Struct TokenExchangeAuthProvider 

pub struct TokenExchangeAuthProvider { /* private fields */ }

Auth provider that exchanges a subject token for a user-scoped delegated token via RFC 8693 Token Exchange.

Implementations

impl TokenExchangeAuthProvider

pub fn new( exchange_url: impl Into<String>, client_id: impl Into<String>, client_secret: impl Into<String>, agent_token: impl Into<String>, ) -> Self

Construct a provider without validating the exchange URL.

Backward-compatible constructor. For new code prefer TokenExchangeAuthProvider::try_new which validates the URL synchronously (scheme + literal-IP) and returns an Err for obvious misconfigurations (file://, http://127.0.0.1, etc.) instead of silently storing them. We log a tracing::error! here when the URL fails the sync check so misconfigured deployments are still loud, but defer to the redirect-policy defense-in-depth at request time.

pub fn try_new( exchange_url: impl Into<String>, client_id: impl Into<String>, client_secret: impl Into<String>, agent_token: impl Into<String>, ) -> Result<Self, Error>

Validating constructor: returns Err if the exchange URL fails the synchronous SSRF check (scheme allowlist + literal-IP blocklist).

SECURITY (F-MCP-1): use this when you can propagate the error to the caller. The redirect-policy and HTTPS enforcement still apply to any URL accepted here, so a hostile DNS rebind cannot leak the token.

pub fn with_tenant_id(self, tenant_id: Option<String>) -> Self

Set the NHI tenant ID for automatic client_credentials agent token fetch.

pub fn with_scopes(self, scopes: Vec<String>) -> Self

Set the OAuth scopes for the client_credentials agent token grant.

pub fn with_user_tokens( self, tokens: Arc<RwLock<HashMap<String, String>>>, ) -> Self

Set the user tokens map ("{tenant_id}:{user_id}" -> subject_token).

pub fn user_tokens(&self) -> &Arc<RwLock<HashMap<String, String>>>

Get a reference to the shared user tokens map for external population.

Trait Implementations

impl AuthProvider for TokenExchangeAuthProvider

fn auth_header_for<'a>( &'a self, user_id: &'a str, tenant_id: &'a str, ) -> Pin<Box<dyn Future<Output = Result<Option<String>, Error>> + Send + 'a>>

Return the Authorization header value for the given user/tenant context. Returns None if no auth is needed.

fn has_credentials(&self, user_id: &str, tenant_id: &str) -> bool

Check whether credentials exist for the given user/tenant without performing an exchange or network call. Used by the daemon to decide whether per-user MCP tool stamping is possible before actually resolving tokens.

fn auth_header_for_resource<'a>( &'a self, user_id: &'a str, tenant_id: &'a str, resource: Option<&'a str>, scopes: Option<&'a [String]>, ) -> Pin<Box<dyn Future<Output = Result<Option<String>, Error>> + Send + 'a>>

Return an Authorization header scoped to a specific resource and OAuth scopes.