phoenix-oss/open-mcp-auth-proxy-upstream
0
0
Fork 1
mirror of https://github.com/wso2/open-mcp-auth-proxy.git synced 2025-10-22 16:23:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: Update ScopesSupported to match RFC 9728 Section 2

Browse source
This commit is contained in:
Alex Leach 2025-10-12 21:26:05 +01:00
parent 56d969b785
commit 8ca4bb4787
No known key found for this signature in database
GPG key ID: 46E1D1A0150DEEA3
5 changed files with 17 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

9
internal/authz/default.go
View file

@ -100,10 +100,17 @@ func (p *defaultProvider) ProtectedResourceMetadataHandler() http.HandlerFunc {
w.Header().Set("Content-Type", "application/json")
meta := map[string]interface{}{
"audience": p.cfg.ProtectedResourceMetadata.Audience,
"scopes_supported": p.cfg.ProtectedResourceMetadata.ScopesSupported,
"authorization_servers": p.cfg.ProtectedResourceMetadata.AuthorizationServers,
}
if len(p.cfg.ProtectedResourceMetadata.ScopesSupported) > 0 {
meta["scopes_supported"] = p.cfg.ProtectedResourceMetadata.ScopesSupported
}
if p.cfg.ProtectedResourceMetadata.ResourceIdentifier != "" {
meta["resource"] = p.cfg.ProtectedResourceMetadata.ResourceIdentifier
}
if p.cfg.ProtectedResourceMetadata.JwksURI != "" {
meta["jwks_uri"] = p.cfg.ProtectedResourceMetadata.JwksURI
}

7
internal/authz/scope_validator.go
View file

@ -7,7 +7,6 @@ import (
"github.com/golang-jwt/jwt/v4"
"github.com/wso2/open-mcp-auth-proxy/internal/config"
"github.com/wso2/open-mcp-auth-proxy/internal/util"
)
type ScopeValidator struct{}
@ -18,11 +17,7 @@ func (d *ScopeValidator) ValidateAccess(
claims *jwt.MapClaims,
config *config.Config,
) AccessControlResult {
env, err := util.ParseRPCRequest(r)
if err != nil {
return AccessControlResult{DecisionDeny, "bad JSON-RPC request"}
}
requiredScopes := util.GetRequiredScopes(config, env)
requiredScopes := config.ProtectedResourceMetadata.ScopesSupported
if len(requiredScopes) == 0 {
return AccessControlResult{DecisionAllow, ""}