Skip to content

fix: serve OpenAI domain verification challenge #119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
adityaoberai merged 3 commits into from
Sep 11, 2026
+30 −0
Merged

fix: serve OpenAI domain verification challenge #119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
839bba6
fix: serve OpenAI domain verification challenge
adityaoberai Sep 11, 2026
78cb907
test: cover public domain verification HTTP contract
adityaoberai Sep 11, 2026
805541a
test: assert challenge media type instead of exact content-type header
adityaoberai Sep 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions src/mcp_server_appwrite/http_app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
following ``resource_metadata`` from the 401 challenge. Mirrors the Appwrite
authorization server's discovery document verbatim.
* ``/healthz`` — liveness probe.
* ``/.well-known/openai-apps-challenge`` — public domain verification token.

Auth uses the SDK primitives (``BearerAuthBackend`` + ``AuthContextMiddleware``) so the
validated token is reachable from tool handlers via ``get_access_token()``.
Expand Down Expand Up @@ -438,6 +439,11 @@ async def health_endpoint(request: Request) -> PlainTextResponse:
return PlainTextResponse(f"appwrite-mcp {SERVER_VERSION} ok")


async def openai_apps_challenge_endpoint(request: Request) -> PlainTextResponse:
"""Serve the public domain-ownership challenge for the OpenAI app listing."""
return PlainTextResponse("Fv03Ea1-vV7p7oIpvL3y2bRKrxVBJnSmscrDOdsVRuk")


async def favicon_svg_endpoint(request: Request) -> Response:
return Response(
_icon_svg(),
Expand Down Expand Up @@ -477,6 +483,11 @@ async def lifespan(app: Starlette):
yield

routes = [
Route(
"/.well-known/openai-apps-challenge",
endpoint=openai_apps_challenge_endpoint,
methods=["GET"],
),
Comment on lines 485 to +490

@greptile-apps greptile-apps Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Missing HTTP contract test

This public verification route has no committed behavioral test. Add an unauthenticated ASGI request test that checks the successful status, exact token body, and text/plain content type. Without it, a later authentication, routing, or response change could silently break domain verification. These assertions cover the observable HTTP contract rather than implementation details.

Prompt To Fix With AI 
This is a comment left during a code review.
Path: src/mcp_server_appwrite/http_app.py
Line: 485-490

Comment:
**Missing HTTP contract test**

This public verification route has no committed behavioral test. Add an unauthenticated ASGI request test that checks the successful status, exact token body, and `text/plain` content type. Without it, a later authentication, routing, or response change could silently break domain verification. These assertions cover the observable HTTP contract rather than implementation details.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Fix in Claude Code Fix in Codex

@adityaoberai adityaoberai Sep 11, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is fixed, isn't it?

@greptile-apps greptile-apps Bot Sep 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this is fixed. The PR now includes an unauthenticated TestClient test covering the route's 200 status, exact token body, and text/plain content type. The missing-test finding is resolved.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.

Route(
"/.well-known/oauth-protected-resource/mcp",
endpoint=mcp_path_protected_resource_metadata_endpoint,
Expand Down
19 changes: 19 additions & 0 deletions tests/unit/test_http_app.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@

from opentelemetry.sdk.metrics import MeterProvider
from opentelemetry.sdk.metrics.export import InMemoryMetricReader
from starlette.testclient import TestClient

from mcp_server_appwrite import auth, telemetry
from mcp_server_appwrite.http_app import (
Expand Down Expand Up @@ -317,6 +318,24 @@ def test_app_routes_include_legacy_discovery_paths(self):
self.assertIn("/.well-known/oauth-protected-resource", paths)
self.assertIn("/.well-known/oauth-authorization-server", paths)

def test_openai_challenge_is_public_plain_text(self):
from mcp_server_appwrite import server as server_module

original_transport = server_module._UPLOAD_TRANSPORT
self.addCleanup(setattr, server_module, "_UPLOAD_TRANSPORT", original_transport)

with TestClient(build_app()) as client:
response = client.get(
"/.well-known/openai-apps-challenge", follow_redirects=False
)

self.assertEqual(response.status_code, 200)
self.assertEqual(
response.content, b"Fv03Ea1-vV7p7oIpvL3y2bRKrxVBJnSmscrDOdsVRuk"
)
media_type = response.headers["content-type"].split(";", 1)[0].strip()
self.assertEqual(media_type, "text/plain")


class ConsoleOverrideTests(unittest.TestCase):
"""The MCP_CONSOLE_URL tester flag: discovery rewrites plus the local
Expand Down
Loading