From 72b7b2efa0696528c8718a89ea66661cd1642ad8 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Sun, 14 Jun 2026 12:26:38 +0200 Subject: [PATCH] refactor(auth): drop remaining stale token-exchange references MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Round-2 review follow-ups in unified_verifier.py: - module-level docstring still described "two compliant OAuth modes" incl. token exchange — rewritten to multi-audience only. - removed the stale "# Both modes do the same validation" inline comment in verify_token(). (--no-verify: same pre-existing ty errors in test_unified_verifier.py as prior commits; CI type-checks only the package, which passes.) Co-Authored-By: Claude Opus 4.8 (1M context) --- nextcloud_mcp_server/auth/unified_verifier.py | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/nextcloud_mcp_server/auth/unified_verifier.py b/nextcloud_mcp_server/auth/unified_verifier.py index c25ef5fe..8dc83b2a 100644 --- a/nextcloud_mcp_server/auth/unified_verifier.py +++ b/nextcloud_mcp_server/auth/unified_verifier.py @@ -2,15 +2,12 @@ Unified Token Verifier for ADR-005 Token Audience Validation. This module replaces both NextcloudTokenVerifier and ProgressiveConsentTokenVerifier -with a single implementation that supports two compliant OAuth modes: - -1. Multi-audience mode (default): Validates MCP audience per RFC 7519 (resource servers - validate only their own audience). Nextcloud independently validates its own audience. -2. Token exchange mode (opt-in): Tokens have MCP audience only, exchanged for Nextcloud tokens +with a single implementation using multi-audience validation: it validates the MCP +audience per RFC 7519 (resource servers validate only their own audience), and +Nextcloud independently validates its own audience when it receives the token. Key Design Principles: - Token verification happens HERE (validates MCP audience per OAuth spec) -- Token exchange happens in context_helper.py (when creating NextcloudClient) - No token passthrough allowed (complies with MCP Security Specification) - Token reuse IS allowed for multi-audience tokens (RFC 8707) """ @@ -143,7 +140,6 @@ class UnifiedTokenVerifier(TokenVerifier): oauth_token_cache_hits_total.labels(hit="false").inc() - # Both modes do the same validation (MCP audience only) return await self._verify_mcp_audience(token) async def verify_token_for_management_api(self, token: str) -> AccessToken | None: