macp-auth 0.4.0

MACP authentication: request identity derivation, the security layer (rate limits, payload limits), and bearer/JWT auth resolvers.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

use crate::auth::resolver::{AuthError, AuthResolver, ResolvedIdentity};
use crate::security::AuthIdentity;
use std::collections::HashMap;
use tonic::metadata::MetadataMap;

/// Resolves opaque bearer tokens against a pre-loaded identity map.
/// This is the existing `MACP_AUTH_TOKENS_JSON` mechanism.
pub struct StaticBearerResolver {
    identities: HashMap<String, AuthIdentity>,
}

impl StaticBearerResolver {
    pub fn new(identities: HashMap<String, AuthIdentity>) -> Self {
        tracing::info!(
            count = identities.len(),
            "static bearer resolver initialized"
        );
        Self { identities }
    }

    fn extract_bearer(metadata: &MetadataMap) -> Option<String> {
        metadata
            .get("authorization")
            .and_then(|v| v.to_str().ok())
            .and_then(|v| v.strip_prefix("Bearer "))
            .map(str::to_string)
            .or_else(|| {
                metadata
                    .get("x-macp-token")
                    .and_then(|v| v.to_str().ok())
                    .map(str::to_string)
            })
    }
}

#[async_trait::async_trait]
impl AuthResolver for StaticBearerResolver {
    fn name(&self) -> &str {
        "static_bearer"
    }

    async fn resolve(&self, metadata: &MetadataMap) -> Result<Option<ResolvedIdentity>, AuthError> {
        let token = match Self::extract_bearer(metadata) {
            Some(t) => t,
            None => return Ok(None),
        };

        // JWT-shaped tokens (contain dots) are not ours — defer to JWT resolver
        if token.contains('.') {
            return Ok(None);
        }

        match self.identities.get(&token) {
            Some(identity) => Ok(Some(ResolvedIdentity {
                sender: identity.sender.clone(),
                allowed_modes: identity.allowed_modes.clone(),
                can_start_sessions: identity.can_start_sessions,
                max_open_sessions: identity.max_open_sessions,
                can_manage_mode_registry: identity.can_manage_mode_registry,
                is_observer: identity.is_observer,
                resolver: "static_bearer".to_string(),
            })),
            None => Err(AuthError::InvalidCredential(
                "token not found in identity map".to_string(),
            )),
        }
    }
}