Chris Coutinho
f43343356e
- Add 429 retry with exponential backoff to register_client() (fixes CI oauth matrix failures from parallel DCR requests) - Make client_id, redirect_uri, and PKCE mandatory at token endpoint - Add null-checks for discovery_url and OAuth credentials in proxy flows - Add OIDC discovery document caching with 5-min TTL - Add per-IP rate limiting on /oauth/register DCR proxy - Discover DCR endpoint from OIDC discovery instead of hardcoding - Extract extract_user_id_from_token to auth/token_utils.py (breaks circular imports between server/ and auth/ layers) - Add TTL scope cache in scope_authorization.py (avoids DB hit per tool) - Add defense-in-depth scope validation in storage layer - Broaden elicitation exception handling with graceful fallback - Add idempotentHint to nc_auth_check_status, return "pending" status after accepted elicitation, add polling interval to description - Change ALL_SUPPORTED_SCOPES from tuple to frozenset for O(1) lookups - Replace Optional[str] with str | None throughout config.py - Use default_factory for ProxyCodeEntry/ASProxySession dataclasses - Add proxy code/session cleanup to background loop - Fix OIDC verification CI step to only run for oauth/login-flow modes - Add unit tests for access.py REST endpoints (10 tests) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
89 lines
2.9 KiB
Python
89 lines
2.9 KiB
Python
"""MCP elicitation helpers for Login Flow v2.
|
|
|
|
Provides a unified way to present login URLs to users, using MCP elicitation
|
|
when the client supports it, or falling back to returning the URL in a message.
|
|
"""
|
|
|
|
import logging
|
|
|
|
from mcp.server.fastmcp import Context
|
|
from pydantic import BaseModel, Field
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
class LoginFlowConfirmation(BaseModel):
|
|
"""Schema for Login Flow v2 confirmation elicitation."""
|
|
|
|
acknowledged: bool = Field(
|
|
default=False,
|
|
description="Check this box after completing login at the provided URL",
|
|
)
|
|
|
|
|
|
async def present_login_url(
|
|
ctx: Context,
|
|
login_url: str,
|
|
message: str | None = None,
|
|
) -> str:
|
|
"""Present a login URL to the user via MCP elicitation or message.
|
|
|
|
Tries MCP elicitation first (ctx.elicit) for interactive clients.
|
|
Falls back to returning the URL as a plain message.
|
|
|
|
Args:
|
|
ctx: MCP context
|
|
login_url: URL the user should open in their browser
|
|
message: Optional custom message (defaults to standard Login Flow prompt)
|
|
|
|
Returns:
|
|
"accepted" if user acknowledged via elicitation,
|
|
"declined" if user declined,
|
|
"message_only" if elicitation not supported (URL returned in message)
|
|
"""
|
|
if message is None:
|
|
message = (
|
|
f"Please log in to Nextcloud to grant access:\n\n"
|
|
f"{login_url}\n\n"
|
|
f"Open this URL in your browser, log in, and grant the requested permissions. "
|
|
f"Then check the box below and click OK."
|
|
)
|
|
|
|
if not hasattr(ctx, "elicit"):
|
|
logger.debug(
|
|
"Elicitation not available (no elicit method), returning URL in message"
|
|
)
|
|
return "message_only"
|
|
|
|
try:
|
|
result = await ctx.elicit(
|
|
message=message,
|
|
schema=LoginFlowConfirmation,
|
|
)
|
|
|
|
if result.action == "accept":
|
|
if hasattr(result, "data") and not result.data.acknowledged: # type: ignore[union-attr]
|
|
logger.warning(
|
|
"User accepted login flow without checking the acknowledged box — "
|
|
"login completion will be verified via polling"
|
|
)
|
|
logger.info("User acknowledged login flow completion")
|
|
return "accepted"
|
|
elif result.action == "decline":
|
|
logger.info("User declined login flow")
|
|
return "declined"
|
|
else:
|
|
logger.info("User cancelled login flow")
|
|
return "cancelled"
|
|
|
|
except NotImplementedError:
|
|
# Elicitation not supported by this client/SDK - fall back to message
|
|
logger.debug("Elicitation not available, returning URL in message")
|
|
return "message_only"
|
|
except Exception as e:
|
|
logger.warning(
|
|
f"Elicitation failed unexpectedly ({type(e).__name__}: {e}), "
|
|
"falling back to message"
|
|
)
|
|
return "message_only"
|