glm-5.3-flash
f431dea5b5
The router-wide bearer_auth_middleware route_layer wraps every route registered before the call (axum 0.8 RouteManager semantics, verified against the vendored axum 0.8.9 source), so it double-wrapped the WS upgrade route (own ws_bearer_auth layer) and the /mcp nest (own inner bearer layer) — the token resolved twice per request on both, and the SRV-10 comment claimed the opposite. Restructure build_router: /mcp is merged and the WS upgrade route is registered after the router-wide route_layer, so each keeps exactly one auth layer. The WS MethodRouter now carries the decoy 405 fallback explicitly (MethodRouter::route_layer wraps method endpoints, not the fallback), preserving the SRV-07 decoy shape for wrong-method probes on /alk/channels. Comments state axum's actual route_layer semantics. Tests: a counting IdentityProvider pins one resolution per WS upgrade request and per /mcp initialize (verified to fail with left: 2/3 under the pre-fix ordering); the 401 enforcement and the WS-path decoy 405 are pinned. Verification: cargo test (304), cargo test --all-features (376 + 5 integration suites), clippy -D warnings (default + all-features), cargo fmt --check, cargo doc --no-deps