feat(auth): implement OAuth AS proxy to fix audience mismatch (ADR-023)

Browse Source

MCP clients like Claude Code were unable to use tools because tokens
obtained directly from Nextcloud had the wrong audience claim. The MCP
server now acts as its own OAuth Authorization Server, proxying auth
to Nextcloud with its own client_id so tokens have the correct audience.

New endpoints: /.well-known/oauth-authorization-server, /oauth/token,
/oauth/register. Modified /oauth/authorize from pass-through to
intermediary pattern. PRM now points authorization_servers to the MCP
server instead of Nextcloud.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

...

This commit is contained in:

Chris Coutinho

2026-03-02 11:25:54 +01:00

co-authored by Claude Opus 4.6

parent d09ebf20cc

commit 9d1a84af5a

5 changed files with 849 additions and 106 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

third_party/astrolabe

Vendored

+1 -1

Submodule third_party/astrolabe updated: 672f572d5f...af53f1c02f