Documentation
¶
Index ¶
- Variables
- func CredentialKey(serverURL string) string
- func NewHandler(ctx context.Context, opts HandlerOptions) (auth.OAuthHandler, error)
- func QuiesceCredentialWrites(handler auth.OAuthHandler)
- func SessionHasIssuerBinding(session *Session) bool
- func SessionHasUsableToken(session *Session) bool
- func SessionScopesCompatible(session *Session, configured []string) bool
- type HandlerOptions
- type LoopbackReceiver
- type Session
- type Store
Constants ¶
This section is empty.
Variables ¶
var ErrCredentialWritesQuiesced = errors.New("OAuth credential writes are quiesced")
var ErrNotFound = errors.New("oauth session not found")
ErrNotFound reports that no mcpx-owned OAuth session exists for a server.
Functions ¶
func CredentialKey ¶
CredentialKey returns a stable, non-secret key for a protected resource.
func NewHandler ¶
func NewHandler(ctx context.Context, opts HandlerOptions) (auth.OAuthHandler, error)
NewHandler restores a saved session when present and configures secure refresh persistence. Interactive authorization only occurs when AllowLogin is true.
func QuiesceCredentialWrites ¶
func QuiesceCredentialWrites(handler auth.OAuthHandler)
QuiesceCredentialWrites prevents an OAuth handler from persisting any token after this call returns, including from SDK reconnect goroutines that outlive transport Close.
func SessionHasIssuerBinding ¶
SessionHasIssuerBinding reports whether a saved OAuth grant is bound to the authorization server that issued its client credentials.
func SessionHasUsableToken ¶
SessionHasUsableToken reports whether a saved session can authenticate now or refresh without another interactive login.
func SessionScopesCompatible ¶
SessionScopesCompatible reports whether a saved OAuth grant can satisfy the explicitly configured scopes. An empty configured set accepts the grant's discovered scopes, matching NewHandler behavior.
Types ¶
type HandlerOptions ¶
type HandlerOptions struct {
ServerURL string
RedirectURL string
Fetcher auth.AuthorizationCodeFetcher
Store Store
Scopes []string
ClientMetadataURL string
AllowLogin bool
}
HandlerOptions configures an MCP OAuth authorization-code handler.
type LoopbackReceiver ¶
type LoopbackReceiver struct {
// contains filtered or unexported fields
}
LoopbackReceiver owns a temporary loopback callback listener for an interactive OAuth login.
func NewLoopbackReceiver ¶
func NewLoopbackReceiver(output io.Writer) (*LoopbackReceiver, error)
NewLoopbackReceiver binds an unpredictable local port and starts the OAuth callback server. It never accepts non-loopback connections.
func (*LoopbackReceiver) Close ¶
func (r *LoopbackReceiver) Close() error
Close stops the callback server.
func (*LoopbackReceiver) Fetch ¶
func (r *LoopbackReceiver) Fetch(ctx context.Context, args *auth.AuthorizationArgs) (*auth.AuthorizationResult, error)
Fetch prints the authorization URL and waits for the redirect. Requiring the user to open it prevents an untrusted authorization server from driving the system browser through redirects into a local or private network.
func (*LoopbackReceiver) RedirectURL ¶
func (r *LoopbackReceiver) RedirectURL() string
RedirectURL is the exact loopback URI registered with the authorization server.
type Store ¶
type Store interface {
Load(key string) (*Session, error)
Save(key string, session *Session) error
Delete(key string) error
}
Store is the credential boundary used by OAuth clients. Implementations must keep serialized sessions out of repository and ordinary config files.
func NewKeyringStore ¶
func NewKeyringStore() Store
NewKeyringStore returns the production OS credential-store adapter.
Source Files