@zuplo/lint-win32-x64 7.7.17 → 7.8.0

package/bin/schemas/policy-options.schema.json

@@ -5808,6 +5808,9 @@
                             {
                               "required": ["skipIssuerMetadataValidation"]
                             },
+                            {
+                              "required": ["skipResourceIndicatorValidation"]
+                            },
                             {
                               "required": ["clientRegistration"]
                             }
@@ -5880,7 +5883,12 @@
                         "skipIssuerMetadataValidation": {
                           "type": "boolean",
                           "x-advanced": true,
-                          "description": "Skips the RFC 8414 section 3.3 issuer-echo check when discovering the upstream authorization server. That check requires the `issuer` in the authorization server's metadata to equal the `authorization_servers` entry the protected-resource metadata advertised. Some providers publish a path-scoped authorization server whose metadata reports the root origin instead — for example ServiceNow advertises `https://<instance>.service-now.com/sncapps/...` but its metadata reports `https://<instance>.service-now.com` — so discovery hard-fails without this option. Warning: enabling this puts the connection out of spec. The check is an unqualified MUST in both RFC 8414 section 3.3 and the MCP authorization spec, which require rejecting a metadata document whose `issuer` differs from the identifier the well-known URL was built from; the spec's own example is a document served from `https://attacker.example/.well-known/oauth-authorization-server` claiming `\"issuer\": \"https://honest.example\"`. The echo check binds the metadata to the TLS-authenticated host it came from, and with it off the gateway trusts the authorization, token and JWKS endpoints from a document that never proved it speaks for that issuer. Only enable it for a specific upstream known to publish a mismatched issuer, and only when the metadata URL's host is itself trusted. It relaxes the discovery-time check only — the RFC 9207 authorization-response check and the callback-leg authorization-server binding still apply."
+                          "description": "Allows the authorization server metadata's `issuer` to differ from the server URL used for discovery. Defaults to `false`. Enable only for a confirmed provider metadata mismatch after verifying that its metadata and OAuth endpoints are trusted. This disables the RFC 8414 section 3.3 issuer check; authorization-response and callback checks still apply. Available only with `user-oauth` and `shared-oauth`."
+                        },
+                        "skipResourceIndicatorValidation": {
+                          "type": "boolean",
+                          "x-advanced": true,
+                          "description": "Allows the upstream metadata's `resource` URL to have a different origin or path from the configured upstream URL. Defaults to `false`. The gateway still sends the advertised `resource` on OAuth requests. Enable only for a confirmed provider metadata mismatch: a token intended for another service could otherwise be sent to this upstream. Available only with `user-oauth` and `shared-oauth`."
                         },
                         "clientRegistration": {
                           "x-advanced": true,

package/bin/version.txt

@@ -1 +1 @@
-7.7.17
+7.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zuplo/lint-win32-x64",
-  "version": "7.7.17",
+  "version": "7.8.0",
   "description": "The win32-x64 binary for zuplo-lint, the Zuplo API linter.",
   "repository": "https://github.com/zuplo/zuplo",
   "author": "Zuplo, Inc.",