mcpbridge

type Config struct {
	// BaseURL is the gvsvd origin without a trailing slash, e.g. http://127.0.0.1:8989/api (Docker edge) or http://ghostvault:8080 inside Compose.
	BaseURL string
	// BearerToken is the session token or (plaintext-vault) actions token (initial value from env/file at startup).
	BearerToken string
	// TokenReloadPath is set when BearerToken came from a file, not GHOSTVAULT_BEARER_TOKEN / -bearer.
	// When non-empty, post() re-reads this file before each gvsvd request.
	TokenReloadPath string
	// DefaultVaultID and DefaultUserID fill tool args when the model omits them (from GHOSTVAULT_DEFAULT_VAULT_ID / GHOSTVAULT_DEFAULT_USER_ID).
	DefaultVaultID string
	DefaultUserID  string
	// HTTPClient is used for POST/GET to gvsvd. If nil, a client with a 125s timeout is used.
	HTTPClient *http.Client
}

type OAuthHTTP struct {
	AuthServerIssuer string
	ResourceURL      string
	MetadataURL      string
	// IntrospectionURL is the RFC 7662 token introspection endpoint (POST, form body token=…).
	IntrospectionURL          string
	IntrospectionClientID     string
	IntrospectionClientSecret string
	// RequiredScopes, if non-empty, must all appear on the token (introspection "scope" split on spaces).
	RequiredScopes []string
	// ScopesSupported is advertised in protected-resource metadata (RFC 9728). If nil, defaults to RequiredScopes.
	ScopesSupported []string
	// Upstream Auth0 (or any RFC 8414 AS) endpoints the facade on the MCP host delegates to.
	// Claude.ai currently ignores authorization_servers from RFC 9728 metadata and instead
	// builds /authorize, /token and /register on the MCP host itself (anthropics/claude-ai-mcp#82),
	// so gvmcp exposes a thin facade that 302s / proxies to these upstream URLs.
	UpstreamAuthorizeURL string
	UpstreamTokenURL     string
	UpstreamRegisterURL  string
	// AudienceURL is injected into /authorize and /token as the OAuth 2.0 "audience" parameter
	// (Auth0-specific extension) when the caller did not supply one, so the issued access token
	// is bound to the MCP resource identifier. Defaults to ResourceURL.
	AudienceURL string
	HTTPClient  *http.Client
}

type UpstreamOverrides struct {
	AuthorizeURL string
	TokenURL     string
	RegisterURL  string
	Audience     string
}