http

func AuthorizationMiddleware ¶

func AuthorizationMiddleware(staticConfig *config.StaticConfig, oidcProvider *oidc.Provider, verifier KubernetesApiTokenVerifier) func(http.Handler) http.Handler

AuthorizationMiddleware validates the OAuth flow for protected resources.

The flow is skipped for unprotected resources, such as health checks and well-known endpoints.

There are several auth scenarios supported by this middleware:

 1. requireOAuth is false:

    - The OAuth flow is skipped, and the server is effectively unprotected.
    - The request is passed to the next handler without any validation.

    see TestAuthorizationRequireOAuthFalse

 2. requireOAuth is set to true, server is protected:

    2.1. Raw Token Validation (oidcProvider is nil):
         - The token is validated offline for basic sanity checks (expiration).
         - If OAuthAudience is set, the token is validated against the audience.
         - If ValidateToken is set, the token is then used against the Kubernetes API Server for TokenReview.

         see TestAuthorizationRawToken

    2.2. OIDC Provider Validation (oidcProvider is not nil):
         - The token is validated offline for basic sanity checks (audience and expiration).
         - If OAuthAudience is set, the token is validated against the audience.
         - The token is then validated against the OIDC Provider.
         - If ValidateToken is set, the token is then used against the Kubernetes API Server for TokenReview.

         see TestAuthorizationOidcToken

    2.3. OIDC Token Exchange (oidcProvider is not nil, StsClientId and StsAudience are set):
         - The token is validated offline for basic sanity checks (audience and expiration).
         - If OAuthAudience is set, the token is validated against the audience.
         - The token is then validated against the OIDC Provider.
         - If the token is valid, an external account token exchange is performed using
           the OIDC Provider to obtain a new token with the specified audience and scopes.
         - If ValidateToken is set, the exchanged token is then used against the Kubernetes API Server for TokenReview.

         see TestAuthorizationOidcTokenExchange

func RequestMiddleware ¶

func RequestMiddleware(next http.Handler) http.Handler

func Serve ¶

func Serve(ctx context.Context, mcpServer *mcp.Server, staticConfig *config.StaticConfig, oidcProvider *oidc.Provider) error

func WellKnownHandler ¶ added in v0.0.49

func WellKnownHandler(staticConfig *config.StaticConfig) http.Handler