Noizu.MCP.Auth.Server.Router (Noizu MCP v0.1.6)

One forward for the whole authorization server.

scope "/oauth" do
  pipe_through :browser_session      # session YES, require_authenticated NO
  forward "/", Noizu.MCP.Auth.Server.Router, MCPConfig.as_opts()
end

Dispatches on the path remaining after the forward:

Path	Plug	Notes
`authorize`	`AuthorizePlug`	GET; needs the session pipeline
`consent`	`AuthorizePlug`	POST; the approve/deny decision
`callback`	`AuthorizePlug` / `Upstream`	only used by `Upstream.OIDC`
`token`	`TokenPlug`	POST; must skip CSRF
`register`	`RegistrationPlug`	POST; must skip CSRF
`revoke`	`RevokePlug`	POST; must skip CSRF
`jwks`	`JWKSPlug`	GET; RS256 only

The paths come from paths: on the config, so overriding one moves it here and in the metadata document together — which is the only way they cannot drift.

Two pipeline requirements, and what happens if you miss them

/oauth/authorize and /oauth/consent need a session (they redirect a browser through your login and render a form) but must not require an authenticated user, or the flow can never reach the login redirect that would authenticate one — the user sees a 401 loop.

/oauth/token, /register and /revoke are called by machines with no cookie. If protect_from_forgery is in their pipeline, every token exchange fails with an InvalidCSRFTokenError — after the browser leg has already succeeded, which makes it look like a token bug rather than a routing one.

A host that would rather mount the endpoints individually can: each plug stands alone and takes the same options.