Struct OAuthServer 

pub struct OAuthServer { /* private fields */ }

OAuth 2.0/2.1 authorization server.

This server contains an OAuth authorization-code path that requires PKCE. That implementation policy is not an OAuth profile-conformance claim.

Implementations

impl OAuthServer

pub fn new(config: OAuthServerConfig) -> Self

Creates a new OAuth server with the given configuration.

Invalid configurations remain fail-closed: mutation methods validate the configuration before changing state. Use Self::try_new to reject invalid configuration eagerly.

pub fn with_approval_backend( config: OAuthServerConfig, approval_backend: Arc<dyn AuthorizationApprovalBackend>, ) -> Self

Creates an OAuth server with an installed authorization/consent backend.

The backend is called exactly once after request and client validation, and before credential generation or state mutation. The default Self::new constructor installs a fail-closed deny-all backend.

pub fn try_new(config: OAuthServerConfig) -> Result<Self, OAuthError>

Creates a new OAuth server after validating its configuration.

Errors

Returns an error for invalid PKCE bounds, state caps outside the hard per-field or aggregate retention envelope, incoherent state caps, or unsafe token lifetimes.

pub fn try_with_approval_backend( config: OAuthServerConfig, approval_backend: Arc<dyn AuthorizationApprovalBackend>, ) -> Result<Self, OAuthError>

Creates a validated OAuth server with an installed approval backend.

pub fn with_defaults() -> Self

Creates a new OAuth server with default configuration.

pub fn config(&self) -> &OAuthServerConfig

Returns the server configuration.

pub fn register_client(&self, client: OAuthClient) -> Result<(), OAuthError>

Registers a new OAuth client.

Errors

Returns an error if:

• Public client fields were mutated into an inconsistent shape
• Client metadata exceeds a retained-value or retained-count bound
• A client with the same ID already exists
• Public clients are not allowed and the client has no secret
• The configured client capacity has been reached

pub fn unregister_client(&self, client_id: &str) -> Result<(), OAuthError>

Unregisters an OAuth client.

This also revokes all tokens issued to the client.

pub fn get_client(&self, client_id: &str) -> Option<OAuthClientMetadata>

Gets secret-free metadata for a registered client by ID.

Confidential client credentials are never cloned into this administrative read model.

pub fn list_clients(&self) -> Vec<OAuthClientMetadata>

Lists secret-free metadata for all registered clients.

Confidential client credentials are never cloned into this administrative read model.

pub fn authorize( &self, request: &AuthorizationRequest, ) -> Result<(String, String), OAuthError>

Validates an authorization request, obtains one backend approval, and creates an authorization code only for a matching approved decision.

Returns

Returns the authorization code and redirect URI on success.

pub fn token(&self, request: &TokenRequest) -> Result<TokenResponse, OAuthError>

Exchanges an authorization code or refresh token for tokens.

pub fn revoke( &self, token: &str, client_id: &str, client_secret: Option<&str>, ) -> Result<(), OAuthError>

Revokes a token (access or refresh).

Per RFC 7009, this always returns success even if the token was not found.

pub fn validate_access_token(&self, token: &str) -> Option<OAuthToken>

Validates an access token and returns its metadata.

This is used internally and by the OAuthTokenVerifier.

pub fn token_verifier(self: &Arc<Self>) -> OAuthTokenVerifier

Creates a token verifier for use with MCP crate::auth::TokenAuthProvider.

pub fn cleanup_expired(&self)

Removes expired tokens, authorization codes, and revocation tombstones.

Mutating operations already perform this cleanup opportunistically. Call this during read-only workloads when prompt reclamation matters.

pub fn stats(&self) -> OAuthServerStats

Returns statistics about the server state.