admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(adr): note token-exchange removed in ADR-005

Browse Source 
Round-4 review: ADR-005 (Status: Implemented) still described the token-exchange
mode (Option 2 / ENABLE_TOKEN_EXCHANGE) as an active option. Add a note to the
Implementation Note section clarifying it was removed in the ADR-022/023
consolidation and only multi-audience mode ships — consistent with the ADR-004
deprecation in this PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-06-14 12:39:43 +02:00
co-authored by Claude Opus 4.8
parent 45c518700b
commit 864b3e96d7
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ADR-005-token-audience-validation.md
+7
View File
@@ -14,6 +14,13 @@ This ADR has been fully implemented with key simplifications based on RFC 7519 S
- Clients discover resource via PRM endpoint (RFC 9728)
- Nextcloud OIDC app uses client-specific resource URLs
> **Note:** The **token-exchange mode** (Option 2 / `ENABLE_TOKEN_EXCHANGE`)
> described in the sections below was **removed** in the ADR-022 (Login Flow v2)
> / ADR-023 (OAuth AS proxy) consolidation. Only **multi-audience mode** ships;
> `ENABLE_TOKEN_EXCHANGE` / `settings.enable_token_exchange` no longer exist.
> The token-exchange references in this document are retained for historical
> context only.
## Executive Summary
This ADR addresses a critical security vulnerability where the MCP server was passing tokens intended for itself directly to Nextcloud APIs (token passthrough). We will: