rest

Documentation

Overview

Package rest provides OAuth 2.1 HTTP handlers for the MCP server.

Index

• Variables
• type Handler
  • func NewHandler(p HandlerParams) (*Handler, error)
  • func (h *Handler) HandleAuthServerMetadata(w http.ResponseWriter, _ *http.Request)
  • func (h *Handler) HandleAuthorize(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) HandleCallback(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request)
  • func (h *Handler) HandleToken(w http.ResponseWriter, r *http.Request)
• type HandlerParams

Variables

var Module = fx.Module("rest",
	fx.Provide(NewHandler),
)

Module provides the OAuth HTTP handler via DI.

Types

type Handler

type Handler struct {
	// contains filtered or unexported fields
}

Handler implements the OAuth 2.1 HTTP handlers.

func NewHandler

func NewHandler(p HandlerParams) (*Handler, error)

NewHandler creates an OAuth Handler from DI-injected dependencies.

func (*Handler) HandleAuthServerMetadata

func (h *Handler) HandleAuthServerMetadata(w http.ResponseWriter, _ *http.Request)

HandleAuthServerMetadata serves the OAuth 2.0 Authorization Server Metadata at GET /.well-known/oauth-authorization-server.

func (*Handler) HandleAuthorize

func (h *Handler) HandleAuthorize(w http.ResponseWriter, r *http.Request)

HandleAuthorize handles GET /oauth/authorize. It validates PKCE parameters, generates an HMAC-signed state containing the original params, and redirects to GitHub's OAuth authorize endpoint.

func (*Handler) HandleCallback

func (h *Handler) HandleCallback(w http.ResponseWriter, r *http.Request)

HandleCallback handles GET /oauth/callback. It validates the HMAC-signed state, exchanges the GitHub authorization code for an access token, fetches the GitHub user, checks the allowlist, generates an auth code, and redirects back to the client.

func (*Handler) HandleRegister

func (h *Handler) HandleRegister(w http.ResponseWriter, r *http.Request)

HandleRegister handles POST /oauth/register for dynamic client registration per RFC 7591.

func (*Handler) HandleToken

func (h *Handler) HandleToken(w http.ResponseWriter, r *http.Request)

HandleToken handles POST /oauth/token. It supports grant_type=authorization_code (with PKCE validation) and grant_type=refresh_token (with token rotation).

type HandlerParams

type HandlerParams struct {
	fx.In

	Store                       *auth.Store
	AllowedUsers                auth.AllowedUsers
	GitHubClientID              auth.GitHubClientID
	GitHubClientSecret          auth.GitHubClientSecret
	JWTSecret                   auth.JWTSecret
	Issuer                      auth.Issuer
	AuthorizationServerMetadata *auth.AuthorizationServerMetadata
	GitHubClient                *github.Client
}

HandlerParams holds the DI-injected dependencies for the OAuth Handler.