chore(http): create constant for session id header

Author: EdouardCourty

src/Server/Transport/StreamableHttpTransport.php

@@ -30,6 +30,8 @@
  */
 class StreamableHttpTransport extends BaseTransport
 {
+    public const MCP_SESSION_ID_HEADER = 'Mcp-Session-Id';
+
     private ResponseFactoryInterface $responseFactory;
     private StreamFactoryInterface $streamFactory;
 
@@ -62,8 +64,8 @@ public function __construct(
         $this->corsHeaders = array_merge([
             'Access-Control-Allow-Origin' => '*',
             'Access-Control-Allow-Methods' => 'GET, POST, DELETE, OPTIONS',
-            'Access-Control-Allow-Headers' => 'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
-            'Access-Control-Expose-Headers' => 'Mcp-Session-Id',
+            'Access-Control-Allow-Headers' => 'Content-Type, '.self::MCP_SESSION_ID_HEADER.', Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
+            'Access-Control-Expose-Headers' => self::MCP_SESSION_ID_HEADER,
         ], $corsHeaders);
 
         foreach ($middleware as $m) {
@@ -120,7 +122,7 @@ protected function handlePostRequest(): ResponseInterface
     protected function handleDeleteRequest(): ResponseInterface
     {
         if (!$this->sessionId) {
-            return $this->createErrorResponse(Error::forInvalidRequest('Mcp-Session-Id header is required.'), 400);
+            return $this->createErrorResponse(Error::forInvalidRequest(self::MCP_SESSION_ID_HEADER.' header is required.'), 400);
         }
 
         $this->handleSessionEnd($this->sessionId);
@@ -144,7 +146,7 @@ protected function createJsonResponse(): ResponseInterface
             ->withBody($this->streamFactory->createStream($responseBody));
 
         if ($this->sessionId) {
-            $response = $response->withHeader('Mcp-Session-Id', $this->sessionId->toRfc4122());
+            $response = $response->withHeader(self::MCP_SESSION_ID_HEADER, $this->sessionId->toRfc4122());
         }
 
         return $response;
@@ -211,7 +213,7 @@ protected function createStreamedResponse(): ResponseInterface
             ->withBody($stream);
 
         if ($this->sessionId) {
-            $response = $response->withHeader('Mcp-Session-Id', $this->sessionId->toRfc4122());
+            $response = $response->withHeader(self::MCP_SESSION_ID_HEADER, $this->sessionId->toRfc4122());
         }
 
         return $response;
@@ -276,7 +278,7 @@ protected function withCorsHeaders(ResponseInterface $response): ResponseInterfa
     private function handleRequest(ServerRequestInterface $request): ResponseInterface
     {
         $this->request = $request;
-        $sessionIdString = $request->getHeaderLine('Mcp-Session-Id');
+        $sessionIdString = $request->getHeaderLine(self::MCP_SESSION_ID_HEADER);
         $this->sessionId = $sessionIdString ? Uuid::fromString($sessionIdString) : null;
 
         return match ($request->getMethod()) {

tests/Unit/Server/Transport/StreamableHttpTransportTest.php

@@ -80,10 +80,10 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         $this->assertSame('*', $response->getHeaderLine('Access-Control-Allow-Origin'));
         $this->assertSame('GET, POST, DELETE, OPTIONS', $response->getHeaderLine('Access-Control-Allow-Methods'));
         $this->assertSame(
-            'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
+            'Content-Type, '.StreamableHttpTransport::MCP_SESSION_ID_HEADER.', Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
             $response->getHeaderLine('Access-Control-Allow-Headers')
         );
-        $this->assertSame('Mcp-Session-Id', $response->getHeaderLine('Access-Control-Expose-Headers'));
+        $this->assertSame(StreamableHttpTransport::MCP_SESSION_ID_HEADER, $response->getHeaderLine('Access-Control-Expose-Headers'));
     }
 
     #[TestDox('transport replaces existing CORS headers on the response')]
@@ -120,10 +120,10 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
         $this->assertSame('https://another.com', $response->getHeaderLine('Access-Control-Allow-Origin'));
         $this->assertSame('GET, POST, DELETE, OPTIONS', $response->getHeaderLine('Access-Control-Allow-Methods'));
         $this->assertSame(
-            'Content-Type, Mcp-Session-Id, Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
+            'Content-Type, '.StreamableHttpTransport::MCP_SESSION_ID_HEADER.', Mcp-Protocol-Version, Last-Event-ID, Authorization, Accept',
             $response->getHeaderLine('Access-Control-Allow-Headers')
         );
-        $this->assertSame('Mcp-Session-Id', $response->getHeaderLine('Access-Control-Expose-Headers'));
+        $this->assertSame(StreamableHttpTransport::MCP_SESSION_ID_HEADER, $response->getHeaderLine('Access-Control-Expose-Headers'));
     }
 
     #[TestDox('middleware runs before transport handles the request')]