Altinity / altinity-mcp / 25912856463

80%

main: 79%

Build Type

Pull #116

github

Committed by BorisTyshkevich

Commit Message

oauth: CIMD inbound + DCR removal + HA replay (#115)

Replace Dynamic Client Registration with OAuth Client ID Metadata Documents
as the only inbound MCP OAuth client mechanism. Aligns altinity-mcp with the
MCP authorization spec direction (DCR retired 2025-11-25 in favor of CIMD)
and lets the upstream IdP be the cross-replica replay oracle.

CIMD resolver (cmd/altinity-mcp/cimd.go, new):
- HTTPS-only URL validation: no userinfo/fragment/query, port 443 only,
  dot-segment + encoded-slash + IDN normalization rejection.
- SSRF-safe fetcher: custom DialContext explicitly resolves DNS, blocks
  loopback / RFC1918 / link-local / multicast / IPv6 ULA / CGNAT / 0.0.0.0/8
  / 192.0.0.0/24, pins dial to a validated IP, post-dial address re-check,
  no env proxy, no redirects, 3s timeout, 5 KiB body limit, JSON-only.
- Schema validation: client_id must equal request URL, token_endpoint_auth_method
  must equal "none", redirect_uris bounded and deduped + https-only, refresh_token
  tolerated in grant_types (but unused), client_secret/private_key_jwt rejected.
- In-memory LRU cache with Cache-Control: max-age (capped at 1h), no-store
  honored, negative-cache 30s, never overrides a positive entry.

DCR removal (cmd/altinity-mcp/oauth_server.go):
- handleOAuthRegister and its route deleted; /oauth/register now returns 404.
- /.well-known/oauth-authorization-server drops registration_endpoint and
  refresh_token, advertises token_endpoint_auth_methods_supported=["none"]
  and client_id_metadata_document_supported: true.
- handleOAuthTokenRefreshDispatch / handleOAuthTokenRefreshForward /
  mintForwardRefreshToken deleted; refresh_token grant returns
  unsupported_grant_type. CIMD clients re-authorize in v1.
- parseStatelessRegisteredClient + authenticateClientSecret + hex import
  deleted as unused.

HA replay model (#115 § HA replay):
- /oauth/callback no longer POSTs to upstream /token. Instead it wraps the
  upstream auth code + upstream PKCE verifier + redirec... (continued)

Pull Request Pull Request #116: oauth: CIMD inbound + DCR removal + HA replay (#115)

Coverage Stats

322 of 482 new or added lines in 3 files covered. (66.8%)

298 existing lines in 2 files now uncovered.

4396 of 5819 relevant lines covered (75.55%)

1.1 hits per line