mcp-nextcloud

Files

T

Chris CoutinhoandClaude 15113dbb03 fix: remove Hybrid Flow, make Progressive Consent default (ADR-004)

Eliminates scope escalation security vulnerability by removing Hybrid Flow
and making Progressive Consent the only OAuth mode.

Changes:
- Delete oauth_callback() and oauth_token() (Hybrid Flow only, ~314 lines)
- Fix scope flows: Flow 1 requests resource scopes, Flow 2 requests identity+offline
- Remove ENABLE_PROGRESSIVE_CONSENT flag (always enabled in OAuth mode)
- Update documentation to reflect Progressive Consent as default
- Delete test_adr004_hybrid_flow.py test file
- Remove unused variables (ruff lint fixes)

Security improvements:
- No scope escalation: client gets exactly what it requests
- Clear separation: MCP session tokens vs Nextcloud offline tokens
- OAuth2 compliant: follows best practices for scope handling

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

2025-11-04 00:26:07 +01:00

auth

fix: remove Hybrid Flow, make Progressive Consent default (ADR-004)

2025-11-04 00:26:07 +01:00

client

refactor: Transform document parsing into pluggable processor architecture

2025-10-25 19:28:35 +02:00

controllers

perf(notes): Improve notes search performance using async iterators

2025-10-18 22:02:19 +02:00

document_processors

feat: Add text processing background worker for telling client about progress