feat(config): per-upstream auth_broker block + teams credential keys (spec 074, MCP-1035)#588
Merged
Merged
Conversation
…(spec 074)
Add server-edition configuration surface for per-user upstream token
brokering (spec 074, T2 / MCP-1035):
- ServerConfig.AuthBroker *AuthBrokerConfig with mode
(token_exchange|entra_obo|oauth_connect), token_endpoint, resource
(RFC 8707 audience), scopes, client_id/secret, and configurable header
+ header_format (defaults "Authorization" / "Bearer {token}", FR-016).
- TeamsConfig.CredentialEncryptionKey (env fallback MCPPROXY_CRED_KEY,
explicit config wins) and StoreIDPTokens bool, default false (FR-006).
- Validation rejects auth_broker on stdio/non-HTTP-family upstreams with
an "unsupported in this phase" message (FR-002); HTTP-family upstreams
pass and have header defaults applied. Opt-in per server; upstreams
without a broker behave exactly as today (FR-003).
The AuthBrokerConfig type and validation are behind //go:build server with
a personal-edition stub (empty struct + no-op validator), so the personal
edition is unaffected. AuthBroker carries swaggerignore (mirrors Teams) —
swagger-verify confirms no OpenAPI drift.
Related #587
Deploying mcpproxy-docs with
|
| Latest commit: |
c786d39
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://a8cf30c4.mcpproxy-docs.pages.dev |
| Branch Preview URL: | https://074-t2-config-auth-broker.mcpproxy-docs.pages.dev |
# Conflicts: # internal/config/config.go
# Conflicts: # internal/config/teams_config.go
…canary AuthBroker (spec 074) is server-edition per-upstream broker config carried in the JSON config (like Shared), not persisted to the BBolt UpstreamRecord. Mark it intentionally excluded in TestSaveServerSyncFieldCoverage so the field-coverage canary passes. Related #588
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
📦 Build ArtifactsWorkflow Run: View Run Available Artifacts
How to DownloadOption 1: GitHub Web UI (easiest)
Option 2: GitHub CLI gh run download 26966810712 --repo smart-mcp-proxy/mcpproxy-go
|
This was referenced Jun 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Spec 074 T2 (MCP-1035) — the config-schema foundation for per-user upstream token brokering (server edition). No blockers; parallel with T1.
Per-upstream
auth_broker(server edition)ServerConfig.AuthBroker *AuthBrokerConfig:mode:token_exchange|entra_obo|oauth_connecttoken_endpoint,resource(RFC 8707 audience),scopes[],client_id,client_secretheader(defaultAuthorization) +header_format(defaultBearer {token}) — FR-016Teams-level keys (
teams_config.go)credential_encryption_key— env fallbackMCPPROXY_CRED_KEY(explicit config wins)store_idp_tokens bool— default false, privacy-preserving (FR-006)Validation
auth_brokeron stdio / non-HTTP-family upstreams with a clear "unsupported in this phase" message (FR-002).http/sse/streamable-http, plus inferred URL-only) pass; header defaults applied in place.Edition isolation
AuthBrokerConfig+ its validator live behind//go:build server; the personal edition gets an empty-struct stub + no-op validator (mirrors the existingTeamsConfigpattern). Personal edition unaffected.AuthBrokercarriesswaggerignorelikeTeams—make swagger-verifyconfirms no OpenAPI drift.Testing (TDD, test-first)
internal/config/auth_broker_test.go: defaults, valid HTTP broker, stdio + implied-stdio rejection, invalid/missing mode, missing token_endpoint, all valid modes, no-broker-unaffected, JSON round-trip.internal/config/teams_credential_test.go:store_idp_tokensdefault false + parse, cred-key parse, env fallback, config-wins-over-env.Verification (all green):
go test ./internal/config/... -race(personal) ✅go test -tags server ./internal/config/... -race✅go build ./cmd/mcpproxy+go build -tags server ./cmd/mcpproxy✅./scripts/run-linter.sh→ 0 issues ✅make swagger-verify→ up to date ✅FR-002, FR-003, FR-006, FR-016 (config side).
Related #587