fix: return a 405 for GET and DELETE if stateful_mode=false (#331)

Author: nated0g

crates/rmcp/src/transport/streamable_http_server/tower.rs

@@ -111,15 +111,20 @@ where
         B::Error: Display,
     {
         let method = request.method().clone();
-        let result = match method {
-            Method::GET => self.handle_get(request).await,
-            Method::POST => self.handle_post(request).await,
-            Method::DELETE => self.handle_delete(request).await,
+        let allowed_methods = match self.config.stateful_mode {
+            true => "GET, POST, DELETE",
+            false => "POST",
+        };
+        let result = match (method, self.config.stateful_mode) {
+            (Method::POST, _) => self.handle_post(request).await,
+            // if we're not in stateful mode, we don't support GET or DELETE because there is no session
+            (Method::GET, true) => self.handle_get(request).await,
+            (Method::DELETE, true) => self.handle_delete(request).await,
             _ => {
                 // Handle other methods or return an error
                 let response = Response::builder()
                     .status(http::StatusCode::METHOD_NOT_ALLOWED)
-                    .header(ALLOW, "GET, POST, DELETE")
+                    .header(ALLOW, allowed_methods)
                     .body(Full::new(Bytes::from("Method Not Allowed")).boxed())
                     .expect("valid response");
                 return response;