Chris CoutinhoandClaude Opus 4.6 5730313574 refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation ...

Nextcloud doesn't support OAuth bearer tokens without upstream patches,
making the RFC 8693 token exchange path untestable and dead code.

Removed:
- nextcloud_mcp_server/auth/token_exchange.py (597 lines)
- nextcloud_mcp_server/auth/keycloak_oauth.py (586 lines)
- OAUTH_TOKEN_EXCHANGE deployment mode from AuthMode enum
- get_session_client_from_context() from context_helper.py
- get_session_token() from token_broker.py
- enable_token_exchange / token_exchange_cache_ttl config fields
- oauth_token_exchange_total Prometheus metric
- Keycloak fixture block from tests/conftest.py (~408 lines)
- Token exchange unit tests from test_config_validators.py,
  test_unified_verifier.py, test_management_status_endpoint.py

Preserved:
- Multi-audience OAuth mode (OAUTH_SINGLE_AUDIENCE)
- Login Flow v2 provisioning with elicitation support
- Token broker background token management
- All existing test coverage for non-exchange paths

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-03 00:22:20 +02:00

..

static

feat: add Tailscale Funnel config for Claude AI connector testing

2026-03-29 21:00:00 +02:00

templates

feat(vector): add Deck card vector search with visualization support

2025-12-13 23:51:18 +01:00

__init__.py

feat: Implement ADR-005 unified token verifier to eliminate token passthrough vulnerability

2025-11-05 18:53:14 +01:00

astrolabe_client.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00

bearer_auth.py

feat(server): Experimental support for OAuth2/OIDC authentication

2025-10-14 01:22:15 +02:00

browser_oauth_routes.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

client_registration.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

client_registry.py

feat(auth): implement OAuth AS proxy to fix audience mismatch (ADR-023)

2026-03-02 11:25:54 +01:00

context_helper.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

elicitation.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

login_flow.py

fix: address PR review — XSS escape, asyncio→anyio, URL rewrite dedup

2026-03-30 08:51:41 +02:00

oauth_routes.py

fix: allow HTTPS redirect URIs for non-localhost OAuth clients

2026-03-29 19:03:25 +02:00

permissions.py

feat: add webhook management UI and BeforeNodeDeletedEvent support

2025-11-11 20:35:08 +01:00

provision_routes.py

fix: require bearer token on provision endpoints (open redirect mitigation)

2026-03-31 17:09:37 +02:00

provisioning_decorator.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

scope_authorization.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

session_backend.py

fix: restructure routes to prevent SessionAuthBackend from interfering with FastMCP OAuth

2025-11-04 03:34:53 +01:00

storage.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

token_broker.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

token_utils.py

fix: address review feedback — security, caching, CI 429 retry

2026-03-02 17:22:23 +01:00

unified_verifier.py

refactor: remove RFC 8693 token exchange and Keycloak OAuth implementation

2026-04-03 00:22:20 +02:00

userinfo_routes.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

viz_routes.py

refactor: enforce PLC0415 (import-outside-top-level) for source code

2026-02-20 08:04:50 +01:00

webhook_routes.py

feat: add self-signed SSL certificate support for Nextcloud connections

2026-02-16 09:21:21 +01:00