Visitar URL original
fix(api): allow PATCH in CORS so browsers can call the status endpoints · modelcontextprotocol/registry@ac0e3c0 · GitHub
Skip to content

Commit ac0e3c0

Browse files
JosephDoUrdenJosephDoUrden
committed
fix(api): allow PATCH in CORS so browsers can call the status endpoints
The status endpoints (PATCH /v0/servers/{name}/status and the per-version variant) are served with PATCH, but the CORS middleware's AllowedMethods never listed PATCH, so a cross-origin browser preflight for them returns without the allow headers and the browser blocks the request. Added PATCH to the allowed methods. The existing CORS test is a black-box placeholder that can't reach the wrapped handler (its own comments say as much), which is why this slipped through. Added a small Handler() accessor and a real preflight test asserting every routed method including PATCH is allowed.
1 parent 07fa85f commit ac0e3c0

2 files changed

Lines changed: 69 additions & 0 deletions

File tree

‎internal/api/cors_preflight_test.go‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package api_test
2+
3+
import (
4+
"crypto/ed25519"
5+
"crypto/rand"
6+
"encoding/hex"
7+
"net/http"
8+
"net/http/httptest"
9+
"testing"
10+
11+
"github.com/stretchr/testify/assert"
12+
"github.com/stretchr/testify/require"
13+
14+
"github.com/modelcontextprotocol/registry/internal/api"
15+
v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0"
16+
"github.com/modelcontextprotocol/registry/internal/config"
17+
"github.com/modelcontextprotocol/registry/internal/telemetry"
18+
)
19+
20+
// TestCORSPreflightAllowedMethods checks that the CORS layer permits every HTTP
21+
// method the API actually routes. The status endpoints
22+
// (PATCH /v0/servers/{name}/status and .../versions/{version}/status) are served
23+
// with PATCH, so a cross-origin browser preflight for PATCH has to be allowed or
24+
// the browser refuses to send the real request. Guards against a routed method
25+
// being missing from AllowedMethods.
26+
func TestCORSPreflightAllowedMethods(t *testing.T) {
27+
seed := make([]byte, ed25519.SeedSize)
28+
_, err := rand.Read(seed)
29+
require.NoError(t, err)
30+
31+
cfg := config.NewConfig()
32+
cfg.JWTPrivateKey = hex.EncodeToString(seed)
33+
34+
shutdownTelemetry, metrics, err := telemetry.InitMetrics("test")
35+
require.NoError(t, err)
36+
defer func() { _ = shutdownTelemetry(nil) }()
37+
38+
// registryService is nil on purpose: a CORS preflight is answered by the
39+
// middleware before any route handler runs, so business logic is never hit.
40+
srv := api.NewServer(cfg, nil, metrics, &v0.VersionBody{Version: "test"})
41+
42+
for _, method := range []string{
43+
http.MethodGet,
44+
http.MethodPost,
45+
http.MethodPut,
46+
http.MethodPatch,
47+
http.MethodDelete,
48+
} {
49+
t.Run(method, func(t *testing.T) {
50+
req := httptest.NewRequest(http.MethodOptions, "/v0/servers/example/status", nil)
51+
req.Header.Set("Origin", "https://example.com")
52+
req.Header.Set("Access-Control-Request-Method", method)
53+
54+
w := httptest.NewRecorder()
55+
srv.Handler().ServeHTTP(w, req)
56+
57+
allow := w.Header().Get("Access-Control-Allow-Methods")
58+
assert.Contains(t, allow, method,
59+
"CORS preflight for %s should be allowed, got Access-Control-Allow-Methods=%q", method, allow)
60+
})
61+
}
62+
}

‎internal/api/server.go‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,7 @@ func NewServer(cfg *config.Config, registryService service.RegistryService, metr
106106
http.MethodGet,
107107
http.MethodPost,
108108
http.MethodPut,
109+
http.MethodPatch,
109110
http.MethodDelete,
110111
http.MethodOptions,
111112
},
@@ -134,6 +135,12 @@ func NewServer(cfg *config.Config, registryService service.RegistryService, metr
134135
}
135136

136137
// Start begins listening for incoming HTTP requests
138+
// Handler returns the fully wrapped HTTP handler (middleware stack plus routes).
139+
// Exposed so tests can exercise the middleware, e.g. CORS, without binding a port.
140+
func (s *Server) Handler() http.Handler {
141+
return s.server.Handler
142+
}
143+
137144
func (s *Server) Start() error {
138145
log.Printf("HTTP server starting on %s", s.config.ServerAddress)
139146
return s.server.ListenAndServe()

0 commit comments

Comments
 (0)