pulseengine-mcp-auth 0.14.0

Authentication and authorization framework for MCP servers - PulseEngine MCP Framework
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

//! RFC 8414: Authorization Server Metadata
//!
//! Provides OAuth 2.1 server metadata discovery endpoint

use axum::{Json, http::StatusCode, response::IntoResponse};
use serde_json::json;

/// RFC 8414: Authorization Server Metadata
///
/// Returns metadata about the OAuth 2.1 authorization server.
/// Endpoint: GET /.well-known/oauth-authorization-server
///
/// # MCP Requirements
/// - Must advertise PKCE with S256 code challenge method
/// - Must support authorization_code grant type
/// - Must support dynamic client registration (RFC 7591)
/// - Must support resource indicators (RFC 8707)
pub async fn authorization_server_metadata() -> impl IntoResponse {
    // TODO: Load base_url from environment or configuration
    let base_url =
        std::env::var("BASE_URL").unwrap_or_else(|_| "http://localhost:3000".to_string());

    let metadata = json!({
        "issuer": base_url,
        "registration_endpoint": format!("{}/oauth/register", base_url),
        "authorization_endpoint": format!("{}/oauth/authorize", base_url),
        "token_endpoint": format!("{}/oauth/token", base_url),

        // OAuth 2.1 required parameters
        "response_types_supported": ["code"],
        "grant_types_supported": ["authorization_code", "refresh_token"],
        "code_challenge_methods_supported": ["S256"],

        // MCP-specific scopes
        "scopes_supported": [
            "mcp:read",
            "mcp:write",
            "mcp:tools",
            "mcp:resources",
            "mcp:prompts"
        ],

        // Token endpoint auth methods
        "token_endpoint_auth_methods_supported": ["client_secret_post"],

        // RFC 8707: Resource indicators support
        "resource_indicators_supported": true,
    });

    (StatusCode::OK, Json(metadata)).into_response()
}