You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by "Similarityoung (via GitHub)" <gi...@apache.org> on 2025/08/20 09:35:56 UTC
[PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Similarityoung opened a new pull request, #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740
<!-- Thanks for sending a pull request!
-->
**What this PR does**:
add MCP authorization with [doc](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization)
This pull request introduces a new OAuth 2.0 resource server authentication filter for MCP protocol support, upgrades several dependencies, and adds configuration and constants to support authorization flows. The main focus is on implementing a robust, standards-compliant authorization mechanism using the `github.com/lestrrat-go/jwx` library, with supporting configuration and documentation for the new MCP authentication filter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3205173784
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "AlexStocks (via GitHub)" <gi...@apache.org>.
AlexStocks merged PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "AlexStocks (via GitHub)" <gi...@apache.org>.
AlexStocks commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328393002
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
Review Comment:
或者可以改成 func (l *JWKSLoader)New(data []byte) (error)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "Alanxtl (via GitHub)" <gi...@apache.org>.
Alanxtl commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2314754888
##########
pkg/filter/auth/mcp/internal/validator/validator.go:
##########
@@ -0,0 +1,361 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "net/http"
+ "net/url"
+ "sort"
+ "sync"
+ "time"
+)
+
+import (
+ "github.com/lestrrat-go/httprc/v3"
+
+ "github.com/lestrrat-go/jwx/v3/jwa"
+ "github.com/lestrrat-go/jwx/v3/jwk"
+ "github.com/lestrrat-go/jwx/v3/jwt"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/logger"
+)
+
+// Error code constants to avoid magic strings in responses.
+const (
+ ErrCodeInvalidProvider = "invalid_provider"
+ ErrCodeJWKS = "jwks_error"
+ ErrCodeInvalidToken = "invalid_token"
+ ErrCodeTokenExpired = "token_expired"
+ ErrCodeTokenNotYet = "token_not_yet_valid"
+)
+
+// TODO(validator): dynamic provider update (Add/Update/Remove) via atomic snapshot or RWMutex
+
+const (
+ defaultAcceptableSkew = 60 * time.Second
+ defaultRemoteJWKSHTTPTimeout = 5 * time.Second
+)
+
+// allowedSignatureAlgorithms defines the whitelist of acceptable JWS algorithms
+// for verifying access tokens. This mitigates algorithm confusion/downgrade.
+var allowedSignatureAlgorithms = map[string]struct{}{
+ // Asymmetric RSA (recommended)
+ "RS256": {},
+ "RS384": {},
+ "RS512": {},
+ // RSASSA-PSS (recommended)
+ "PS256": {},
+ "PS384": {},
+ "PS512": {},
+ // ECDSA (recommended)
+ "ES256": {},
+ "ES384": {},
+ "ES512": {},
+ // Edwards (modern)
+ "EdDSA": {},
+ // Optionally allow HMAC for compatible deployments. If your AS never uses HMAC,
+ // remove HS* to further tighten security.
+ "HS256": {},
+ "HS384": {},
+ "HS512": {},
+}
+
+// filterKeySetByAllowedAlgorithms filters a JWK set to only include keys
+func filterKeySetByAllowedAlgorithms(source jwk.Set) (jwk.Set, int) {
+ if source == nil {
+ return nil, 0
+ }
+ filtered := jwk.NewSet()
+ kept := 0
+ for i := 0; i < source.Len(); i++ {
+ key, ok := source.Key(i)
+ if !ok {
+ continue
+ }
+ var algStr string
+ if err := key.Get("alg", &algStr); err != nil || algStr == "" {
+ // Try retrieving as jwa.SignatureAlgorithm, then stringify
+ var sa jwa.SignatureAlgorithm
+ if err2 := key.Get("alg", &sa); err2 == nil {
+ algStr = sa.String()
+ }
+ }
+ if algStr == "" {
+ continue
+ }
+ if _, ok := allowedSignatureAlgorithms[algStr]; !ok {
+ continue
+ }
+ if err := filtered.AddKey(key); err == nil {
+ kept++
+ }
+ }
+ return filtered, kept
+}
+
+// Validator represents a JWT validator instance
+// Remote providers use jwk.Cache for JWKS auto-refresh; local providers use a static key set.
+type Validator struct {
+ providers map[string]*providerInfo
+ mu sync.RWMutex
+ ctx context.Context
+ cancel context.CancelFunc
+}
+
+// providerInfo contains the provider configuration and its JWKS loader
+type providerInfo struct {
+ config Provider
+ loader JWKSLoader
+}
+
+// ValidationError represents a JWT validation error
+type ValidationError struct {
+ Code string `json:"error"`
+ Message string `json:"error_description"`
+ Err error `json:"-"`
+}
+
+func (e ValidationError) Error() string {
+ return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+// Unwrap exposes the underlying error for errors.Is / errors.As without leaking to clients
+func (e ValidationError) Unwrap() error { return e.Err }
+
+// categorizeJWKSLoadError maps loader errors to standardized error code/message
+func categorizeJWKSLoadError(err error) (code, msg string) {
+ if err == nil {
+ return ErrCodeJWKS, "jwks error"
+ }
+ return ErrCodeJWKS, err.Error()
+}
+
+// categorizeJWTError categorizes JWT validation errors into standard error codes
+func categorizeJWTError(err error) (code, msg string) {
+ if err == nil {
+ return ErrCodeInvalidToken, "invalid token"
+ }
+ // jwx v3 exposes sentinel errors; Validate wraps with fmt.Errorf("validation failed: %w", err)
+ if errors.Is(err, jwt.TokenExpiredError()) {
+ return ErrCodeTokenExpired, jwt.TokenExpiredError().Error()
+ }
+ if errors.Is(err, jwt.TokenNotYetValidError()) {
+ return ErrCodeTokenNotYet, jwt.TokenNotYetValidError().Error()
+ }
+ return ErrCodeInvalidToken, err.Error()
+}
+
+// NewValidator creates a new JWT validator instance
+func NewValidator(config Config) (*Validator, error) {
+ if len(config.Providers) == 0 {
+ return nil, errors.New("at least one provider must be configured")
+ }
+
+ ctx, cancel := context.WithCancel(context.Background())
+ v := &Validator{
+ providers: make(map[string]*providerInfo),
+ ctx: ctx,
+ cancel: cancel,
+ }
+
+ // Initialize each provider
+ for _, provider := range config.Providers {
+ if err := v.addProvider(provider); err != nil {
+ cancel()
+ return nil, fmt.Errorf("failed to add provider %s: %w", provider.Name, err)
+ }
+ }
+
+ return v, nil
+}
+
+// addProvider adds a provider to the validator
+func (v *Validator) addProvider(provider Provider) error {
+ entry := &providerInfo{config: provider}
+
+ loader, err := v.buildLoaderFromJWKS(provider.JWKS)
+ if err != nil {
+ logger.Errorf("[dubbo-go-pixiu] jwt validator build loader failed: provider=%s jwks=%s err=%v", provider.Name, provider.JWKS, err)
+ return fmt.Errorf("failed to init JWKS loader: %w", err)
+ }
+ entry.loader = loader
+
+ v.mu.Lock()
+ v.providers[provider.Name] = entry
+ v.mu.Unlock()
+ return nil
+}
+
+// ProviderByTokenIssuer parses token without validation to extract the issuer
+// and returns the provider name configured for that issuer.
+func (v *Validator) ProviderByTokenIssuer(tokenString string) (string, error) {
+ // Parse token without validation to read claims
+ tok, err := jwt.Parse([]byte(tokenString), jwt.WithValidate(false), jwt.WithVerify(false))
+ if err != nil {
+ return "", fmt.Errorf("failed to parse token for issuer extraction: %w", err)
+ }
+
+ var iss string
+ if err := tok.Get("iss", &iss); err != nil || iss == "" {
+ // fallback to Issuer() accessor (returns issuer string and ok bool)
+ if iss2, ok := tok.Issuer(); ok {
+ iss = iss2
+ }
+ if iss == "" {
+ return "", fmt.Errorf("issuer claim not found in token")
+ }
+ }
+
+ v.mu.RLock()
+ defer v.mu.RUnlock()
+ for name, entry := range v.providers {
+ if entry.config.Issuer == iss {
+ return name, nil
+ }
+ }
+ return "", fmt.Errorf("no provider found for issuer %s", iss)
+}
+
+// buildLoaderFromJWKS parses provider.JWKS and constructs an appropriate loader.
+func (v *Validator) buildLoaderFromJWKS(jwks string) (JWKSLoader, error) {
+ if jwks == "" {
+ return nil, errors.New("jwks must be specified")
+ }
+ u, err := url.Parse(jwks)
+ if err != nil {
+ return nil, fmt.Errorf("invalid jwks uri: %w", err)
+ }
+ switch u.Scheme {
+ case "http", "https":
+ timeout := defaultRemoteJWKSHTTPTimeout
+ // Build http client with resolved timeout
+ httpClient := &http.Client{Timeout: timeout}
+ client := httprc.NewClient(httprc.WithHTTPClient(httpClient))
+ c, err := jwk.NewCache(v.ctx, client)
+ if err != nil {
+ return nil, fmt.Errorf("failed to create jwk cache: %w", err)
+ }
+ if err := c.Register(v.ctx, jwks); err != nil {
+ return nil, fmt.Errorf("failed to register JWKS uri %s: %w", jwks, err)
+ }
+ return newHTTPLoader(c, jwks), nil
+ case "file":
+ return newStaticLoaderFromFile(u.Path)
+ default:
+ return nil, fmt.Errorf("unsupported jwks scheme: %s", u.Scheme)
+ }
+}
+
+// Validate validates a JWT token using the specified provider
+func (v *Validator) Validate(providerName, tokenString string) (jwt.Token, error) {
+ v.mu.RLock()
+ provider, exists := v.providers[providerName]
+ v.mu.RUnlock()
+
+ if !exists {
+ logger.Warnf("[dubbo-go-pixiu] jwt validator provider not found: name=%s", providerName)
+ return nil, ValidationError{Code: ErrCodeInvalidProvider, Message: fmt.Sprintf("provider '%s' not found", providerName)}
+ }
+
+ // Resolve key set via loader (no network IO in validation path)
+ var (
+ keySet jwk.Set
+ err error
+ )
+ keySet, err = provider.loader.Load(v.ctx)
+ if err != nil {
+ code, msg := categorizeJWKSLoadError(err)
+ logger.Errorf("[dubbo-go-pixiu] jwt validator jwks load failed: provider=%s code=%s err=%v", providerName, code, err)
+ return nil, ValidationError{Code: code, Message: msg, Err: err}
+ }
+ if keySet == nil {
+ logger.Warnf("[dubbo-go-pixiu] jwt validator jwks not available: provider=%s", providerName)
+ return nil, ValidationError{Code: ErrCodeJWKS, Message: "no JWKS available for provider"}
+ }
+
+ // Enforce algorithm whitelist by filtering the key set. Tokens signed with algorithms
+ // outside this list will be rejected because no matching key remains.
+ filteredKeySet, kept := filterKeySetByAllowedAlgorithms(keySet)
+ if kept == 0 {
+ logger.Warnf("[dubbo-go-pixiu] jwt validator no acceptable jwk after alg filter: provider=%s", providerName)
+ return nil, ValidationError{Code: ErrCodeJWKS, Message: "no acceptable JWKs with allowed algorithms"}
+ }
+
+ // Build parse options
+ opts := make([]jwt.ParseOption, 0, 5)
+ opts = append(opts,
+ jwt.WithKeySet(filteredKeySet),
+ jwt.WithIssuer(provider.config.Issuer),
+ jwt.WithValidate(true),
+ jwt.WithAcceptableSkew(defaultAcceptableSkew),
+ )
+ if provider.config.Audience != "" {
+ opts = append(opts, jwt.WithAudience(provider.config.Audience))
+ }
+
+ // Parse and validate the token (iss/exp/nbf etc.)
+ token, err := jwt.Parse([]byte(tokenString), opts...)
+ if err != nil {
+ code, msg := categorizeJWTError(err)
+ logger.Warnf("[dubbo-go-pixiu] jwt validator token validate failed: provider=%s iss=%s code=%s err=%v", providerName, provider.config.Issuer, code, err)
+ return nil, ValidationError{Code: code, Message: msg, Err: err}
+ }
+
+ return token, nil
+}
+
+// Provider returns the provider configuration by name
+func (v *Validator) Provider(name string) (*Provider, bool) {
+ v.mu.RLock()
+ defer v.mu.RUnlock()
+ p, ok := v.providers[name]
+ if !ok {
+ return nil, false
+ }
+ cp := p.config
+ return &cp, true
+}
+
+// Providers returns the list of provider names
+func (v *Validator) Providers() []string {
+ v.mu.RLock()
+ defer v.mu.RUnlock()
+ names := make([]string, 0, len(v.providers))
+ for name := range v.providers {
+ names = append(names, name)
+ }
Review Comment:
```suggestion
names = maps.Keys(v.providers)
```
##########
pkg/filter/auth/mcp/filter.go:
##########
@@ -0,0 +1,239 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package mcp
+
+import (
+ "encoding/json"
+ "errors"
+ "fmt"
+ "net/http"
+ "strings"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/common/constant"
+ "github.com/apache/dubbo-go-pixiu/pkg/common/extension/filter"
+ contexthttp "github.com/apache/dubbo-go-pixiu/pkg/context/http"
+ "github.com/apache/dubbo-go-pixiu/pkg/filter/auth/mcp/internal/validator"
+ "github.com/apache/dubbo-go-pixiu/pkg/logger"
+)
+
+const (
+ // Kind is the filter kind key for MCP auth
+ Kind = constant.HTTPMCPAuthFilter
+)
+
+func init() {
+ filter.RegisterHttpFilter(&Plugin{})
+}
+
+type (
+ // Plugin is http filter plugin.
+ Plugin struct{}
+
+ // runtimeState holds read-only runtime data for filters
+ runtimeState struct {
+ validator *validator.Validator
+ metaPath string
+ metaBody []byte
+ rules []Rule
+ }
+
+ // FilterFactory holds immutable state for creating filters
+ FilterFactory struct {
+ cfg *Config
+ state *runtimeState
+ }
+
+ // Filter is the runtime decode filter
+ Filter struct {
+ state *runtimeState
+ }
+)
+
+func (p *Plugin) Kind() string { return Kind }
+
+func (p *Plugin) CreateFilterFactory() (filter.HttpFilterFactory, error) {
+ return &FilterFactory{cfg: &Config{}}, nil
+}
+
+func (factory *FilterFactory) Config() any { return factory.cfg }
+
+// Apply initializes the validator and prebuilds resource metadata body
+func (factory *FilterFactory) Apply() error {
+ if err := factory.cfg.Validate(); err != nil {
+ return err
+ }
+
+ v, err := validator.NewValidator(validator.Config{Providers: factory.cfg.Providers})
+ if err != nil {
+ return fmt.Errorf("init validator: %w", err)
+ }
+ metaPath := factory.cfg.ResourceMetadata.Path
+ // Minimal RFC9728 document: resource + authorization_servers
+ meta := struct {
+ AuthorizationServers []string `json:"authorization_servers"`
+ Resource string `json:"resource"`
+ }{
+ AuthorizationServers: factory.cfg.ResourceMetadata.AuthorizationServers,
+ Resource: factory.cfg.ResourceMetadata.Resource,
+ }
+ body, err := json.Marshal(meta)
+ if err != nil {
+ return fmt.Errorf("marshal resource metadata: %w", err)
+ }
+ rules := factory.cfg.Rules
+
+ factory.state = &runtimeState{
+ validator: v,
+ metaPath: metaPath,
+ metaBody: body,
+ rules: rules,
+ }
+ return nil
+}
+
+// PrepareFilterChain appends the decode filter to chain
+func (factory *FilterFactory) PrepareFilterChain(ctx *contexthttp.HttpContext, chain filter.FilterChain) error {
+ f := &Filter{state: factory.state}
+ chain.AppendDecodeFilters(f)
+ return nil
+}
+
+// Decode implements MCP auth flow
+func (f *Filter) Decode(hc *contexthttp.HttpContext) filter.FilterStatus {
+ path := hc.GetUrl()
+
+ // Well-known metadata endpoint
+ if path == f.state.metaPath {
+ logger.Debugf("[dubbo-go-pixiu] mcp auth filter meta path: %s", path)
+ hc.SendLocalReply(http.StatusOK, f.state.metaBody)
+ return filter.Stop
+ }
+
+ // Resolve rule by framework route entry's cluster
+ var rule *Rule
+ if rEntry := hc.GetRouteEntry(); rEntry != nil {
+ for i := range f.state.rules {
+ if rEntry.Cluster == f.state.rules[i].Cluster {
+ rule = &f.state.rules[i]
+ break
+ }
+ }
+ }
+ if rule == nil {
+ return filter.Continue
+ }
+
+ // Extract bearer token
+ token := extractBearer(hc.GetHeader(constant.Authorization))
+ if token == "" {
+ f.unauthorized(hc, "invalid_token", "missing bearer token")
+ return filter.Stop
+ }
+
+ // Determine provider by token issuer (do not trust token issuer blindly)
+ providerName, err := f.state.validator.ProviderByTokenIssuer(token)
+ if err != nil {
+ logger.Warnf("[dubbo-go-pixiu] provider lookup by token issuer failed: %v", err)
+ f.unauthorized(hc, "invalid_token", "untrusted token issuer")
+ return filter.Stop
+ }
+
+ // Validate token using provider derived from issuer
+ _, err = f.state.validator.Validate(providerName, token)
+ if err != nil {
+ // Map validator.ValidationError if possible
+ verr := validator.ValidationError{}
+ code := "invalid_token"
+ msg := "invalid token"
+ if ok := asValidationError(err, &verr); ok {
+ if verr.Code != "" {
+ code = verr.Code
+ }
+ if verr.Message != "" {
+ msg = verr.Message
+ }
+ } else {
+ msg = err.Error()
+ }
+ f.unauthorized(hc, code, msg)
+ return filter.Stop
+ }
+
+ // remove Authorization header to avoid leaking token to downstream services
+ hc.Request.Header.Del(constant.Authorization)
+
+ return filter.Continue
+}
+
+// unauthorized writes 401 with WWW-Authenticate including resource metadata URL
+func (f *Filter) unauthorized(hc *contexthttp.HttpContext, code, desc string) {
+ // Build absolute metadata URL from request
+ scheme := "http"
+ if hc.Request.TLS != nil {
+ scheme = "https"
+ }
+ metaURL := scheme + "://" + hc.Request.Host + f.state.metaPath
Review Comment:
```suggestion
metaURL := scheme + constant.ProtocolSlash + hc.Request.Host + f.state.metaPath
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2288409229
##########
pkg/filter/auth/mcp/config.go:
##########
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package mcp
+
+import (
+ "fmt"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/filter/auth/mcp/internal/validator"
+ "github.com/apache/dubbo-go-pixiu/pkg/logger"
+)
+
+// Config defines the MCP auth filter configuration.
+// It wires resource metadata (RFC9728), JWT providers, and path-based auth rules.
+type Config struct {
+ // ResourceMetadata controls /.well-known/oauth-protected-resource exposure and values.
+ ResourceMetadata ResourceMetadata `yaml:"resource_metadata" json:"resource_metadata" mapstructure:"resource_metadata"`
+
+ // Providers declares JWT validation providers reused by rules.
+ Providers []validator.Provider `yaml:"providers" json:"providers" mapstructure:"providers"`
+
+ // Rules binds request paths to a provider and required scopes.
+ Rules []Rule `yaml:"rules" json:"rules" mapstructure:"rules"`
+}
+
+// ResourceMetadata represents OAuth 2.0 Protected Resource Metadata (RFC9728)
+// that MCP clients discover via /.well-known/oauth-protected-resource
+type ResourceMetadata struct {
+ // Path is the well-known endpoint path to serve metadata from.
+ // Default: "/.well-known/oauth-protected-resource"
+ Path string `yaml:"path" json:"path" mapstructure:"path"`
+
+ // Resource is the canonical resource identifier (RFC8707) that clients
+ // should request tokens for (e.g. "https://mcp.example.com").
+ Resource string `yaml:"resource" json:"resource" mapstructure:"resource"`
+
+ // AuthorizationServers lists candidate Authorization Server metadata endpoints
+ // (e.g. "https://auth.example.com/.well-known/oauth-authorization-server").
+ AuthorizationServers []string `yaml:"authorization_servers" json:"authorization_servers" mapstructure:"authorization_servers"`
+}
+
+// Rule describes how to protect requests under a given path prefix.
+type Rule struct {
+ // Cluster is the route cluster name matched by the framework router.
+ // The MCP filter will protect routes that resolve to this cluster.
+ Cluster string `yaml:"cluster" json:"cluster" mapstructure:"cluster"`
+}
+
+// Validate performs basic semantic checks on the configuration.
+func (c *Config) Validate() error {
+ // Resource metadata
+ if c.ResourceMetadata.Path == "" {
+ c.ResourceMetadata.Path = "/.well-known/oauth-protected-resource"
+ logger.Warnf("[dubbo-go-pixiu] resource_metadata.path is not set, using default value: %s", c.ResourceMetadata.Path)
+ }
+ if c.ResourceMetadata.Resource == "" {
+ return fmt.Errorf("resource_metadata.resource must be set to the canonical MCP server URI")
+ }
+ if len(c.ResourceMetadata.AuthorizationServers) == 0 {
+ return fmt.Errorf("resource_metadata.authorization_servers must not be empty")
+ }
+
+ // Providers presence
+ if len(c.Providers) == 0 {
+ return fmt.Errorf("providers must not be empty")
+ }
+
+ // Validate provider entries and index names to detect duplicates
+ providerNames := make(map[string]struct{}, len(c.Providers))
+ for _, p := range c.Providers {
+ if p.Name == "" {
+ return fmt.Errorf("provider name must not be empty")
+ }
+ if p.Audience == "" {
+ p.Audience = c.ResourceMetadata.Resource
+ logger.Warnf("[dubbo-go-pixiu] provider '%s' has no audience; defaulting to resource_metadata.resource '%s' ", p.Name, c.ResourceMetadata.Resource)
Review Comment:
Remove the extra spaces before the closing double quote in the log message format string.
```suggestion
logger.Warnf("[dubbo-go-pixiu] provider '%s' has no audience; defaulting to resource_metadata.resource '%s'", p.Name, c.ResourceMetadata.Resource)
```
##########
pkg/filter/auth/mcp/internal/validator/validator.go:
##########
@@ -0,0 +1,361 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "net/http"
+ "net/url"
+ "sort"
+ "sync"
+ "time"
+)
+
+import (
+ "github.com/lestrrat-go/httprc/v3"
+
+ "github.com/lestrrat-go/jwx/v3/jwa"
+ "github.com/lestrrat-go/jwx/v3/jwk"
+ "github.com/lestrrat-go/jwx/v3/jwt"
+)
+
+import (
+ "github.com/apache/dubbo-go-pixiu/pkg/logger"
+)
+
+// Error code constants to avoid magic strings in responses.
+const (
+ ErrCodeInvalidProvider = "invalid_provider"
+ ErrCodeJWKS = "jwks_error"
+ ErrCodeInvalidToken = "invalid_token"
+ ErrCodeTokenExpired = "token_expired"
+ ErrCodeTokenNotYet = "token_not_yet_valid"
+)
+
+// TODO(validator): dynamic provider update (Add/Update/Remove) via atomic snapshot or RWMutex
Review Comment:
[nitpick] This TODO comment should be more specific about the implementation plan or converted to a GitHub issue. Consider specifying the exact approach or timeline for implementing dynamic provider updates.
```suggestion
// TODO(validator): Implement dynamic provider update (Add/Update/Remove) using RWMutex for thread safety.
// See https://github.com/apache/dubbo-go-pixiu/issues/1234 for detailed implementation plan and timeline.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3205170710
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "Similarityoung (via GitHub)" <gi...@apache.org>.
Similarityoung commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328547180
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
+ keySet, err := jwk.Parse(data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+ }
+ return &StaticLoader{set: keySet}, nil
+}
+
+func newStaticLoaderFromFile(path string) (JWKSLoader, error) {
+ data, err := os.ReadFile(path)
+ if err != nil {
+ return nil, fmt.Errorf("failed to read JWKS file %s: %w", path, err)
+ }
+ return newStaticLoaderFromBytes(data)
+}
+
+func (l *StaticLoader) Load(_ context.Context) (jwk.Set, error) { return l.set, nil }
+
+// HTTPLoader loads a jwk.Set from a prepared jwk.Cache by lookup only.
+type HTTPLoader struct {
+ uri string
+ cache *jwk.Cache
+}
+
+func newHTTPLoader(cache *jwk.Cache, uri string) JWKSLoader {
Review Comment:
同上
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "AlexStocks (via GitHub)" <gi...@apache.org>.
AlexStocks commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328392521
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
Review Comment:
为何是小写？
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
+ keySet, err := jwk.Parse(data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+ }
+ return &StaticLoader{set: keySet}, nil
+}
+
+func newStaticLoaderFromFile(path string) (JWKSLoader, error) {
Review Comment:
为何是小写？
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3213167430
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "AlexStocks (via GitHub)" <gi...@apache.org>.
AlexStocks commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3316046135
Please fix the ci failure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "Similarityoung (via GitHub)" <gi...@apache.org>.
Similarityoung commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328546827
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
Review Comment:
这是内部函数，不对外暴露，暴露的函数是
```go
// NewValidator creates a new JWT validator instance
func NewValidator(config Config) (*Validator, error) {
if len(config.Providers) == 0 {
return nil, errors.New("at least one provider must be configured")
}
ctx, cancel := context.WithCancel(context.Background())
v := &Validator{
providers: make(map[string]*providerInfo),
ctx: ctx,
cancel: cancel,
}
// Initialize each provider
for _, provider := range config.Providers {
if err := v.addProvider(provider); err != nil {
cancel()
return nil, fmt.Errorf("failed to add provider %s: %w", provider.Name, err)
}
}
return v, nil
}
```
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
+ keySet, err := jwk.Parse(data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+ }
+ return &StaticLoader{set: keySet}, nil
+}
+
+func newStaticLoaderFromFile(path string) (JWKSLoader, error) {
Review Comment:
同上
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "AlexStocks (via GitHub)" <gi...@apache.org>.
AlexStocks commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328392685
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
+ keySet, err := jwk.Parse(data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+ }
+ return &StaticLoader{set: keySet}, nil
+}
+
+func newStaticLoaderFromFile(path string) (JWKSLoader, error) {
+ data, err := os.ReadFile(path)
+ if err != nil {
+ return nil, fmt.Errorf("failed to read JWKS file %s: %w", path, err)
+ }
+ return newStaticLoaderFromBytes(data)
+}
+
+func (l *StaticLoader) Load(_ context.Context) (jwk.Set, error) { return l.set, nil }
+
+// HTTPLoader loads a jwk.Set from a prepared jwk.Cache by lookup only.
+type HTTPLoader struct {
+ uri string
+ cache *jwk.Cache
+}
+
+func newHTTPLoader(cache *jwk.Cache, uri string) JWKSLoader {
Review Comment:
为何是小写？
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3263582219
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3205184676
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3262123388
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "AlexStocks (via GitHub)" <gi...@apache.org>.
AlexStocks commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328393298
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
+ keySet, err := jwk.Parse(data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+ }
+ return &StaticLoader{set: keySet}, nil
+}
+
+func newStaticLoaderFromFile(path string) (JWKSLoader, error) {
Review Comment:
或者添加为 New() 函数
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
+ keySet, err := jwk.Parse(data)
+ if err != nil {
+ return nil, fmt.Errorf("failed to parse JWKS: %w", err)
+ }
+ return &StaticLoader{set: keySet}, nil
+}
+
+func newStaticLoaderFromFile(path string) (JWKSLoader, error) {
+ data, err := os.ReadFile(path)
+ if err != nil {
+ return nil, fmt.Errorf("failed to read JWKS file %s: %w", path, err)
+ }
+ return newStaticLoaderFromBytes(data)
+}
+
+func (l *StaticLoader) Load(_ context.Context) (jwk.Set, error) { return l.set, nil }
+
+// HTTPLoader loads a jwk.Set from a prepared jwk.Cache by lookup only.
+type HTTPLoader struct {
+ uri string
+ cache *jwk.Cache
+}
+
+func newHTTPLoader(cache *jwk.Cache, uri string) JWKSLoader {
Review Comment:
或者添加为 New() 函数
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "Similarityoung (via GitHub)" <gi...@apache.org>.
Similarityoung commented on code in PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#discussion_r2328546827
##########
pkg/filter/auth/mcp/internal/validator/loader.go:
##########
@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package validator
+
+import (
+ "context"
+ "errors"
+ "fmt"
+ "os"
+)
+
+import (
+ "github.com/lestrrat-go/jwx/v3/jwk"
+)
+
+// JWKSLoader loads a jwk.Set for verification without performing network I/O
+// during request validation.
+type JWKSLoader interface {
+ Load(ctx context.Context) (jwk.Set, error)
+}
+
+// StaticLoader loads a pre-parsed jwk.Set
+type StaticLoader struct{ set jwk.Set }
+
+func newStaticLoaderFromBytes(data []byte) (JWKSLoader, error) {
Review Comment:
这是内部函数，不对外暴露，暴露的函数是
// NewValidator creates a new JWT validator instance
func NewValidator(config Config) (*Validator, error) {
if len(config.Providers) == 0 {
return nil, errors.New("at least one provider must be configured")
}
ctx, cancel := context.WithCancel(context.Background())
v := &Validator{
providers: make(map[string]*providerInfo),
ctx: ctx,
cancel: cancel,
}
// Initialize each provider
for _, provider := range config.Providers {
if err := v.addProvider(provider); err != nil {
cancel()
return nil, fmt.Errorf("failed to add provider %s: %w", provider.Name, err)
}
}
return v, nil
}
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3324340895
## [Codecov](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/740?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 15.95%. Comparing base ([`26606a8`](https://app.codecov.io/gh/apache/dubbo-go-pixiu/commit/26606a8317ac79fb8ce826138a34908b62beae1c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`9dc93dc`](https://app.codecov.io/gh/apache/dubbo-go-pixiu/commit/9dc93dcc399166b6fbeb48a458fe05ae14d073d9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 67 commits behind head on develop.
> :exclamation: There is a different number of reports uploaded between BASE (26606a8) and HEAD (9dc93dc). Click for more details.
>
> <details><summary>HEAD has 1 upload less than BASE</summary>
>
>| Flag | BASE (26606a8) | HEAD (9dc93dc) |
>|------|------|------|
>||1|0|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## develop #740 +/- ##
============================================
- Coverage 54.67% 15.95% -38.72%
============================================
Files 671 221 -450
Lines 78658 16350 -62308
============================================
- Hits 43006 2609 -40397
+ Misses 31981 13503 -18478
+ Partials 3671 238 -3433
```
| [Flag](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/740/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [unittests](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/740/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `15.95% <ø> (?)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/dubbo-go-pixiu/pull/740?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3324325110
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [PR] feat(MCP): add MCP authorization [dubbo-go-pixiu]
Posted by "sonarqubecloud[bot] (via GitHub)" <gi...@apache.org>.
sonarqubecloud[bot] commented on PR #740:
URL: https://github.com/apache/dubbo-go-pixiu/pull/740#issuecomment-3386242049
## [](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740) **Quality Gate passed**
Issues
 [23 New issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=ACCEPTED)
Measures
 [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo-go-pixiu&pullRequest=740&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)
 [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_coverage&view=list)
 [2.3% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_dubbo-go-pixiu&pullRequest=740&metric=new_duplicated_lines_density&view=list)
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=apache_dubbo-go-pixiu&pullRequest=740)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org