oauth

type AuthResult ¶

type AuthResult struct {
	Code  string
	State string
	Err   error
}

AuthResult is the result sent back from the OAuth callback.

type Handler ¶ added in v0.22.1

type Handler struct {
	*auth.AuthorizationCodeHandler
	// contains filtered or unexported fields
}

Handler wraps auth.AuthorizationCodeHandler to add token persistence and pending authorization bridging for the web UI.

It embeds *auth.AuthorizationCodeHandler to satisfy the unexported isOAuthHandler() method required by the auth.OAuthHandler interface.

func NewHandler(cfg HandlerConfig) (*Handler, error)

func (h *Handler) Authorize(ctx context.Context, req *http.Request, resp *http.Response) error

func (h *Handler) ClearToken() error

func (h *Handler) Close()

func (h *Handler) HasToken() bool

func (h *Handler) TokenSource(ctx context.Context) (oauth2.TokenSource, error)

func (h *Handler) ToolName() string

type HandlerConfig ¶ added in v0.22.1

type HandlerConfig struct {
	ToolName     string
	CallbackURL  string // e.g. "https://denkeeper.example.com/api/v1/tools/oauth/callback"
	ClientID     string // pre-registered (optional)
	ClientSecret string // pre-registered (optional)
	Scopes       []string
	HTTPClient   *http.Client // SSRF-safe client

	Store   *TokenStore
	Pending *PendingManager
	Logger  *slog.Logger
}

HandlerConfig configures the OAuth handler for a remote MCP tool.

type PendingAuth ¶

type PendingAuth struct {
	ID        string    `json:"id"`
	ToolName  string    `json:"tool_name"`
	AuthURL   string    `json:"auth_url,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	// contains filtered or unexported fields
}

PendingAuth represents an in-progress OAuth authorization flow.

type PendingManager ¶

type PendingManager struct {
	// contains filtered or unexported fields
}

PendingManager tracks active OAuth authorization requests. The lifecycle:

1. The AuthorizationCodeFetcher callback creates a pending auth via Create().
2. It sets the auth URL via SetAuthURL() after the SDK generates it.
3. It blocks on WaitForCompletion() until the callback resolves.
4. The API callback handler calls Complete() with the code+state.
5. WaitForCompletion() returns the result to the fetcher.

func NewPendingManager(logger *slog.Logger) *PendingManager

func (pm *PendingManager) Cancel(id string)

func (pm *PendingManager) Cleanup()

func (pm *PendingManager) CompleteByState(state, code string) error

func (pm *PendingManager) Create(toolName string) *PendingAuth

func (pm *PendingManager) Get(id string) *PendingAuth

func (pm *PendingManager) GetByToolName(toolName string) *PendingAuth

func (pm *PendingManager) List() []*PendingAuth

func (pm *PendingManager) SetAuthURL(id, authURL string) error

func (pm *PendingManager) StartCleanup(ctx context.Context, interval time.Duration)

func (pm *PendingManager) WaitForCompletion(ctx context.Context, id string) (code, state string, err error)

type StoredToken ¶

type StoredToken struct {
	ToolName     string
	AccessToken  string
	RefreshToken string
	TokenType    string
	Expiry       *time.Time
	Scopes       []string

	// OAuth2 config for token refresh.
	ClientID     string
	ClientSecret string
	TokenURL     string
	AuthStyle    oauth2.AuthStyle
	ResourceURL  string
}

StoredToken holds everything needed to reconstruct an oauth2.TokenSource without re-authorizing. Sensitive fields are encrypted at rest.

func (st *StoredToken) Summary() TokenSummary

func (st *StoredToken) ToOAuth2Config() *oauth2.Config

func (st *StoredToken) ToOAuth2Token() *oauth2.Token

type TokenStore ¶

type TokenStore struct {
	// contains filtered or unexported fields
}

TokenStore provides encrypted token persistence in SQLite.

func NewTokenStore(db *sqlx.DB, hexKey string) (*TokenStore, error)

func (s *TokenStore) Delete(toolName string) error

func (s *TokenStore) Get(toolName string) (*StoredToken, error)

func (s *TokenStore) List() ([]TokenSummary, error)

func (s *TokenStore) Put(st *StoredToken) error

type TokenSummary ¶

type TokenSummary struct {
	HasToken    bool       `json:"has_token"`
	ExpiresAt   *time.Time `json:"expires_at,omitempty"`
	Scopes      []string   `json:"scopes,omitempty"`
	NeedsReauth bool       `json:"needs_reauth"`
}

TokenSummary is a non-sensitive view of a stored token for API responses.