rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add OAuth2 Client ID Metadata Document support

Browse Source 
MCP connectors such as ChatGPT and Claude register via HTTPS
client_id URLs instead of pre-provisioned GIDs. Fetch and cache
their metadata documents, upsert clients on first use, and
advertise CIMD in OIDC discovery when allowed URLs are configured.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-19 16:35:53 +02:00
parent 9e6f1b9e8f
commit 5b0d3e5052
22 changed files with 1836 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
pkg/bootstrap/builder.go
View File

@@ -139,6 +139,9 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
RefreshTokenDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_REFRESH_TOKEN_DURATION", 2592000),
AuthorizationCodeDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_AUTHORIZATION_CODE_DURATION", 600),
DeviceCodeDuration: b.getEnvIntOrDefault("OAUTH2_SERVER_DEVICE_CODE_DURATION", 600),
CIMDAllowedClientIDs: b.parseOriginsList(
b.getEnv("OAUTH2_SERVER_CIMD_ALLOWED_CLIENT_IDS"),
),
},
},
TrustCenter: probodconfig.TrustCenterConfig{

10
pkg/bootstrap/builder_test.go
View File

@@ -728,6 +728,7 @@ func TestBuilder_Build_OAuth2Defaults(t *testing.T) {
assert.Equal(t, 2592000, cfg.Probod.Auth.OAuth2Server.RefreshTokenDuration)
assert.Equal(t, 600, cfg.Probod.Auth.OAuth2Server.AuthorizationCodeDuration)
assert.Equal(t, 600, cfg.Probod.Auth.OAuth2Server.DeviceCodeDuration)
assert.Nil(t, cfg.Probod.Auth.OAuth2Server.CIMDAllowedClientIDs)
}
func TestBuilder_Build_OAuth2FromEnv(t *testing.T) {
@@ -738,6 +739,7 @@ func TestBuilder_Build_OAuth2FromEnv(t *testing.T) {
env["OAUTH2_SERVER_REFRESH_TOKEN_DURATION"] = "20"
env["OAUTH2_SERVER_AUTHORIZATION_CODE_DURATION"] = "30"
env["OAUTH2_SERVER_DEVICE_CODE_DURATION"] = "40"
env["OAUTH2_SERVER_CIMD_ALLOWED_CLIENT_IDS"] = "https://chatgpt.com/oauth/client.json,https://claude.ai/oauth/client.json"
b := NewBuilder(mockEnv(env))
@@ -754,6 +756,14 @@ func TestBuilder_Build_OAuth2FromEnv(t *testing.T) {
assert.Equal(t, 20, cfg.Probod.Auth.OAuth2Server.RefreshTokenDuration)
assert.Equal(t, 30, cfg.Probod.Auth.OAuth2Server.AuthorizationCodeDuration)
assert.Equal(t, 40, cfg.Probod.Auth.OAuth2Server.DeviceCodeDuration)
assert.Equal(
t,
[]string{
"https://chatgpt.com/oauth/client.json",
"https://claude.ai/oauth/client.json",
},
cfg.Probod.Auth.OAuth2Server.CIMDAllowedClientIDs,
)
}
func TestBuilder_Build_OAuth2Preset(t *testing.T) {