2 Commits

Include renames

Author	SHA1	Message	Date
Chris CoutinhoandClaude	c896a2de63	feat: Complete ADR-004 Progressive Consent OAuth flows implementation ... Implement dual OAuth flows for Progressive Consent architecture: Flow 1 (Client Authentication): - Client authenticates directly to IdP with its own client_id - Server validates client_id against ALLOWED_MCP_CLIENTS whitelist - Issues tokens with aud: "mcp-server" for MCP authentication only - Progressive mode detected via ENABLE_PROGRESSIVE_CONSENT env var Flow 2 (Resource Provisioning): - New endpoints: /oauth/authorize-nextcloud, /oauth/callback-nextcloud - MCP server acts as OAuth client for delegated Nextcloud access - Stores master refresh tokens with flow_type and audience metadata - Returns success HTML page after provisioning completion Scope Authorization Updates: - Added ProvisioningRequiredError for missing Flow 2 provisioning - Decorator checks if Nextcloud scopes require provisioning in Progressive mode - Validates token has Nextcloud scopes before allowing access Storage Schema Enhancements: - Added flow_type, is_provisioning, requested_scopes to oauth_sessions - Enhanced store_oauth_session to support Progressive Consent metadata - Maintains backward compatibility with hybrid flow This completes the Progressive Consent implementation, enabling: - Explicit user consent for resource access - Stateless server by default (no automatic provisioning) - Clear separation between authentication and resource access - Defense in depth with audience-specific tokens 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-11-03 08:14:23 +01:00
Chris CoutinhoandClaude	babd60e08b	feat: Implement ADR-004 Hybrid Flow with comprehensive integration tests ... Implement the ADR-004 Hybrid Flow OAuth pattern where the MCP server intercepts the OAuth callback to obtain master refresh tokens while maintaining PKCE security for clients. ## Implementation ### OAuth Routes (ADR-004 Hybrid Flow) - Add `/oauth/authorize` endpoint: Intercepts client OAuth initiation - Add `/oauth/callback` endpoint: Receives IdP callback, stores master token - Add `/oauth/token` endpoint: Exchanges MCP code for client access token - Implement PKCE code challenge/verifier validation - Store OAuth sessions with state/challenge correlation ### MCP Server Integration - Update `setup_oauth_config()` to return client_id and client_secret - Initialize OAuth context in Starlette lifespan for login routes - Add OAuth session storage to RefreshTokenStorage - Configure authlib dependency for OAuth flow management ### Integration Tests - Create `test_adr004_hybrid_flow.py` with Playwright automation - Add `adr004_hybrid_flow_mcp_client` session-scoped fixture - Test MCP session establishment with hybrid flow token - Test tool execution using stored refresh tokens (on-behalf-of pattern) - Test persistent access across multiple operations - All tests passing: ✅ 3 passed in 8.82s ### Documentation - Update ADR-004 with comprehensive Testing section - Add integration test commands and coverage details - Document test implementation and verification steps - Create TESTING_INSTRUCTIONS.md for manual and automated testing - Include manual test scripts for reference/debugging ## What This Enables ✅ PKCE code challenge/verifier flow ✅ MCP server intercepts OAuth callback and stores master refresh token ✅ Client receives MCP access token (not master token) ✅ MCP session establishment with hybrid flow token ✅ Tool execution using stored refresh tokens (on-behalf-of pattern) ✅ Multiple operations without re-authentication ✅ Proper token isolation (client never sees master token) ## Testing Run ADR-004 integration tests: ```bash uv run pytest tests/server/oauth/test_adr004_hybrid_flow.py --browser firefox -v ``` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-11-03 02:18:30 +01:00