Chris Coutinho
1a6ce0fa7d
- Fix circular dependency in scope_authorization: auth tools requiring only identity scopes (openid/profile/email) now bypass the login flow provisioning check, so unprovisioned users can call provisioning tools - Fix no-op detection in nc_auth_update_scopes: NULL scopes (legacy "all") now correctly map to ALL_SUPPORTED_SCOPES instead of empty set - Fix get_app_password_with_scopes swallowing exceptions: re-raise instead of returning None, matching sibling methods - Add missing audit logging to update_app_password_scopes, delete_login_flow_session, and delete_expired_login_flow_sessions - Pin setup-uv to v7.3.1 in CI unit-test job (was v7.3.0) - Add FastMCP type annotation to register_auth_tools parameter - Log warning when user accepts elicitation without checking acknowledged box Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
77 lines
2.5 KiB
Python
77 lines
2.5 KiB
Python
"""MCP elicitation helpers for Login Flow v2.
|
|
|
|
Provides a unified way to present login URLs to users, using MCP elicitation
|
|
when the client supports it, or falling back to returning the URL in a message.
|
|
"""
|
|
|
|
import logging
|
|
|
|
from mcp.server.fastmcp import Context
|
|
from pydantic import BaseModel, Field
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class LoginFlowConfirmation(BaseModel):
|
|
"""Schema for Login Flow v2 confirmation elicitation."""
|
|
|
|
acknowledged: bool = Field(
|
|
default=False,
|
|
description="Check this box after completing login at the provided URL",
|
|
)
|
|
|
|
|
|
async def present_login_url(
|
|
ctx: Context,
|
|
login_url: str,
|
|
message: str | None = None,
|
|
) -> str:
|
|
"""Present a login URL to the user via MCP elicitation or message.
|
|
|
|
Tries MCP elicitation first (ctx.elicit) for interactive clients.
|
|
Falls back to returning the URL as a plain message.
|
|
|
|
Args:
|
|
ctx: MCP context
|
|
login_url: URL the user should open in their browser
|
|
message: Optional custom message (defaults to standard Login Flow prompt)
|
|
|
|
Returns:
|
|
"accepted" if user acknowledged via elicitation,
|
|
"declined" if user declined,
|
|
"message_only" if elicitation not supported (URL returned in message)
|
|
"""
|
|
if message is None:
|
|
message = (
|
|
f"Please log in to Nextcloud to grant access:\n\n"
|
|
f"{login_url}\n\n"
|
|
f"Open this URL in your browser, log in, and grant the requested permissions. "
|
|
f"Then check the box below and click OK."
|
|
)
|
|
|
|
try:
|
|
result = await ctx.elicit(
|
|
message=message,
|
|
schema=LoginFlowConfirmation,
|
|
)
|
|
|
|
if result.action == "accept":
|
|
if hasattr(result, "data") and not result.data.acknowledged: # type: ignore[union-attr]
|
|
logger.warning(
|
|
"User accepted login flow without checking the acknowledged box — "
|
|
"login completion will be verified via polling"
|
|
)
|
|
logger.info("User acknowledged login flow completion")
|
|
return "accepted"
|
|
elif result.action == "decline":
|
|
logger.info("User declined login flow")
|
|
return "declined"
|
|
else:
|
|
logger.info("User cancelled login flow")
|
|
return "cancelled"
|
|
|
|
except Exception as e:
|
|
# Elicitation not supported by this client - fall back to message
|
|
logger.debug(f"Elicitation not available ({e}), returning URL in message")
|
|
return "message_only"
|