Files
pnoker 8b507b313d fix(auth,gateway): mark OAuth2.1/MCP protocol endpoints @PublicEndpoint to pass controller permission audit
These OAuth2.1 authorization-server endpoints (metadata, jwks, register, authorize, token, revoke) and the MCP gateway endpoints (protected-resource metadata, JSON-RPC mcp) authenticate via OAuth (PKCE / client credentials / bearer-token introspection), not the internal @PreAuthorize RBAC. Marking them @PublicEndpoint — consistent with TokenController pre-login endpoints — makes their public security posture explicit and satisfies the controller permission audit (337 endpoints: 326 guarded + 11 public).
2026-06-24 19:29:31 +08:00
..
2026-06-06 13:00:39 +08:00