Repository navigation
Make "Try this route" work on every API docs page - #567
Merged
Merged
Conversation
Docs pages use full /api paths while openapi.json paths are relative to the server URL. Strip that base so getOpenApiOperation finds the operation. Co-authored-by: Hugo Demenez <hugodemenez@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: 3256e522-93b7-4ef1-872d-57977275e5d1) |
hugodemenez
added a commit
that referenced
this pull request
Nov 1, 2026
## Summary Promote beta to main so production gets the streamable HTTP MCP server and one-click OAuth connect for Claude, ChatGPT, Cursor, and other MCP clients. ### Shipping - **MCP** (`#573`, `#577`): `POST /api/mcp` with OAuth DCR + PKCE; tools bound to the token user; docs at `/docs/mcp` (EN + FR); `serverInfo` / server-card icons so clients show the Deltalytix mark - **OAuth consent**: “Use another account” link (`#564`) - **Connections**: automatic daily end-of-day sync on by default for new connections (`#563`) - **API docs**: live “Try this route” on every page (`#567`); keep new token visible until closed (`#568`); Try with Claude / ChatGPT / Grok (`#571`, `#572`) - **Rithmic**: stop mis-sizing split orders and duplicating stored trades (`#569`) - **Email**: release newsletter images under `public/email` (`#570`) ### Migrations - `20261024160000_oauth_public_clients_and_audience` - `20261024160100_oauth_registration_attempt_row_level_security` ### Notes - Prod MCP was 404 before this; after merge, clients use `https://www.deltalytix.app/api/mcp` - Connection management / revocable tokens & apps already on main from earlier work - Hugh does not merge this — wait for Hugo ### Test plan - [ ] Vercel prod deploy green; migrations applied - [ ] `GET /.well-known/mcp/server-card.json` returns icons on `www.deltalytix.app` - [ ] Connect from Cursor / Claude custom connector / ChatGPT custom MCP and call `list_trades` - [ ] Consent screen shows Use another account; new connections default to daily auto-sync <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Introduces a new authenticated data surface (MCP) and substantial OAuth changes (public clients, audience-bound tokens, PKCE rules) on top of shared read logic—any bug affects authorization and multi-tenant isolation. > > **Overview** > Adds a **production MCP server** at `POST /api/mcp` (streamable HTTP, stateless JSON-RPC) so AI clients can read the same trading data as `/api/v1` via eight **read-only tools**, always scoped to the bearer token’s user. > > **OAuth & discovery** are extended for MCP connect flows: RFC 7591 **`POST /oauth/register`** (public clients, PKCE S256 required, rate-limited), RFC 8707 **`resource`** audience binding to `/api/mcp`, RFC 9207 **`iss`** on authorize redirects, and new **`/.well-known/oauth-authorization-server`** plus **MCP protected-resource** metadata. The **server card** now advertises streamable HTTP, OAuth on that transport, and the real tool catalog. OpenID discovery delegates to shared authorization-server metadata. > > **REST handlers** are refactored to **`lib/api/v1/reads`** so MCP and HTTP share one read path; auth rejects tokens whose **`resource`** doesn’t match the request URL. Consent shows an **“Unverified app”** badge for dynamically registered clients; redirect URI validation **rejects wildcards**. > > Docs (EN/FR MCP guides), OpenAPI `/mcp`, agent discovery, WebMCP resources, and broad tests (including cross-tenant isolation) ship with the feature. **`@modelcontextprotocol/sdk`** is added as a direct dependency. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit f09776b. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Base: beta
The docs pages use full paths like
/api/v1/trades, but/openapi.jsonlists paths relative to its server URL (https://www.deltalytix.app/api), e.g./v1/trades. The exact-match lookup ingetOpenApiOperationnever matched, so every try panel showed "This endpoint isn't in the live OpenAPI document" (FR: "Cet endpoint n’est pas disponible dans le document OpenAPI live").Fix: the lookup also tries the path with the spec's server base path (
/api) stripped. Requests still go to the full same-origin/api/...path. Adds unit tests./oauth/authorizeis a browser redirect, not in the spec, and still shows no playground (expected).Note
Low Risk
Docs-only lookup logic with unit tests; no change to how API requests are sent.
Reviewed by Cursor Bugbot for commit 2e84ea3. Configure here.