feat: add HTTP transport with OAuth flow including token exchange#21
Draft
tomassurin wants to merge 29 commits intomainfrom
Draft
feat: add HTTP transport with OAuth flow including token exchange#21tomassurin wants to merge 29 commits intomainfrom
tomassurin wants to merge 29 commits intomainfrom
Conversation
Design for Track B of Co-work DWS Connector — upgrading the MCP server from stdio-only/static-API-key to HTTP transport with JWT auth via JWKS, RFC 8693 token exchange, and RFC 9728 Protected Resource Metadata. Six implementation phases covering transport, auth, token exchange, and environment configuration. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This reverts commit 26c2c15.
tomassurin
changed the title
Remove callNutrientApi legacy helper and inline axios fallbacks. All perform* functions now require an explicit DwsApiClient parameter, eliminating hidden coupling to environment variables and global state. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove TokenExchangeClient and token exchange mechanism - DWS API now accepts OAuth access tokens directly - Simplify JWT mode environment validation to only require JWKS_URL - Remove CLIENT_ID, CLIENT_SECRET, CLIENT_ASSERTION_* requirements for JWT mode - Delete unused src/http/tokenExchange.ts - Update tokenExchange.test.ts to skip (no longer applicable) - Update environment.ts to remove token exchange validation - Update documentation (README.md, docs/testing.md, .env.example) - Update environment tests to reflect new behavior
JWKS_URL now defaults to https://api.nutrient.io/.well-known/jwks.json so JWT mode only requires AUTH_MODE=jwt. Remove redundant environment tests and the empty tokenExchange test file. Update testing.md with minimal JWT config, localhost DWS debug build section, and current common failures. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Removes duplicate implementations from bearerAuth.ts and jwtAuth.ts into a single src/http/authUtils.ts module to avoid drift. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- isInitializeRequest now checks array bodies for batch JSON-RPC - Add comment noting CORS wildcard is intentional for local use Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves https://nutrient.atlassian.net/browse/SERVER-2408
Summary
Upgrades the MCP server from stdio-only with static API key auth to also support HTTP transport with production-grade authentication:
/mcpwith session binding, alongside the existing stdio modeAUTH_MODE=jwt) with validation ofaud,scope,exp,issclaims, plus static bearer token mode (AUTH_MODE=static) for local devRFC 8693 token exchange — exchanges MCP access tokens for short-lived DWS API credentials with per-principal caching/.well-known/oauth-protected-resource) per RFC 9728DwsApiClientreplacing the module-level API function, enabling per-user token resolutionStdio mode is fully preserved — all new behavior is opt-in via environment variables (
MCP_TRANSPORT=http).