admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: round-4 reviewer nits

Browse Source 
Address four small items from the latest PR #743 review:

- login-flow-v2.md Compose example: add an inline comment +
  follow-up note pointing readers at Docker secrets for
  TOKEN_ENCRYPTION_KEY (the snippet is likely to be copy-pasted
  into production).
- auth-flows.md: rename the third column in the Astrolabe → MCP
  Server diagram from "Nextcloud OIDC" to "OIDC Provider" so the
  diagram matches the multi-IdP framing in the surrounding prose.
- login-flow-v2.md OAuth Endpoints section: rewrite the
  ambiguous "token issuance still comes from the IdP" line to
  make the cryptographic separation explicit — the MCP server
  exposes /token, but tokens are signed by the IdP's key and
  validated against its JWKS; the MCP server has no signing keys
  of its own.
- README.md auth bullet: replace the jargony "OAuth-to-MCP
  supported, with app-password conversion to Nextcloud" with the
  reviewer's clearer wording: "MCP clients authenticate via
  OAuth, the server handles Nextcloud app passwords
  transparently".

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-04-30 04:07:43 +02:00
co-authored by Claude Opus 4.7
parent 0c6b766e7e
commit 367816e4e4
3 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/login-flow-v2.md
+5 -1
View File
@@ -104,6 +104,8 @@ mcp-login-flow:
- NEXTCLOUD_MCP_SERVER_URL=http://localhost:8004
- NEXTCLOUD_PUBLIC_ISSUER_URL=http://localhost:8080
- ENABLE_LOGIN_FLOW=true
# Dev-only inline value. In production, mount via Docker secret and read
# from a *_FILE env var or a secrets-management init step.
- TOKEN_ENCRYPTION_KEY=<your-fernet-key>
- TOKEN_STORAGE_DB=/app/data/tokens.db
volumes:
@@ -111,6 +113,8 @@ mcp-login-flow:
- login-flow-oauth-storage:/app/.oauth
```
> **Production note:** `TOKEN_ENCRYPTION_KEY` is a credential — losing it makes every stored app password unrecoverable. Inline-environment values are fine for local development but should be passed via Docker secrets (or your platform's equivalent) in production. See [Configuration → Best Practices for Docker](configuration.md#for-docker).
The `--oauth` flag enables the OAuth/OIDC identity layer that Login Flow v2 builds on (user identity via OAuth session, Nextcloud access via app passwords).
## Per-User Provisioning Flow
@@ -226,7 +230,7 @@ Implementation: [`nextcloud_mcp_server/auth/scope_authorization.py`](../nextclou
## OAuth Endpoints
When `--oauth` is enabled, the MCP server exposes OAuth 2.1 endpoints. **These endpoints front the configured IdP** — discovery metadata, token issuance, and JWKS still come from whichever provider is selected via `OIDC_DISCOVERY_URL` (Nextcloud OIDC by default, or Keycloak / Cognito / etc.); the MCP server is not a standalone OAuth issuer.
When `--oauth` is enabled, the MCP server exposes OAuth 2.1 endpoints. **These endpoints front the configured IdP**: discovery metadata is sourced from the IdP, and tokens served via the MCP server's `/token` endpoint are signed by the IdP's key and validated against its JWKS — the MCP server has no signing keys of its own. The IdP is selected by `OIDC_DISCOVERY_URL` (Nextcloud OIDC by default, or Keycloak / Cognito / etc.).
| Endpoint | RFC | Purpose |
|----------|-----|---------|