From fb233e9411aab9662734e4537c48437f93b8effc Mon Sep 17 00:00:00 2001
From: Eugene Yokota <eed3si9n@gmail.com>
Date: Tue, 4 Aug 2026 18:19:36 -0400
Subject: [PATCH] [2.x] Retire textDocument/definition

---
 .../server/LanguageServerProtocol.scala       | 10 +--------
 .../testpkg/ExecRequiresInitializeTest.scala  | 22 ++++++++-----------
 2 files changed, 10 insertions(+), 22 deletions(-)

diff --git a/main/src/main/scala/sbt/internal/server/LanguageServerProtocol.scala b/main/src/main/scala/sbt/internal/server/LanguageServerProtocol.scala
index f0d59ba0a..77f79d1d1 100644
--- a/main/src/main/scala/sbt/internal/server/LanguageServerProtocol.scala
+++ b/main/src/main/scala/sbt/internal/server/LanguageServerProtocol.scala
@@ -41,7 +41,7 @@ private[sbt] object LanguageServerProtocol {
     ServerCapabilities(
       textDocumentSync = TextDocumentSyncOptions(true, 0, false, false, SaveOptions(false)),
       hoverProvider = false,
-      definitionProvider = true
+      definitionProvider = false
     )
   }
 
@@ -78,14 +78,6 @@ private[sbt] object LanguageServerProtocol {
           if (!opt.skipAnalysis.getOrElse(false)) appendExec("collectAnalyses", None)
           jsonRpcRespond(InitializeResult(serverCapabilities), Some(r.id))
 
-        case r: JsonRpcRequestMessage if r.method == "textDocument/definition" =>
-          checkAuthenticated(r) {
-            val _ =
-              Definition.lspDefinition(json(r), r.id, CommandSource(name), converter, log)(using
-                StandardMain.executionContext
-              )
-          }
-
         case r: JsonRpcRequestMessage if r.method == "sbt/exec" =>
           checkAuthenticated(r) {
             val param = Converter.fromJson[SbtExecParams](json(r)).get
diff --git a/server-test/src/test/scala/testpkg/ExecRequiresInitializeTest.scala b/server-test/src/test/scala/testpkg/ExecRequiresInitializeTest.scala
index 78eab4bf2..63e5bd11d 100644
--- a/server-test/src/test/scala/testpkg/ExecRequiresInitializeTest.scala
+++ b/server-test/src/test/scala/testpkg/ExecRequiresInitializeTest.scala
@@ -26,10 +26,10 @@ import org.scalatest.funsuite.AnyFunSuite
 /**
  * Reproduces the reported vulnerability: a TCP server configured with token auth
  * (the default whenever `serverConnectionType` is Tcp) must reject requests that
- * mutate or read through the server (`sbt/exec`, `textDocument/definition`) from a
- * client that never completed a token-authenticated `initialize`. Unlike the other
- * tests in this suite, these deliberately skip `ServerSession#initialize` to play
- * the part of an attacker who can reach the socket but does not know the token.
+ * mutate or read through the server from a client that never completed a
+ * token-authenticated `initialize`. Unlike the other tests in this suite, these
+ * deliberately skip `ServerSession#initialize` to play the part of an attacker who
+ * can reach the socket but does not know the token.
  */
 class ExecRequiresInitializeTest extends AnyFunSuite {
   private val testDirectory = "tcp"
@@ -81,7 +81,11 @@ class ExecRequiresInitializeTest extends AnyFunSuite {
   }
 
   /** Sends `method`/`params` on `session` and asserts the server rejected it pre-auth. */
-  private def assertRejected[A: JsonWriter](session: ServerSession, method: String, params: A): Unit = {
+  private def assertRejected[A: JsonWriter](
+      session: ServerSession,
+      method: String,
+      params: A
+  ): Unit = {
     val id = session.nextId()
     session.sendJsonRpc(id, method, params).get
     val response = session.waitForResponseMsg(30.seconds, id).get
@@ -99,14 +103,6 @@ class ExecRequiresInitializeTest extends AnyFunSuite {
     }
   }
 
-  test("textDocument/definition is rejected over TCP before a token-authenticated initialize") {
-    withUnauthenticatedSession { session =>
-      // The gate runs before params are ever parsed, so a bogus payload is enough
-      // to prove the request never reaches Definition.lspDefinition's file reads.
-      assertRejected(session, "textDocument/definition", "")
-    }
-  }
-
   test("sbt/setting is rejected over TCP before a token-authenticated initialize") {
     withUnauthenticatedSession { session =>
       assertRejected(session, "sbt/setting", SettingQuery("root/name"))