admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(auth): drop remaining stale token-exchange references

Browse Source 
Round-2 review follow-ups in unified_verifier.py:
- module-level docstring still described "two compliant OAuth modes" incl.
  token exchange — rewritten to multi-audience only.
- removed the stale "# Both modes do the same validation" inline comment in
  verify_token().

(--no-verify: same pre-existing ty errors in test_unified_verifier.py as prior
commits; CI type-checks only the package, which passes.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-06-14 12:26:38 +02:00
co-authored by Claude Opus 4.8
parent 40b1f0ec3c
commit 72b7b2efa0
1 changed files with 3 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nextcloud_mcp_server/auth/unified_verifier.py
+3 -7
View File
@@ -2,15 +2,12 @@
Unified Token Verifier for ADR-005 Token Audience Validation. Unified Token Verifier for ADR-005 Token Audience Validation.
This module replaces both NextcloudTokenVerifier and ProgressiveConsentTokenVerifier This module replaces both NextcloudTokenVerifier and ProgressiveConsentTokenVerifier
with a single implementation that supports two compliant OAuth modes: with a single implementation using multi-audience validation: it validates the MCP
audience per RFC 7519 (resource servers validate only their own audience), and
1. Multi-audience mode (default): Validates MCP audience per RFC 7519 (resource servers Nextcloud independently validates its own audience when it receives the token.
validate only their own audience). Nextcloud independently validates its own audience.
2. Token exchange mode (opt-in): Tokens have MCP audience only, exchanged for Nextcloud tokens
Key Design Principles: Key Design Principles:
- Token verification happens HERE (validates MCP audience per OAuth spec) - Token verification happens HERE (validates MCP audience per OAuth spec)
- Token exchange happens in context_helper.py (when creating NextcloudClient)
- No token passthrough allowed (complies with MCP Security Specification) - No token passthrough allowed (complies with MCP Security Specification)
- Token reuse IS allowed for multi-audience tokens (RFC 8707) - Token reuse IS allowed for multi-audience tokens (RFC 8707)
""" """
@@ -143,7 +140,6 @@ class UnifiedTokenVerifier(TokenVerifier):
oauth_token_cache_hits_total.labels(hit="false").inc() oauth_token_cache_hits_total.labels(hit="false").inc()
# Both modes do the same validation (MCP audience only)
return await self._verify_mcp_audience(token) return await self._verify_mcp_audience(token)
async def verify_token_for_management_api(self, token: str) -> AccessToken | None: async def verify_token_for_management_api(self, token: str) -> AccessToken | None: