feat(auth): add reusable OAuth2 base helper library#3198
Open
crivetimihai wants to merge 1 commit intomainfrom
Open
feat(auth): add reusable OAuth2 base helper library#3198crivetimihai wants to merge 1 commit intomainfrom
crivetimihai wants to merge 1 commit intomainfrom
Conversation
Introduce a canonical OAuth2/OIDC helper module for token validation, claims extraction, metadata discovery, token exchange/refresh, and scope operations so auth plugins can share consistent protocol logic. Add focused unit coverage for the new helper APIs and RFC-oriented behaviors. Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: hany1 <hany1@tcd.ie>
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Introduce a canonical OAuth2/OIDC helper module for token validation, claims extraction, metadata discovery, token exchange/refresh, and scope operations so auth plugins can share consistent protocol logic. Add focused unit coverage for the new helper APIs and RFC-oriented behaviors.
🔗 Related Issue
Closes #
📝 Summary
mcpgateway/oauth2/base.pyvalidate_token()with JWKS JWT verification and introspection fallbackextract_claims()canonical claim mappingdiscover_authorization_server_metadata()(RFC 8414)discover_oidc_metadata()(OIDC discovery)discover_protected_resource_metadata()(RFC 9728)exchange_token()(RFC 8693)refresh_token()(RFC 6749)mcpgateway/oauth2/models.pytyped request/response config modelsmcpgateway/oauth2/exceptions.pyunified OAuth2 error typesmcpgateway/oauth2/__init__.pypublic exportstests/unit/mcpgateway/oauth2/test_base.pyfocused unit tests for helper APIs and error paths🏷️ Type of Change
🧪 Verification
make lintmake testmake coverage✅ Checklist
make black isort pre-commit)📓 Notes (optional)
This PR delivers the OAuth2 base helper layer requested by #1434 and is designed to be consumed by plugin/auth flows in the #1422 epic.