admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: address round-3 review (compose excerpt, ADR-004 notes, placeholder)

Browse Source 
- login-flow-v2.md: add commented-out NEXTCLOUD_OIDC_CLIENT_ID/_SECRET (with a
  "production: register a static client" note) to the Docker Compose excerpt so
  copy-pasters of the rendered snippet don't fall into the #907 DCR-expiry trap.
- ADR-004: rename "## Implementation Status" -> "## Historical Implementation
  Notes" and add a banner clarifying the steps were never completed and the
  ENABLE_TOKEN_EXCHANGE symbols no longer exist (the design was superseded).
- env.sample.oauth-multi-user: angle-bracket the TOKEN_ENCRYPTION_KEY
  placeholder for consistency with the OIDC client placeholders.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-06-14 12:33:01 +02:00
co-authored by Claude Opus 4.8
parent 72b7b2efa0
commit 45c518700b
3 changed files with 14 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ADR-004-mcp-application-oauth.md
+8 -3
View File
@@ -1539,11 +1539,16 @@ The **Progressive Consent architecture** solves the critical challenges of token
This architecture follows industry best practices for federated systems and positions the MCP server as a secure token broker in an enterprise identity ecosystem.
## Implementation Status
## Historical Implementation Notes
**Current Status**: Partially Implemented (Refactoring Required)
> These were the planned refactoring steps at the time this ADR was written.
> They were **never completed** — the design was superseded by ADR-022 (Login
> Flow v2) and ADR-023 (OAuth AS proxy) before this progressive-consent /
> token-exchange architecture was adopted. The `ENABLE_TOKEN_EXCHANGE` /
> `settings.enable_token_exchange` symbols referenced below no longer exist in
> the codebase. Retained for historical context only.
The current implementation (`nextcloud_mcp_server/auth/oauth_routes.py`) implements a **simplified hybrid flow** but needs refactoring to match the progressive consent architecture documented above:
The implementation at the time (`nextcloud_mcp_server/auth/oauth_routes.py`) was a **simplified hybrid flow** that would have needed refactoring to match the progressive consent architecture documented above:
### What's Currently Implemented ✅