lukaszraczylo 304c5ebf3f fix(mcp): free-reject ordering and rate-limit coverage on target proxy
Hoist the Upgrade->501 and traversal->400 checks in handleTargetProxy
above checkAndCount, matching handlePassthrough's own order
(403 -> 501 -> 400 -> limit). A request rejected before the upstream
call must never burn the caller's or their group's rate-limit quota
for a call that was never going to reach the target. Updated the
function's doc comment to state and justify the order.

Add TestHandleTargetProxy_RateLimited_Returns429WithRetryAfter:
group requestsPerMinute:1, two hits on /mcp/{name}/x -> first 200,
second 429 with Retry-After, upstream called exactly once.

Add TestHandleTargetProxy_JSONResponse_OnlyRequestCounterMoves: a
usage-shaped JSON response from the target leaves token/cost
counters at 0 while the request-rate counter moves to 1, proving
the target proxy never tees or accounts a response the way native
passthrough does.
2026-08-20 12:27:07 +01:00
S
Description
No description provided
MIT
9.4 MiB
Languages
Go 81.7%
TypeScript 11.3%
Vue 6.2%
JavaScript 0.2%
Go Template 0.2%
Other 0.3%