Constrain Strava requests in the metadata prototype - #1
Draft
pH-7 wants to merge 6 commits into
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Strava route accepted an arbitrary destination while forwarding a bearer token, and malformed requests were not validated. Requests now reach only Strava's documented activities endpoint, reject unknown fields and invalid pagination, disable redirects, bound time/response size, and omit sensitive upstream details from errors. The server also limits request bodies and defaults to loopback.
Metadata now loads after environment configuration, the documented discovery route resolves, model descriptions are explicitly examples, and missing models return 404. Duplicate static context serving is removed. The README corrects the unsupported MCP-compliance and production-readiness claims: the implementation is a REST metadata prototype. Historical material is retained with a correction note.
Validation: a clean Node 22
npm cifollowed by seven offline tests, TypeScript build and Prettier passes. Six regression tests failed before the route fixes.npm auditreports zero vulnerabilities (previously 14). Gitleaks finds no secrets in source or the six commits. Compiled localhost startup applies a synthetic.envcorrectly and rejects five invalid port values; the temporary server is stopped.No real Strava account, token, activity or AI service is used. Public hosting remains a separate decision: the prototype has permissive CORS and no per-user authentication, application-level rate limit or OAuth flow. No real Model Context Protocol transport or ML inference has been added.