miki3421 opened a new pull request, #5: URL: https://github.com/apache/openserverless-mcp/pull/5
## Summary - replace JWT and application-secret automation with opaque Redis-backed sessions - make auth_setup wire Redis atomically across login, protected, and logout endpoints - remove secret_ensure and all MCP-side .env mutation - document bcrypt credentials, expiring opaque tokens, server-derived identity, and logout revocation ## Safety and compatibility - preflight every endpoint before changing wrappers - roll back wrappers and requirements if any binding fails - keep action_add_redis for single non-authentication endpoints - never expose credentials or session payloads to the browser ## Validation - npm test: 13 passed - npm run typecheck: passed - validated from the Ubuntu trudev Lima VM Related Trustable integration plan: https://github.com/trustable-ai/trustable-app/issues/68 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
