systemprompt_api/services/proxy/auth/mod.rs
1//! Proxy authentication and authorization for backend service access.
2//!
3//! Two cohesive halves:
4//!
5//! - `challenge`: validating credential presence and building the RFC 6750 /
6//! RFC 9728 `WWW-Authenticate` 401/403 OAuth challenges that drive MCP and
7//! agent clients into the OAuth discovery flow.
8//! - `access`: resolving a service's OAuth requirement from the agent / MCP
9//! registries and enforcing the required scopes against the authenticated
10//! user, with the session-cache fallback for already-established MCP
11//! sessions.
12//!
13//! Copyright (c) systemprompt.io — Business Source License 1.1.
14//! See <https://systemprompt.io> for licensing details.
15
16pub mod access;
17mod challenge;
18
19pub(crate) use access::{AccessValidator, mcp_oauth_requirement};
20pub use challenge::OAuthChallengeBuilder;
21pub(crate) use challenge::build_mcp_unknown_service_challenge;