Documentation
¶
Overview ¶
Package rs is an MCP service's OAuth 2.1 Resource Server HTTP surface: the RFC 9728 discovery endpoint and the bearer-authn middleware on /mcp. Tokens are authenticated by proxy-auth introspection (no local verification); per-tool authorization lives in pkg/mcp/middleware/auth.go.
Index ¶
Constants ¶
const MetadataPath = "/.well-known/oauth-protected-resource"
MetadataPath is the RFC 9728 well-known path for protected-resource metadata.
const ValidateRoute = "/api/v3/oauth/validate"
ValidateRoute is proxy-auth's OAuth token-introspection endpoint (authn + aud, no route authorization). It lives under the isolated /api/v3/oauth/* namespace; the first-party /api/v3/auth gateway path rejects OAuth-class tokens.
Variables ¶
This section is empty.
Functions ¶
func Register ¶
func Register(router *echo.Echo, mcpHandler http.Handler, oauth mcpConfig.OAuthInfo, validator TokenValidator) error
Register mounts the RS surface: the RFC 9728 metadata endpoint and /mcp behind the bearer-authn middleware. Fails fast when the OAuth config is invalid or validator is nil.
func ValidateConfig ¶
ValidateConfig rejects incomplete OAuth settings so startup fails rather than serving empty metadata / forwarding an empty aud. Scope stays optional.
Types ¶
type TokenValidator ¶
type TokenValidator interface {
// Validate returns nil when valid; an error of KindUnauthorized when
// invalid/expired/wrong-aud; other kinds for service failures. authz is
// "Bearer <token>".
Validate(ctx context.Context, authz, resource string) error
}
TokenValidator authenticates a bearer against proxy-auth introspection.
func NewHTTPValidator ¶
func NewHTTPValidator(baseURL string, injector restinterfaces.AuthenticationInjector) TokenValidator
NewHTTPValidator builds a TokenValidator that POSTs to proxy-auth's ValidateRoute.
Source Files