server

type Config struct {
	Addr       string
	MCPEnabled bool
	MCPPath    string
	// OAuth, when set, makes the server an OAuth 2.1 resource server: the MCP
	// endpoint and the REST API require a bearer token the platform IdP
	// issued (forwarded by muster / sent by the portal) or this server's own,
	// and every call carries the caller's identity. Off: anonymous, acting as
	// the ServiceAccount.
	OAuth *OAuthConfig
}

type OAuthConfig struct {
	// BaseURL is the public URL of this server: the OAuth issuer identifier
	// of its own authorization-server metadata (https, or http on loopback).
	BaseURL string
	// Provider is the IdP: dex (default) or google.
	Provider string

	// Dex provider (Provider == dex).
	DexIssuerURL    string
	DexClientID     string
	DexClientSecret string
	// DexCAFile is a PEM CA bundle for an IdP with a private certificate;
	// verifies discovery, token and JWKS calls. Empty: system trust.
	DexCAFile string
	// DexAllowPrivateIP lets the issuer resolve to a private/loopback address
	// (an in-cluster Dex).
	DexAllowPrivateIP bool

	// Google provider (Provider == google).
	GoogleClientID     string
	GoogleClientSecret string

	// TrustedAudiences are the OAuth client ids whose IdP id_tokens are
	// accepted as bearers (SSO token forwarding): the platform client, and
	// the audiences the MCPServer requires — what the kube-apiserver trusts,
	// which every token muster forwards carries by construction (the chart
	// unions both). A portal session's id_token names the portal's own
	// client, not the platform client. Empty: only tokens this server issued
	// itself.
	TrustedAudiences []string
	// SSOAllowPrivateIPs lets the JWKS endpoint used for forwarded tokens
	// resolve to a private address (an in-cluster Dex).
	SSOAllowPrivateIPs bool
	// AllowPublicClientRegistration lets MCP clients register over DCR
	// without a token (labs only).
	AllowPublicClientRegistration bool
	// DownstreamOAuth puts the caller's IdP token on the request so every
	// Kubernetes API call is made as the caller instead of the ServiceAccount
	// (the apiserver must trust the IdP and the token's audience). The
	// ServiceAccount then holds no permissions, so a request whose caller has
	// no IdP token to present is refused (401) rather than run as nobody.
	DownstreamOAuth bool
}

type Server struct {
	// contains filtered or unexported fields
}