adk_mcp_oauth (erlang_adk v0.10.0)

View Source

Bounded OAuth discovery and PKCE helper for MCP clients.

Discovery follows RFC 9728 protected-resource metadata, then RFC 8414 authorization-server metadata with the OpenID Connect well-known location as a 404-only fallback. The caller supplies a fetch function so connection pinning and trust roots remain owned by the application. Requests emitted to that function never contain credentials and redirects are never followed.

Summary

Functions

authorization_metadata_urls(Issuer)
authorization_request(Discovery, Params)
describe(Discovery)
discover(Resource0, Options)
pkce()
resource_metadata_url(Resource)
token_parameters(Discovery, Code, RedirectUri, Verifier)

Functions

authorization_metadata_urls(Issuer)

-spec authorization_metadata_urls(binary()) ->
                                     {ok, [binary()]} | {error, invalid_mcp_authorization_server}.

authorization_request(Discovery, Params)

-spec authorization_request(map(), map()) -> {ok, map()} | {error, term()}.

describe(Discovery)

-spec describe(map()) -> map().

discover(Resource0, Options)

-spec discover(binary(), map()) -> {ok, map()} | {error, term()}.

pkce()

-spec pkce() -> #{verifier := binary(), challenge := binary(), method := <<_:32>>}.

resource_metadata_url(Resource)

-spec resource_metadata_url(binary()) -> {ok, binary()} | {error, invalid_mcp_oauth_resource}.

token_parameters(Discovery, Code, RedirectUri, Verifier)

-spec token_parameters(map(), binary(), binary(), binary()) -> {ok, map()} | {error, term()}.