rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add RFC 6750 WWW-Authenticate on OAuth bearer APIs

Browse Source 
Introduce BearerChallengeMiddleware on MCP, Console and Connect GraphQL, Files, and OAuth2 userinfo. Call sites record challenge intent in context via NoteUnauthenticated, NoteInvalidToken, and NoteInsufficientScope; the middleware applies resource_metadata, invalid_token, and insufficient_scope on WriteHeader.

OAuth2 access token middleware flags rejected Bearer tokens for invalid_token challenges. Add Authorizer.ScopesForAction for the scope auth-param.

Signed-off-by: Ludovic Vielle <ludovic@probo.com>
This commit is contained in:
Ludovic Vielle
2026-06-19 16:35:15 +02:00
parent b2e9b8b4f1
commit e424563794
18 changed files with 305 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
pkg/iam/errors.go
View File

@@ -17,6 +17,7 @@ package iam
import (
"fmt"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/mail"
)
@@ -205,18 +206,17 @@ func (e ErrInsufficientPermissions) Error() string {
type ErrInsufficientOAuth2Scope struct {
IdentityID gid.GID
Action Action
Scopes []coredata.OAuth2Scope
}
func NewInsufficientOAuth2ScopeError(identityID gid.GID, action Action) error {
return &ErrInsufficientOAuth2Scope{IdentityID: identityID, Action: action}
func NewInsufficientOAuth2ScopeError(identityID gid.GID, scopes ...coredata.OAuth2Scope) error {
return &ErrInsufficientOAuth2Scope{IdentityID: identityID, Scopes: scopes}
}
func (e ErrInsufficientOAuth2Scope) Error() string {
return fmt.Sprintf(
"identity %q does not have an OAuth2 scope granting action %s",
"identity %q does not have an OAuth2 scope granting the requested action",
e.IdentityID,
e.Action,
)
}