Documentation
¶
Overview ¶
Package oauthserver is the OAuth 2.1 authorization server for MCP connectors (ADR 0016, phase 2): discovery documents (RFC 9728, RFC 8414), dynamic client registration (RFC 7591), the PKCE authorization-code flow and the token endpoint. The consent screen is a SPA route; the signed-in user's decision arrives through the site API and is handled by Service.Decide. The token endpoint issues ordinary scoped API tokens, so /mcp and /api authenticate them exactly like a hand-made token.
Index ¶
- Constants
- Variables
- func ClientHost(clientID string) string
- func IsMetadataClientID(clientID string) bool
- func NewFetcher(allow webhook.Allowlist) webhook.Doer
- func ResourceMetadataURL(mcpOrigin string) string
- func ResourceURL(mcpOrigin string) string
- func SupportedScopes() []string
- type Decision
- type Request
- type Server
- type Service
Constants ¶
const (
// ConsentPath is the SPA route that renders the consent screen.
ConsentPath = "/oauth/consent"
)
Paths served by the Go binary. The consent screen is the SPA route ConsentPath.
Variables ¶
var ( // ErrUnknownClient means the client_id was never registered. ErrUnknownClient = errors.New("unknown client") // ErrInvalidRequest means the authorization request is malformed or does not // match the client's registration (the message is safe to show). ErrInvalidRequest = errors.New("invalid authorization request") )
Functions ¶
func ClientHost ¶
ClientHost is the host of a metadata client's client_id, shown on the consent screen so the user sees who is asking; empty for a registered client.
func IsMetadataClientID ¶
IsMetadataClientID reports whether a client_id is a URL (a Client ID Metadata Document) rather than an identifier handed out by dynamic client registration.
func NewFetcher ¶
NewFetcher is the client that downloads metadata documents: SSRF-hardened, honouring the Instance's internal allowlist (ADR 0039), never following redirects.
func ResourceMetadataURL ¶
ResourceMetadataURL is where /mcp points unauthenticated clients (RFC 9728), on the MCP origin.
func ResourceURL ¶
ResourceURL is the canonical URI of the protected MCP resource, served from the MCP origin (the app origin unless SPHERICON_MCP_URL gives MCP its own host).
func SupportedScopes ¶
func SupportedScopes() []string
SupportedScopes lists every scope the authorization server can issue.
Types ¶
type Decision ¶
type Decision struct {
ClientID string
RedirectURI string
State string
CodeChallenge string
Scope string
WorkspaceID int64
Approve bool
AllowSend bool
}
Decision is the signed-in user's answer to an authorization request. The caller has already verified the user belongs to WorkspaceID.
type Request ¶
type Request struct {
ClientName string
// ClientHost is the host of a metadata client's client_id URL, empty for a registered client.
ClientHost string
// LocalRedirect is set when the redirect URI is on a loopback host, where any program
// on the user's machine can be listening.
LocalRedirect bool
RedirectURI string
// Scopes are granted by default; SendScopes only on explicit opt-in.
Scopes []string
SendScopes []string
}
Request is a validated authorization request, ready for the consent screen.
type Server ¶
type Server struct {
*Service
// contains filtered or unexported fields
}
Server mounts the OAuth protocol endpoints.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service holds the authorization server's state operations.
func NewService ¶
NewService builds the service over the ent client; fetcher downloads Client ID Metadata Documents and must come from webhook.NewClient or NewClientAllowing.
Source Files