oauth

func MetadataURLFor ¶ added in v2.7.1

func MetadataURLFor(resourceID string) string

MetadataURLFor derives the RFC 9728 §3 protected-resource metadata URL from a resource identifier: the well-known path segment is inserted between the host component and the resource's path, so https://mcp.example.com/gitlab advertises its metadata at https://mcp.example.com/.well-known/oauth-protected-resource/gitlab and a path-less resource at the bare well-known URI. The identifier is validated at config load; a parse failure here would be a programming error, so the fallback simply appends the well-known path.

func NewGitLabVerifier ¶

func NewGitLabVerifier(gitlabURL string, skipTLS bool, cacheTTL time.Duration, cache *TokenCache) auth.TokenVerifier

NewGitLabVerifier returns an auth.TokenVerifier that validates Bearer tokens by calling the GitLab /api/v4/user endpoint. Verified identities are cached in cache (if non-nil) to avoid redundant API calls.

The returned verifier populates auth.TokenInfo with:

• UserID: the GitLab user's numeric ID (as string)
• Extra["username"]: the GitLab user's login name
• Extra["token"]: the raw token (for downstream GitLab client creation)
• Expiration: now + cacheTTL (so the SDK middleware honors TTL)

func NewProtectedResourceHandler ¶

func NewProtectedResourceHandler(resourceURL, gitlabURL, requiredScope string) http.Handler

NewProtectedResourceHandler returns an http.Handler that serves RFC 9728 Protected Resource Metadata. MCP clients use this endpoint to discover the GitLab authorization server associated with this resource.

requiredScope is the GitLab scope this deployment actually needs, which a client reads from scopes_supported to build its authorization request. It is the least privilege that works: a server that can only read asks for read_api rather than making every user grant full api.

The handler is registered at /.well-known/oauth-protected-resource.

func NormalizeAuthHeader ¶

func NormalizeAuthHeader(next http.Handler) http.Handler

NormalizeAuthHeader is HTTP middleware that converts GitLab's PRIVATE-TOKEN header into a standard Authorization: Bearer header. This allows the SDK's RequireBearerToken middleware to handle both OAuth tokens and legacy PRIVATE-TOKEN headers through a unified pipeline.

If the request already has an Authorization header, PRIVATE-TOKEN is ignored.

func RequiredScope ¶ added in v2.7.4

func RequiredScope(readOnly, safeMode bool) string

RequiredScope reports the least-privilege GitLab scope a deployment needs: read_api when no request can reach GitLab as a write, api otherwise. Safe mode counts as read-only here because it answers mutating calls with a preview instead of forwarding them.