orvanta_api/apis/
mcp_oauth_api.rs

1/*
2 * Orvanta API
3 *
4 * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
5 *
6 * The version of the OpenAPI document: 6.3.0
7 * Contact: contact@orvanta.cloud
8 * Generated by: https://openapi-generator.tech
9 */
10
11
12use reqwest;
13use serde::{Deserialize, Serialize};
14use crate::{apis::ResponseContent, models};
15use super::{Error, configuration};
16
17
18/// struct for typed errors of method [`create_mcp_o_auth_start`]
19#[derive(Debug, Clone, Serialize, Deserialize)]
20#[serde(untagged)]
21pub enum CreateMcpOAuthStartError {
22    UnknownValue(serde_json::Value),
23}
24
25/// struct for typed errors of method [`deny_mcp_o_auth_server_authorization`]
26#[derive(Debug, Clone, Serialize, Deserialize)]
27#[serde(untagged)]
28pub enum DenyMcpOAuthServerAuthorizationError {
29    Status400(),
30    UnknownValue(serde_json::Value),
31}
32
33/// struct for typed errors of method [`discover_mcp_o_auth`]
34#[derive(Debug, Clone, Serialize, Deserialize)]
35#[serde(untagged)]
36pub enum DiscoverMcpOAuthError {
37    UnknownValue(serde_json::Value),
38}
39
40/// struct for typed errors of method [`get_mcp_o_auth_client_metadata`]
41#[derive(Debug, Clone, Serialize, Deserialize)]
42#[serde(untagged)]
43pub enum GetMcpOAuthClientMetadataError {
44    UnknownValue(serde_json::Value),
45}
46
47/// struct for typed errors of method [`mcp_o_auth_callback`]
48#[derive(Debug, Clone, Serialize, Deserialize)]
49#[serde(untagged)]
50pub enum McpOAuthCallbackError {
51    UnknownValue(serde_json::Value),
52}
53
54/// struct for typed errors of method [`refresh_mcp_o_auth`]
55#[derive(Debug, Clone, Serialize, Deserialize)]
56#[serde(untagged)]
57pub enum RefreshMcpOAuthError {
58    UnknownValue(serde_json::Value),
59}
60
61/// struct for typed errors of method [`start_mcp_o_auth_popup`]
62#[derive(Debug, Clone, Serialize, Deserialize)]
63#[serde(untagged)]
64pub enum StartMcpOAuthPopupError {
65    UnknownValue(serde_json::Value),
66}
67
68
69/// Validates that the caller is a member of workspace_id and entitled to MCP OAuth, then returns a same-origin URL carrying a single-use nonce (valid 2 minutes, bound to the caller). Open that URL in a popup. Starting the flow takes a POST rather than a navigation so that a link on another page cannot start it (#1929).
70pub async fn create_mcp_o_auth_start(configuration: &configuration::Configuration, create_mcp_o_auth_start_request: models::CreateMcpOAuthStartRequest) -> Result<models::CreateMcpOAuthStart200Response, Error<CreateMcpOAuthStartError>> {
71    let local_var_configuration = configuration;
72
73    let local_var_client = &local_var_configuration.client;
74
75    let local_var_uri_str = format!("{}/mcp/oauth/start", local_var_configuration.base_path);
76    let mut local_var_req_builder = local_var_client.request(reqwest::Method::POST, local_var_uri_str.as_str());
77
78    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
79        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
80    }
81    if let Some(ref local_var_token) = local_var_configuration.bearer_access_token {
82        local_var_req_builder = local_var_req_builder.bearer_auth(local_var_token.to_owned());
83    };
84    local_var_req_builder = local_var_req_builder.json(&create_mcp_o_auth_start_request);
85
86    let local_var_req = local_var_req_builder.build()?;
87    let local_var_resp = local_var_client.execute(local_var_req).await?;
88
89    let local_var_status = local_var_resp.status();
90    let local_var_content = local_var_resp.text().await?;
91
92    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
93        crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).map_err(Error::from)
94    } else {
95        let local_var_entity: Option<CreateMcpOAuthStartError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
96        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
97        Err(Error::ResponseError(local_var_error))
98    }
99}
100
101/// Called by the consent page when the user clicks Deny, in both gateway and workspace mode. Validates redirect_uri against the client's registered list (exact match, https or loopback http only) and returns the client redirect carrying error=access_denied and the encoded state. The page navigates only to the returned URL (#1868).
102pub async fn deny_mcp_o_auth_server_authorization(configuration: &configuration::Configuration, deny_mcp_o_auth_server_authorization_request: models::DenyMcpOAuthServerAuthorizationRequest) -> Result<models::DenyMcpOAuthServerAuthorization200Response, Error<DenyMcpOAuthServerAuthorizationError>> {
103    let local_var_configuration = configuration;
104
105    let local_var_client = &local_var_configuration.client;
106
107    let local_var_uri_str = format!("{}/mcp/gateway/oauth/server/deny", local_var_configuration.base_path);
108    let mut local_var_req_builder = local_var_client.request(reqwest::Method::POST, local_var_uri_str.as_str());
109
110    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
111        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
112    }
113    if let Some(ref local_var_token) = local_var_configuration.bearer_access_token {
114        local_var_req_builder = local_var_req_builder.bearer_auth(local_var_token.to_owned());
115    };
116    local_var_req_builder = local_var_req_builder.json(&deny_mcp_o_auth_server_authorization_request);
117
118    let local_var_req = local_var_req_builder.build()?;
119    let local_var_resp = local_var_client.execute(local_var_req).await?;
120
121    let local_var_status = local_var_resp.status();
122    let local_var_content = local_var_resp.text().await?;
123
124    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
125        crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).map_err(Error::from)
126    } else {
127        let local_var_entity: Option<DenyMcpOAuthServerAuthorizationError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
128        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
129        Err(Error::ResponseError(local_var_error))
130    }
131}
132
133pub async fn discover_mcp_o_auth(configuration: &configuration::Configuration, discover_mcp_o_auth_request: models::DiscoverMcpOAuthRequest) -> Result<models::DiscoverMcpOAuth200Response, Error<DiscoverMcpOAuthError>> {
134    let local_var_configuration = configuration;
135
136    let local_var_client = &local_var_configuration.client;
137
138    let local_var_uri_str = format!("{}/mcp/oauth/discover", local_var_configuration.base_path);
139    let mut local_var_req_builder = local_var_client.request(reqwest::Method::POST, local_var_uri_str.as_str());
140
141    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
142        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
143    }
144    if let Some(ref local_var_token) = local_var_configuration.bearer_access_token {
145        local_var_req_builder = local_var_req_builder.bearer_auth(local_var_token.to_owned());
146    };
147    local_var_req_builder = local_var_req_builder.json(&discover_mcp_o_auth_request);
148
149    let local_var_req = local_var_req_builder.build()?;
150    let local_var_resp = local_var_client.execute(local_var_req).await?;
151
152    let local_var_status = local_var_resp.status();
153    let local_var_content = local_var_resp.text().await?;
154
155    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
156        crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).map_err(Error::from)
157    } else {
158        let local_var_entity: Option<DiscoverMcpOAuthError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
159        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
160        Err(Error::ResponseError(local_var_error))
161    }
162}
163
164/// Static client metadata document served for MCP servers that want to inspect Orvanta's registration parameters ahead of dynamic client registration.
165pub async fn get_mcp_o_auth_client_metadata(configuration: &configuration::Configuration, ) -> Result<models::GetMcpOAuthClientMetadata200Response, Error<GetMcpOAuthClientMetadataError>> {
166    let local_var_configuration = configuration;
167
168    let local_var_client = &local_var_configuration.client;
169
170    let local_var_uri_str = format!("{}/mcp/oauth/client-metadata.json", local_var_configuration.base_path);
171    let mut local_var_req_builder = local_var_client.request(reqwest::Method::GET, local_var_uri_str.as_str());
172
173    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
174        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
175    }
176
177    let local_var_req = local_var_req_builder.build()?;
178    let local_var_resp = local_var_client.execute(local_var_req).await?;
179
180    let local_var_status = local_var_resp.status();
181    let local_var_content = local_var_resp.text().await?;
182
183    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
184        crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).map_err(Error::from)
185    } else {
186        let local_var_entity: Option<GetMcpOAuthClientMetadataError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
187        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
188        Err(Error::ResponseError(local_var_error))
189    }
190}
191
192/// Handles the OAuth redirect from the MCP server, exchanges the code for tokens (PKCE, server-to-server), persists them encrypted per-workspace, and returns an HTML page that posts a message to window.opener and closes itself. Always returns 200 -- success/failure is conveyed via the posted message, never plaintext tokens.
193pub async fn mcp_o_auth_callback(configuration: &configuration::Configuration, state: &str, code: Option<&str>, error: Option<&str>, error_description: Option<&str>) -> Result<String, Error<McpOAuthCallbackError>> {
194    let local_var_configuration = configuration;
195
196    let local_var_client = &local_var_configuration.client;
197
198    let local_var_uri_str = format!("{}/mcp/oauth/callback", local_var_configuration.base_path);
199    let mut local_var_req_builder = local_var_client.request(reqwest::Method::GET, local_var_uri_str.as_str());
200
201    if let Some(ref local_var_str) = code {
202        local_var_req_builder = local_var_req_builder.query(&[("code", &local_var_str.to_string())]);
203    }
204    local_var_req_builder = local_var_req_builder.query(&[("state", &state.to_string())]);
205    if let Some(ref local_var_str) = error {
206        local_var_req_builder = local_var_req_builder.query(&[("error", &local_var_str.to_string())]);
207    }
208    if let Some(ref local_var_str) = error_description {
209        local_var_req_builder = local_var_req_builder.query(&[("error_description", &local_var_str.to_string())]);
210    }
211    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
212        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
213    }
214
215    let local_var_req = local_var_req_builder.build()?;
216    let local_var_resp = local_var_client.execute(local_var_req).await?;
217
218    let local_var_status = local_var_resp.status();
219    let local_var_content = local_var_resp.text().await?;
220
221    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
222        crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).map_err(Error::from)
223    } else {
224        let local_var_entity: Option<McpOAuthCallbackError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
225        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
226        Err(Error::ResponseError(local_var_error))
227    }
228}
229
230/// Uses the stored (encrypted) refresh token to obtain a new access token from the MCP server and updates the stored connection. The caller must be a member of workspace_id.
231pub async fn refresh_mcp_o_auth(configuration: &configuration::Configuration, refresh_mcp_o_auth_request: models::RefreshMcpOAuthRequest) -> Result<models::RefreshMcpOAuth200Response, Error<RefreshMcpOAuthError>> {
232    let local_var_configuration = configuration;
233
234    let local_var_client = &local_var_configuration.client;
235
236    let local_var_uri_str = format!("{}/mcp/oauth/refresh", local_var_configuration.base_path);
237    let mut local_var_req_builder = local_var_client.request(reqwest::Method::POST, local_var_uri_str.as_str());
238
239    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
240        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
241    }
242    if let Some(ref local_var_token) = local_var_configuration.bearer_access_token {
243        local_var_req_builder = local_var_req_builder.bearer_auth(local_var_token.to_owned());
244    };
245    local_var_req_builder = local_var_req_builder.json(&refresh_mcp_o_auth_request);
246
247    let local_var_req = local_var_req_builder.build()?;
248    let local_var_resp = local_var_client.execute(local_var_req).await?;
249
250    let local_var_status = local_var_resp.status();
251    let local_var_content = local_var_resp.text().await?;
252
253    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
254        crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).map_err(Error::from)
255    } else {
256        let local_var_entity: Option<RefreshMcpOAuthError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
257        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
258        Err(Error::ResponseError(local_var_error))
259    }
260}
261
262/// Opens in a popup. Consumes the nonce from POST /mcp/oauth/start (single-use, caller-bound), discovers OAuth metadata, registers a client (if needed), and redirects to the MCP server's authorization endpoint.
263pub async fn start_mcp_o_auth_popup(configuration: &configuration::Configuration, nonce: &str) -> Result<(), Error<StartMcpOAuthPopupError>> {
264    let local_var_configuration = configuration;
265
266    let local_var_client = &local_var_configuration.client;
267
268    let local_var_uri_str = format!("{}/mcp/oauth/start", local_var_configuration.base_path);
269    let mut local_var_req_builder = local_var_client.request(reqwest::Method::GET, local_var_uri_str.as_str());
270
271    local_var_req_builder = local_var_req_builder.query(&[("nonce", &nonce.to_string())]);
272    if let Some(ref local_var_user_agent) = local_var_configuration.user_agent {
273        local_var_req_builder = local_var_req_builder.header(reqwest::header::USER_AGENT, local_var_user_agent.clone());
274    }
275    if let Some(ref local_var_token) = local_var_configuration.bearer_access_token {
276        local_var_req_builder = local_var_req_builder.bearer_auth(local_var_token.to_owned());
277    };
278
279    let local_var_req = local_var_req_builder.build()?;
280    let local_var_resp = local_var_client.execute(local_var_req).await?;
281
282    let local_var_status = local_var_resp.status();
283    let local_var_content = local_var_resp.text().await?;
284
285    if !local_var_status.is_client_error() && !local_var_status.is_server_error() {
286        Ok(())
287    } else {
288        let local_var_entity: Option<StartMcpOAuthPopupError> = crate::from_str_patched/* Externally injected from /build.nu */(&local_var_content).ok();
289        let local_var_error = ResponseContent { status: local_var_status, content: local_var_content, entity: local_var_entity };
290        Err(Error::ResponseError(local_var_error))
291    }
292}
293
orvanta_api/apis/mcp_oauth_api.rs

orvanta_api/apis/
mcp_oauth_api.rs
