Expand description
OAuth 2.1 authorization, as MCP’s revisions specify it.
Which revision requires what is authorization_model
in domain/. This module holds the decisions that follow from it, and they
are split by who makes them: token is the pure logic this crate owns and
can be tested without a socket, while the crypto and HTTP that turn a
presented string into claims live in adapters.
No scope vocabulary is defined here. The vendored spec names no scope
strings, so any table would be this crate inventing one and presenting it as
policy — see token::ScopePolicy.
Modules§
- authorizer
- Getting a bearer token for an MCP server.
- callback
- Handling the authorization callback: the redirect back from the browser.
- client
- Beginning an OAuth authorization flow: what the client sends the user to, and what it must keep until the user comes back.
- environment
- What the authorization flow needs from the outside world.
- flow
- The client-side decisions of the authorization flow that need no network.
- metadata
- The two metadata documents a client reads before it can authorize.
- redeem
- Completing the authorization-code exchange: trading the code for a token.
- registration
- Choosing a client registration mechanism and carrying it out.
Structs§
- NoScopes
- The fail-secure default: no scope string means anything.
- Token
Claims - What an adapter established about a presented token, before this crate’s own rules ran.
- Token
Policy - What the request is allowed to be, given the resource it reached and the revision it negotiated.
Enums§
- Refusal
- Why a presented token was refused.
- Source
Error - Why no claims could be established for a presented token.
Traits§
- Scope
Policy - What a deployment decides its own OAuth scope strings mean.
- Token
Source - Where verified claims come from.
Functions§
- authenticate
- Authenticates a presented bearer token end to end.
- verify
- Turns claims an adapter authenticated into an
AuthContext, or refuses.