PtcRunner.Kernel.MCPOAuth.Metadata (PtcRunner v0.14.0)

Copy Markdown View Source

Pure candidate construction and semantic validation for MCP OAuth metadata.

Decoding must use StrictJSON before these functions are called. Validators project only fields used by PtcRunner's supported authorization profile and reject DPoP, signed Protected Resource Metadata, PAR requirements, and unsupported client authentication before browser interaction.

Summary

Functions

authorization_server_candidates(issuer)
protected_resource_candidates(resource)
select_scopes(challenge, protected_resource, authority)
validate_authorization_server(document, authority, source)
validate_client_document(document, authority, source, redirect_uri)
validate_protected_resource(document, authority, source)

Functions

authorization_server_candidates(issuer)

@spec authorization_server_candidates(binary()) :: [binary()]

protected_resource_candidates(resource)

@spec protected_resource_candidates(binary()) :: [binary()]

select_scopes(challenge, protected_resource, authority)

@spec select_scopes(map(), map(), PtcRunner.Kernel.MCPOAuth.Authority.t()) ::
  {:ok, MapSet.t(binary())} | {:error, :authorization_required}

validate_authorization_server(document, authority, source)

@spec validate_authorization_server(
  map(),
  PtcRunner.Kernel.MCPOAuth.Authority.t(),
  binary()
) ::
  {:ok, map()} | {:error, :invalid_authorization_server_metadata}

validate_client_document(document, authority, source, redirect_uri)

@spec validate_client_document(
  map(),
  PtcRunner.Kernel.MCPOAuth.Authority.t(),
  binary(),
  binary()
) ::
  {:ok, map()} | {:error, :invalid_client_metadata_document}

validate_protected_resource(document, authority, source)

@spec validate_protected_resource(
  map(),
  PtcRunner.Kernel.MCPOAuth.Authority.t(),
  binary()
) ::
  {:ok, map()} | {:error, :invalid_protected_resource_metadata}