Documentation
¶
Overview ¶
Package oauth implements the stateless endpoints of Ken's optional OAuth 2.1 authorization server: discovery metadata (RFC 8414 + RFC 9728), dynamic client registration (RFC 7591), and the token endpoint (authorization_code + refresh_token, PKCE-S256). The interactive /authorize + consent step lives in internal/web (it needs the human session); MCP access-token validation lives in the store (ValidateOAuthAccessToken) so the hot path never imports this package.
The whole feature is inert unless the operator sets KEN_OAUTH_ENABLED — main.go only mounts these handlers when it is on. Purpose: let claude.ai add Ken as a remote-MCP "custom connector" (OAuth-only on personal accounts). A connector authenticated this way gets the standard agent capability set (read | write-draft | propose) — never curate; curation stays human-only in the web UI.
Index ¶
- type Config
- type Server
- func (s *Server) HandleASMetadata(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandlePRMetadata(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleRegister(w http.ResponseWriter, r *http.Request)
- func (s *Server) HandleToken(w http.ResponseWriter, r *http.Request)
- func (s *Server) ResourceMetadataURL(r *http.Request) string
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
Config carries the token lifetimes. Zero values fall back to the defaults in New. Access tokens are deliberately short (claude.ai refreshes proactively); grant revocation is instant regardless, since every MCP call re-checks it.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server holds the collaborators the stateless OAuth endpoints need.
func New ¶
New builds a Server. baseURL must return the canonical https origin for a request (used verbatim as the issuer and to build every endpoint URL).
func (*Server) HandleASMetadata ¶
func (s *Server) HandleASMetadata(w http.ResponseWriter, r *http.Request)
HandleASMetadata serves RFC 8414 authorization-server metadata at /.well-known/oauth-authorization-server.
func (*Server) HandlePRMetadata ¶
func (s *Server) HandlePRMetadata(w http.ResponseWriter, r *http.Request)
HandlePRMetadata serves RFC 9728 protected-resource metadata. Registered for BOTH /.well-known/oauth-protected-resource and /.well-known/oauth-protected-resource/mcp (claude.ai probes the path-suffixed form first). resource MUST equal the MCP URL the user typed into Claude.
func (*Server) HandleRegister ¶
func (s *Server) HandleRegister(w http.ResponseWriter, r *http.Request)
HandleRegister implements DCR. It is intentionally open (per RFC 7591 and how claude.ai self-registers), but bounded: redirect URIs must be https or loopback, and it sits behind Ken's per-IP rate-limit guard. A registered client is inert until a human approves it at /oauth/authorize.
func (*Server) HandleToken ¶
func (s *Server) HandleToken(w http.ResponseWriter, r *http.Request)
HandleToken implements the token endpoint (application/x-www-form-urlencoded).
func (*Server) ResourceMetadataURL ¶
ResourceMetadataURL is the RFC 9728 protected-resource-metadata URL for the MCP endpoint — the value the MCP endpoint advertises in its 401 WWW-Authenticate header so a client can discover this authorization server.
Source Files