Documentation
¶
Overview ¶
Package oauthhttp provides the optional, mountable HTTP adapters for Credbound's OAuth 2.1/OIDC authorization server: Handler serves the protocol endpoints (discovery, JWKS, authorize, token, revoke, register, userinfo), Protect wraps an MCP or API resource with bearer-token authentication, and MetadataFetcher resolves Client Identifier Metadata Documents over SSRF-hardened HTTPS.
The package starts no server and issues no cookies; the host mounts Handler on its own mux and supplies session authentication and consent UI through HandlerConfig. It requires a Manager built with credbound.Config.OAuth and an OAuthStore-capable store:
handler, err := oauthhttp.New(manager, oauthhttp.HandlerConfig{
Issuer: "https://auth.example.com",
Authenticate: sessionFromRequest,
PresentConsent: renderConsent,
})
mux.Handle("/", handler)
Index ¶
- func AuthenticationFromContext(r *http.Request) (credbound.OAuthAuthentication, bool)
- func Protect(manager *credbound.Manager, resource, requiredScope, metadataURL string, ...) http.Handler
- func WithAuthentication(ctx context.Context, authentication credbound.OAuthAuthentication) context.Context
- type Handler
- type HandlerConfig
- type MetadataFetcher
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AuthenticationFromContext ¶
func AuthenticationFromContext(r *http.Request) (credbound.OAuthAuthentication, bool)
AuthenticationFromContext extracts the verified OAuth authentication that Protect attached to the request, reporting false when the request did not pass through Protect.
func Protect ¶
func Protect(manager *credbound.Manager, resource, requiredScope, metadataURL string, next http.Handler) http.Handler
Protect wraps next with bearer-token validation at the resource boundary. resource is the canonical protected-resource identifier registered with the manager, requiredScope the minimum scope for this route, and metadataURL the absolute URL of the resource's protected-resource metadata document echoed in WWW-Authenticate challenges. Mount it per route:
mux.Handle("/mcp", oauthhttp.Protect(manager,
"https://api.example.com/mcp", // resource
"mcp.read", // requiredScope
"https://api.example.com/.well-known/oauth-protected-resource", // metadataURL
mcpHandler))
func WithAuthentication ¶
func WithAuthentication(ctx context.Context, authentication credbound.OAuthAuthentication) context.Context
WithAuthentication returns a context carrying a verified OAuth authentication, as installed by Protect for its wrapped handler. Only attach values produced by Credbound's token authentication — downstream authorization decisions trust them.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler serves the OAuth 2.1/OIDC protocol endpoints for one issuer: discovery, protected-resource metadata, JWKS, authorize, token, revoke, dynamic client registration and userinfo. Mount it on the host mux; TLS, sessions and rate limiting remain the host's responsibility.
type HandlerConfig ¶
type HandlerConfig struct {
// Issuer is the authorization server's canonical https:// URL, without
// trailing slash, query, fragment or userinfo. Required; endpoint
// paths are derived from it.
Issuer string
// Resource optionally enables the protected-resource metadata
// endpoint for this https:// resource URL.
Resource string
// Authenticate resolves the host's own browser session into the
// server-side Authentication acting on /authorize. It must come from
// the host session — never from client-supplied fields. Nil disables
// the authorization endpoint.
Authenticate func(*http.Request) (credbound.Authentication, error)
// PresentConsent renders the consent (or auto-approval) UI for a
// validated authorization request; the host later completes it with
// Manager.CompleteOAuthAuthorization. Nil disables the authorization
// endpoint.
PresentConsent func(http.ResponseWriter, *http.Request, credbound.OAuthConsent)
}
HandlerConfig wires a Handler to one issuer and to the host's session and consent machinery.
type MetadataFetcher ¶
type MetadataFetcher struct {
// contains filtered or unexported fields
}
MetadataFetcher retrieves Client Identifier Metadata Documents for CIMD client registration. It only speaks HTTPS to hosts resolving to public addresses (blocking SSRF into loopback, private and link-local ranges), refuses redirects, and caps documents at 5 KiB. It implements credbound.OAuthClientMetadataFetcher for credbound.OAuthConfig.MetadataFetcher.
func NewMetadataFetcher ¶
func NewMetadataFetcher(timeout time.Duration, concurrency int) (*MetadataFetcher, error)
NewMetadataFetcher builds a fetcher with the given per-request timeout (zero defaults to 5s) and concurrency cap (zero defaults to 16, at most 256). Requests beyond the cap wait for a slot or their context.
func (*MetadataFetcher) Fetch ¶
func (f *MetadataFetcher) Fetch(ctx context.Context, clientID string) (credbound.OAuthClientMetadataDocument, error)
Fetch downloads and validates the metadata document identified by the HTTPS clientID URL, returning it with the fetch time and a cache expiry derived from the response's Cache-Control header.
Source Files