mcpremote

type AuthServer interface {
	// VerifyAccessToken returns the re-gated user and the grant of a
	// token; errors.Is(err, auth.ErrInvalidToken) means 401, anything else
	// an infrastructure failure.
	VerifyAccessToken(ctx context.Context, raw string) (*identity.User, *auth.Grant, error)
	// Challenge is the exact WWW-Authenticate value for a token error (nil:
	// the missing-token form).
	Challenge(err error) string
	ResourceMetadataURL() string // M
	Resource() string            // R
	Issuer() string              // P, the hub origin
	// AllowedOrigin reports whether an Origin other than the hub's may
	// call the endpoint (the origins of mcp.redirect_uris and mcp.clients).
	AllowedOrigin(origin string) bool
	MaxBodyBytes() int64
}

type Options struct {
	Config *config.Config
	// Auth is the authorization server (auth.MCPOf); nil or disabled
	// answers 404 everywhere.
	Auth  AuthServer
	Sites *sites.Registry // default: a registry over Blob
	Blob  blob.Store      // default: Sites.Store()
	// Docs holds the cross-replica publish lease (_system/_mcp_locks).
	Docs docstore.Store
	// Gateway publishes; nil when deploy.embedded_gateway is false.
	Gateway *deploy.Gateway
	// DocsFor returns backyard_docs topics (default mcpserver.DefaultDocs).
	DocsFor func(topic string) (string, error)
	// Allow is the per-user request limit (ratelimit.API) for the key
	// "user:<id>"; nil means unlimited.
	Allow func(key string) (bool, time.Duration)
	// OnPublish runs after every backyard_publish that reached the
	// gateway, ok or not (PurgeSite, ObserveDeploy("mcp", …)).
	OnPublish func(site string, ok bool)
	// RequestOrigin returns the client-visible origin (scheme://host[:port],
	// lowercase) of r, honouring trusted proxy headers; default: from r.TLS
	// and r.Host.
	RequestOrigin func(r *http.Request) string
	// ClientIP returns the caller's address for audit records; default:
	// the host of r.RemoteAddr.
	ClientIP func(r *http.Request) string
	Version  string // serverInfo.version (default version.Version)
	Logger   *slog.Logger
	Now      func() time.Time
}