9 @@
                             {
                               "required": ["prompt"]
                             },
+                            {
+                              "required": ["skipIssuerMetadataValidation"]
+                            },
                             {
                               "required": ["clientRegistration"]
                             }
@@ -5874,6 +5877,11 @@
                             }
                           ]
                         },
+                        "skipIssuerMetadataValidation": {
+                          "type": "boolean",
+                          "x-advanced": true,
+                          "description": "Skips the RFC 8414 section 3.3 issuer-echo check when discovering the upstream authorization server. That check requires the `issuer` in the authorization server's metadata to equal the `authorization_servers` entry the protected-resource metadata advertised. Some providers publish a path-scoped authorization server whose metadata reports the root origin instead — for example ServiceNow advertises `https://<instance>.service-now.com/sncapps/...` but its metadata reports `https://<instance>.service-now.com` — so discovery hard-fails without this option. Warning: enabling this puts the connection out of spec. The check is an unqualified MUST in both RFC 8414 section 3.3 and the MCP authorization spec, which require rejecting a metadata document whose `issuer` differs from the identifier the well-known URL was built from; the spec's own example is a document served from `https://attacker.example/.well-known/oauth-authorization-server` claiming `\"issuer\": \"https://honest.example\"`. The echo check binds the metadata to the TLS-authenticated host it came from, and with it off the gateway trusts the authorization, token and JWKS endpoints from a document that never proved it speaks for that issuer. Only enable it for a specific upstream known to publish a mismatched issuer, and only when the metadata URL's host is itself trusted. It relaxes the discovery-time check only — the RFC 9207 authorization-response check and the callback-leg authorization-server binding still apply."
+                        },
                         "clientRegistration": {
                           "x-advanced": true,
                           "description": "OAuth client registration mode. Defaults to `auto`, which uses Client ID Metadata Documents when the upstream advertises support and falls back to Dynamic Client Registration otherwise.",

package/bin/version.txt

@@ -1 +1 @@
-7.7.16
+7.7.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/lint-win32-x64",
-  "version": "7.7.16",
+  "version": "7.7.17",
   "description": "The win32-x64 binary for zuplo-lint, the Zuplo API linter.",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",