feat: make OAuth support optional

Author: quinnj

Project.toml

@@ -5,16 +5,17 @@ version = "1.0.0"
 [deps]
 HTTP = "cd3eb016-35fb-5094-929b-558a96fad6f3"
 JSON = "682c06a0-de6a-54ab-a142-c8b1cf79cde6"
-OAuth = "22d8b318-f366-56fb-a292-a93f7d76c017"
 Logging = "56ddb016-857b-54e1-b83d-db4d58db5568"
 Sockets = "6462fe0b-24de-5631-8697-dd941f90decc"
 UUIDs = "cf7118a7-6976-5b1a-9a39-7adc72f591a4"
 
 [weakdeps]
 Agentif = "b1e21dde-9d8e-492f-89d0-ee48af23bfc5"
+OAuth = "22d8b318-f366-56fb-a292-a93f7d76c017"
 
 [extensions]
 ModelContextProtocolAgentifExt = ["Agentif"]
+ModelContextProtocolOAuthExt = ["OAuth"]
 
 [compat]
 HTTP = "1.11, 2"
@@ -23,7 +24,8 @@ OAuth = "2"
 julia = "1.10"
 
 [extras]
+OAuth = "22d8b318-f366-56fb-a292-a93f7d76c017"
 Test = "8dfed614-e22c-5e08-85e1-65c5234f0b40"
 
 [targets]
-test = ["Test"]
+test = ["OAuth", "Test"]

ext/ModelContextProtocolOAuthExt.jl

@@ -0,0 +1,74 @@
+module ModelContextProtocolOAuthExt
+
+using HTTP
+using OAuth
+using ModelContextProtocol
+import ModelContextProtocol: MCPClient, attach_token!, request_client_credentials_token, start_public_client_flow
+
+function start_public_client_flow(
+    prm_url::AbstractString,
+    config::OAuth.PublicClientConfig;
+    http=HTTP,
+    issuer::Union{String,Nothing}=nothing,
+    kwargs...
+)
+    result = OAuth.complete_pkce_authorization(
+        prm_url,
+        config;
+        http=http,
+        issuer=issuer,
+        kwargs...,
+    )
+    resource = result.session.resource
+    return (
+        token=result.token,
+        authorization_server=result.session.authorization_server,
+        resource=resource,
+        session=result.session,
+        callback=result.callback,
+    )
+end
+
+function start_public_client_flow(
+    prm_url::AbstractString;
+    client_id::AbstractString,
+    redirect_uri=nothing,
+    scopes=String[],
+    additional_parameters=nothing,
+    dpop=nothing,
+    kwargs...
+)
+    config = OAuth.PublicClientConfig(
+        client_id=String(client_id),
+        redirect_uri=redirect_uri,
+        scopes=scopes,
+        additional_parameters=additional_parameters,
+        dpop=dpop,
+    )
+    return start_public_client_flow(prm_url, config; kwargs...)
+end
+
+function request_client_credentials_token(
+    prm_url::AbstractString,
+    config::OAuth.ConfidentialClientConfig;
+    http=HTTP,
+    issuer=nothing,
+    extra_token_params=Dict{String,String}(),
+    verbose::Bool=false,
+)
+    return OAuth.request_client_credentials_token(
+        prm_url,
+        config;
+        http=http,
+        issuer=issuer,
+        extra_token_params=extra_token_params,
+        verbose=verbose,
+    )
+end
+
+function attach_token!(client::MCPClient, token::OAuth.TokenResponse)
+    client.auth_token = string(token.token_type, " ", token.access_token)
+    return token
+end
+
+end

src/ModelContextProtocol.jl

@@ -2,7 +2,6 @@ module ModelContextProtocol
 
 using HTTP
 using JSON
-using OAuth
 
 include("types.jl")
 include("errors.jl")

src/auth.jl

@@ -1,67 +1,10 @@
-function start_public_client_flow(
-    prm_url::AbstractString,
-    config::PublicClientConfig;
-    http=HTTP,
-    issuer::Union{String,Nothing}=nothing,
-    kwargs...
-)
-    result = OAuth.complete_pkce_authorization(
-        prm_url,
-        config;
-        http=http,
-        issuer=issuer,
-        kwargs...,
-    )
-    resource = result.session.resource
-    return (
-        token=result.token,
-        authorization_server=result.session.authorization_server,
-        resource=resource,
-        session=result.session,
-        callback=result.callback,
-    )
-end
-
-function start_public_client_flow(
-    prm_url::AbstractString;
-    client_id::AbstractString,
-    redirect_uri=nothing,
-    scopes=String[],
-    additional_parameters=nothing,
-    dpop=nothing,
-    kwargs...
-)
-    config = PublicClientConfig(
-        client_id=String(client_id),
-        redirect_uri=redirect_uri,
-        scopes=scopes,
-        additional_parameters=additional_parameters,
-        dpop=dpop,
-    )
-    return start_public_client_flow(prm_url, config; kwargs...)
-end
+function start_public_client_flow end
 
-function request_client_credentials_token(
-    prm_url::AbstractString,
-    config::ConfidentialClientConfig;
-    http=HTTP,
-    issuer=nothing,
-    extra_token_params=Dict{String,String}(),
-    verbose::Bool=false,
-)
-    return OAuth.request_client_credentials_token(
-        prm_url,
-        config;
-        http=http,
-        issuer=issuer,
-        extra_token_params=extra_token_params,
-        verbose=verbose,
-    )
-end
+function request_client_credentials_token end
 
-function attach_token!(client::MCPClient, token::TokenResponse)
-    client.auth_token = token
-    return token
+function attach_token!(client::MCPClient, authorization::AbstractString)
+    client.auth_token = String(authorization)
+    return authorization
 end
 
 function preferred_resource_metadata(challenges::Vector{MCPAuthenticationChallenge})

src/jsonrpc.jl

@@ -175,7 +175,7 @@ function build_request_headers(
     return headers
 end
 
-authorization_value(token::TokenResponse) = string(token.token_type, " ", token.access_token)
+authorization_value(token::AbstractString) = String(token)
 
 function normalize_params(params)
     params === nothing && return nothing

src/types.jl

@@ -140,6 +140,20 @@ struct MCPClientConfig
     verbose::Bool
 end
 
+Base.@kwdef struct WWWAuthenticateChallenge
+    scheme::String
+    token::Union{String,Nothing}
+    params::Dict{String,String}
+end
+
+function WWWAuthenticateChallenge(scheme::AbstractString; token=nothing, params=Dict{String,String}())
+    return WWWAuthenticateChallenge(
+        scheme=String(scheme),
+        token=token === nothing ? nothing : String(token),
+        params=Dict{String,String}(params),
+    )
+end
+
 Base.@kwdef struct MCPAuthenticationChallenge
     challenge::WWWAuthenticateChallenge
     resource_metadata::Union{String,Nothing}
@@ -154,7 +168,7 @@ mutable struct MCPClient
     headers::HTTP.Headers
     timeout::NamedTuple
     verbose::Bool
-    auth_token::Union{TokenResponse,Nothing}
+    auth_token::Union{String,Nothing}
     session::Union{JSONDict,Nothing}
     session_id::Union{String,Nothing}
     initialized::Bool

src/util.jl

@@ -165,6 +165,133 @@ function split_scopes(value)
     return String[p for p in parts if !isempty(p)]
 end
 
+function parse_www_authenticate(header::AbstractString)
+    challenges = WWWAuthenticateChallenge[]
+    idx = firstindex(header)
+    stop = lastindex(header)
+    while true
+        idx = skip_delimiters(header, idx, stop)
+        idx > stop && break
+        scheme, idx = read_token(header, idx, stop)
+        isempty(scheme) && break
+        params = Dict{String,String}()
+        token = nothing
+        seen_param = false
+        while true
+            idx = skip_spaces(header, idx, stop)
+            idx > stop && break
+            if header[idx] == ','
+                next_idx = Base.nextind(header, idx)
+                peek_idx = skip_delimiters(header, next_idx, stop)
+                peek_token, after_peek = read_token(header, peek_idx, stop)
+                if isempty(peek_token)
+                    idx = after_peek
+                    continue
+                end
+                if after_peek <= stop && header[after_peek] == '='
+                    idx = peek_idx
+                else
+                    idx = next_idx
+                    break
+                end
+            end
+            key_start = idx
+            key, idx = read_token(header, idx, stop)
+            isempty(key) && break
+            idx = skip_spaces(header, idx, stop)
+            if idx <= stop && header[idx] == '='
+                idx = Base.nextind(header, idx)
+                idx = skip_spaces(header, idx, stop)
+                value, idx = read_value(header, idx, stop)
+                params[String(key)] = value
+                seen_param = true
+            else
+                if seen_param || token !== nothing
+                    idx = key_start
+                    break
+                end
+                token = String(key)
+            end
+        end
+        push!(challenges, WWWAuthenticateChallenge(String(scheme); token, params))
+    end
+    return challenges
+end
+
+function skip_spaces(str, idx, stop)
+    while idx <= stop
+        c = str[idx]
+        if c == ' ' || c == '\t'
+            idx = Base.nextind(str, idx)
+        else
+            break
+        end
+    end
+    return idx
+end
+
+function skip_delimiters(str, idx, stop)
+    while idx <= stop
+        c = str[idx]
+        if c == ' ' || c == '\t' || c == ','
+            idx = Base.nextind(str, idx)
+        else
+            break
+        end
+    end
+    return idx
+end
+
+function read_token(str, idx, stop)
+    start = idx
+    while idx <= stop
+        c = str[idx]
+        if c == ' ' || c == '\t' || c == '=' || c == ',' || c == '"'
+            break
+        end
+        idx = Base.nextind(str, idx)
+    end
+    idx == start && return "", idx
+    last = Base.prevind(str, idx)
+    return String(str[start:last]), idx
+end
+
+function read_value(str, idx, stop)
+    idx > stop && return "", idx
+    if str[idx] == '"'
+        idx = Base.nextind(str, idx)
+        buf = IOBuffer()
+        escaped = false
+        while idx <= stop
+            c = str[idx]
+            if escaped
+                write(buf, c)
+                escaped = false
+            elseif c == '\\'
+                escaped = true
+            elseif c == '"'
+                idx = Base.nextind(str, idx)
+                break
+            else
+                write(buf, c)
+            end
+            idx = Base.nextind(str, idx)
+        end
+        return String(take!(buf)), idx
+    end
+    start = idx
+    while idx <= stop
+        c = str[idx]
+        if c == ',' || c == ' ' || c == '\t'
+            break
+        end
+        idx = Base.nextind(str, idx)
+    end
+    idx == start && return "", idx
+    last = Base.prevind(str, idx)
+    return String(str[start:last]), idx
+end
+
 function extract_auth_challenges(headers::HTTP.Headers)
     challenges = MCPAuthenticationChallenge[]
     for (name, value) in headers

test/runtests.jl

@@ -410,6 +410,10 @@ end
         @test cancel_entry["sessionId"] == client.session_id
         @test cancel_entry["params"]["requestId"] == "req-1"
 
+        attach_token!(client, "Bearer rawtoken")
+        list_tools(client)
+        @test any(h -> get(h, "Authorization", "") == "Bearer rawtoken", state.headers)
+        @test Base.get_extension(ModelContextProtocol, :ModelContextProtocolOAuthExt) !== nothing
         token_data = JSON.Object(Dict{String,Any}("access_token" => "stubtoken", "token_type" => "Bearer"))
         token = OAuth.TokenResponse(token_data)
         attach_token!(client, token)