toolnexus.mcp-auth — net.clojars.muthuishere/toolnexus 0.25.0

answer-callback clj/s

(answer-callback answer)

The callback URL out of a §10 Answer's data (callbackUrl, any key spelling).

answer-denied-text clj/s

(answer-denied-text answer)

SPEC §2A.1a — the error for a not-ok answer to an authorization request.

b64url clj/s

(b64url x)

base64url without padding (RFC 4648 §5) of byte values or a string.

bearer clj/s

(bearer e resource)

The access token to send to resource (refreshed if expired), or nil = send none. A token is sent only once this server's issuer is confirmed (§2A.1.11). Refresh is single-flight: N concurrent callers share one refresh request.

challenge! clj/s

(challenge! e resource status www sent)

Handle a 401/403 from resource. sent is the access token the failed request carried (nil = none). Returns :retry (send the request again now) or {:pending request} (pause mode — a §10 authorization Request; finish with resume!). Throws ex-info carrying a safe message on any failure.

complete! clj/s

(complete! e f callback-url)

Validate the callback (iss, then state, then error — SPEC §2A.1 step 6) and exchange the code. Nothing is stored on failure.

default-open-url clj/s

(default-open-url url)

Open url in the system browser (macOS open, else xdg-open, else Windows start).

discover-as clj/s

(discover-as e issuer)

RFC 8414 then OIDC metadata, in SPEC §2A.1 step 3's order; issuer must match.

engine clj/s

(engine cfg {:keys [token-store open-url http]})

One auth engine per remote server. cfg is the mcp.json auth object (camelCase keys, keywords or strings); opts are the load options :token-store and :open-url, plus :http (a request fn, tests only).

form-encode clj/s

(form-encode m)

application/x-www-form-urlencoded, keys in sorted order (deterministic).

hex clj/s

(hex vs)

Lower-case hex of unsigned byte values.

memory-store clj/s

(memory-store)

The default token store: in-memory, per load. A store is a map of three fns {:load (fn [resource]) :save (fn [resource token]) :delete (fn [resource])}.

mode clj/s

(mode e)

"auto" unless the config says "pause".

parse-challenge clj/s

(parse-challenge h)

Bearer k="v", k2=v2 (RFC 6750 §3) as {lower-key value}.

parse-query clj/s

(parse-query q)

A query/form string as {name first-value}.

parse-url clj/s

(parse-url u)

{:scheme :host (with port) :hostname :path :query} of an absolute URL, or nil.

rand-str clj/s

(rand-str n)

n url-safe random characters from the host CSPRNG (via random-uuid).

resume! clj/s

(resume! e id callback-url)

Finish a paused authorization with the callback URL the AS redirected to. The caller then sends the paused request (for the first time).

reveal clj/s

(reveal x)

The value of a Token secret (:access-token / :refresh-token), or nil.

sha256 clj/s

(sha256 x)

SHA-256 of a string (UTF-8) or a seq of unsigned byte values; returns 32 unsigned byte values. FIPS 180-4, plain arithmetic, identical on both hosts.

token clj/s

(token {:keys [access-token refresh-token expires-at scopes issuer client-id
               resource]})

A Token: {:access-token :refresh-token :expires-at :scopes :issuer :client-id :resource}. The two token values are held in closures, so the Token's printed form never shows them; read them with reveal.

token->data clj/s

(token->data t)

A Token as plain data (secrets revealed) — for a store that persists it. Persist it confidentially.

url-decode clj/s

(url-decode s)

(url-decode s plus?)

Percent-decode ONCE (and + as space, for forms). Throws on a malformed escape.

url-encode clj/s

(url-encode s)

Percent-encode every byte outside RFC 3986's unreserved set (UTF-8).

utf8-vals clj/s

(utf8-vals s)

A string's UTF-8 bytes as unsigned values (0-255). Through koine's base64, which is the one portable string<->bytes seam both hosts already share.

vals->utf8 clj/s

(vals->utf8 vs)

Unsigned byte values back to a string (UTF-8).