auth

func BuildHTTPClient ¶

func BuildHTTPClient(
	setupCtx context.Context,
	lifecycleCtx context.Context,
	server *mcpserverapi.MCPServer,
	secrets *compstore.ComponentStore,
	jwt security.Handler,
	opts ...Option,
) (*http.Client, error)

BuildHTTPClient returns an http.Client configured with:

1. Static header injection from transport headers.
2. OAuth2 client credentials token injection (if auth.oauth2 is set; errors if secrets is nil).
3. SPIFFE JWT injection via the configured header (if auth.spiffe.jwt is set and jwt != nil).

OAuth2 and SPIFFE are mutually exclusive in practice; if both are configured, OAuth2 takes precedence and SPIFFE is ignored.

setupCtx controls one-shot setup work (secret fetches). lifecycleCtx controls background work that must outlive the connection setup, specifically the OAuth2 token refresher, which is invoked on every token expiry for the lifetime of the returned client.

opts may customize the dial/TLS settings of the base transport the auth round-trippers wrap (see WithBaseTransport); the default clones http.DefaultTransport.

func HTTPTransportConfig ¶

func HTTPTransportConfig(server *mcpserverapi.MCPServer) ([]commonapi.NameValuePair, *mcpserverapi.MCPAuth)

HTTPTransportConfig extracts headers and auth from whichever HTTP transport is configured on the MCPServer. Returns nil slices/pointers for stdio.