Documentation
¶
Overview ¶
Package mcpauth implements the MCP / OAuth 2.1 authorization surface: RFC 8707 resource indicators, RFC 9728 protected-resource metadata, and the RFC 6750/9728 WWW-Authenticate challenges resource servers return.
Index ¶
- func CanonicalizeResource(raw string) (string, error)
- func Challenge(w http.ResponseWriter, status int, resourceMetadata, errCode, errDesc string)
- func ProtectedResourceMetadataHandler(resourceURI, issuerURL string) http.HandlerFunc
- func ResourceMatches(requested, allowed string) bool
- type ProtectedResourceMetadata
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CanonicalizeResource ¶
CanonicalizeResource validates and canonicalizes an RFC 8707 resource indicator. The resource must be an absolute URI, https (or http only for loopback in dev), with no fragment; the scheme and host are lowercased and a default port removed so that semantically-equal resources compare equal and a resource-server audience cannot be confused by trivial string variations.
func Challenge ¶
func Challenge(w http.ResponseWriter, status int, resourceMetadata, errCode, errDesc string)
Challenge writes an RFC 6750 / RFC 9728 WWW-Authenticate header and status. A bare challenge (no error) is sent when no credentials were presented; an error is added only when a token was presented and rejected. resourceMetadata points the client at the protected-resource metadata document.
func ProtectedResourceMetadataHandler ¶
func ProtectedResourceMetadataHandler(resourceURI, issuerURL string) http.HandlerFunc
ProtectedResourceMetadataHandler serves RFC 9728 metadata for a resource whose authorization server is issuerURL. Tokens are only accepted in the Authorization header (never the query string), per the MCP spec.
func ResourceMatches ¶
ResourceMatches reports whether a requested resource matches an allowed one after canonicalization. A resource that fails to canonicalize never matches.
Types ¶
type ProtectedResourceMetadata ¶
type ProtectedResourceMetadata struct {
Resource string `json:"resource"`
AuthorizationServers []string `json:"authorization_servers"`
BearerMethodsSupported []string `json:"bearer_methods_supported"`
ScopesSupported []string `json:"scopes_supported,omitempty"`
}
ProtectedResourceMetadata is the RFC 9728 document a resource server publishes at /.well-known/oauth-protected-resource so a client can discover which authorization server to use, and how to present tokens.
Source Files