authsome-mcp-proxy 0.4.0__tar.gz

authsome_mcp_proxy-0.4.0/.dockerignore

@@ -0,0 +1,41 @@
+# Docker build context exclusions.
+#
+# Note: `.git/` is intentionally NOT excluded — `uv-dynamic-versioning`
+# needs it during the builder stage to derive the project version from the
+# latest git tag. The final image does not include `.git/` (only the
+# builder stage copies it; the production stage takes the resolved venv).
+
+# Python build artifacts and caches
+__pycache__/
+*.py[oc]
+*.egg-info/
+build/
+dist/
+
+# Test / coverage artifacts
+.pytest_cache/
+.coverage
+htmlcov/
+
+# Linter / type-checker caches
+.ruff_cache/
+.mypy_cache/
+.ty_cache/
+
+# Local virtualenvs
+.venv/
+
+# Local env files — runtime config comes from container env vars / k8s secrets
+.env
+.env.local
+
+# IDE / agent local state
+.vscode/
+.idea/
+.claude/
+
+# Local helper / debug scripts
+inspect-*.bat
+run-*.bat
+*.log
+*.mcpb

authsome_mcp_proxy-0.4.0/.env.example

@@ -0,0 +1,6 @@
+OIDC_ISSUER_URL="https://auth.company.com"
+OIDC_CLIENT_ID="your-client-id"
+OIDC_CLIENT_SECRET="your-client-secret" # optional for public OIDC clients that don't require any such
+OIDC_SCOPES="openid profile"
+OIDC_REDIRECT_URL="http://localhost:8080/auth/callback"
+UPSTREAM_MCP_URL="https://mcp-upstream.company.com/mcp"

authsome_mcp_proxy-0.4.0/.github/workflows/docker-publish.yml

@@ -0,0 +1,85 @@
+name: Build and Publish Docker Image
+
+on:
+  push:
+    branches:
+      - main
+      - feat/web-connector-proxy-support
+    tags:
+      - "v*"
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    if: github.repository == 'stephaneberle9/authsome-mcp-proxy'
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          # Full history + tags so uv-dynamic-versioning can derive the
+          # project version inside the Docker builder stage.
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set image name to lowercase
+        run: |
+          # Docker image names must be lowercase
+          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Log in to GitHub Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          target: production
+          platforms: linux/amd64,linux/arm64
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4
+        if: github.event_name != 'pull_request'
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

authsome_mcp_proxy-0.4.0/.github/workflows/publish-test.yml

@@ -0,0 +1,40 @@
+name: Publish to TestPyPI
+on:
+  workflow_dispatch:
+
+jobs:
+  test-pypi-publish:
+    name: Upload to TestPyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # For PyPI's trusted publishing
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: "Install uv"
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build
+        run: uv build
+
+      - name: Check version format
+        run: |
+          # Extract version from the built package
+          VERSION=$(ls dist/*.whl | head -n1 | sed -E 's/.*-([0-9].*)-.*/\1/')
+          echo "Package version: $VERSION"
+
+          # Check if version contains dev/post markers (development version)
+          if [[ "$VERSION" =~ (dev|post.*dev) ]]; then
+            echo "❌ ERROR: Cannot publish development version: $VERSION"
+            echo "Please create a proper Git tag first (e.g., 'git tag v0.1.0')"
+            exit 1
+          fi
+
+          echo "✅ Version $VERSION is valid for publishing"
+
+      - name: Publish to TestPyPI
+        run: uv publish --publish-url https://test.pypi.org/legacy/ -v dist/*

authsome_mcp_proxy-0.4.0/.github/workflows/publish.yml

@@ -0,0 +1,42 @@
+name: Publish to PyPI
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  pypi-publish:
+    name: Upload to PyPI
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write # For PyPI's trusted publishing
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: "Install uv"
+        uses: astral-sh/setup-uv@v6
+
+      - name: Build
+        run: uv build
+
+      - name: Check version format
+        run: |
+          # Extract version from the built package
+          VERSION=$(ls dist/*.whl | head -n1 | sed -E 's/.*-([0-9].*)-.*/\1/')
+          echo "Package version: $VERSION"
+
+          # Check if version contains dev/post markers (development version)
+          if [[ "$VERSION" =~ (dev|post.*dev) ]]; then
+            echo "❌ ERROR: Cannot publish development version: $VERSION"
+            echo "Please create a proper Git tag first (e.g., 'git tag v0.1.0')"
+            exit 1
+          fi
+
+          echo "✅ Version $VERSION is valid for publishing"
+
+      - name: Publish to PyPI
+        run: uv publish -v dist/*

authsome_mcp_proxy-0.4.0/.github/workflows/run-static.yml

@@ -0,0 +1,53 @@
+name: Run static analysis
+
+env:
+  # Enable colored output
+  PY_COLORS: 1
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "uv.lock"
+      - "pyproject.toml"
+      - ".github/workflows/**"
+
+  # Run on all pull requests because these checks are required and will block merges otherwise
+  pull_request:
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  static_analysis:
+    timeout-minutes: 2
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v5
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+
+      - name: Install dependencies
+        run: uv sync
+
+      - name: Check lockfile is up to date
+        run: |
+          if ! uv lock --check; then
+            echo "❌ Lockfile is out of date!"
+            echo "To update the lockfile, run 'uv lock'."
+            exit 1
+          fi
+          echo "✅ Lockfile is up to date"
+      - name: Run pre-commit
+        run: uv run pre-commit run --all-files
+        env:
+          SKIP: no-commit-to-branch

authsome_mcp_proxy-0.4.0/.github/workflows/run-tests.yml

@@ -0,0 +1,51 @@
+name: Run tests
+
+env:
+  # Enable colored output
+  PY_COLORS: 1
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - "src/**"
+      - "tests/**"
+      - "uv.lock"
+      - "pyproject.toml"
+      - ".github/workflows/**"
+
+  # Run on all pull requests because these checks are required and will block merges otherwise
+  pull_request:
+
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  run_tests:
+    name: "Run tests: Python ${{ matrix.python-version }} on ${{ matrix.os }}"
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.10"]
+      fail-fast: false
+    timeout-minutes: 5
+
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          enable-cache: true
+          cache-dependency-glob: "uv.lock"
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        # Run with frozen to use the current lockfile; static checks will determine if it needs updating
+        run: uv sync --frozen
+
+      - name: Run tests
+        run: uv run pytest

authsome_mcp_proxy-0.4.0/.gitignore

@@ -0,0 +1,33 @@
+.env*
+!.env.example
+mcp.json
+claude_desktop_config.json*
+*.bat
+
+# Python-generated files
+__pycache__/
+*.py[oc]
+build/
+dist/
+wheels/
+*.egg-info
+
+# Virtual environments
+.venv/
+
+# Log files
+*.log
+
+# Coverage reports
+.coverage
+htmlcov/
+.pytest_cache/
+
+# MCPB files
+*.mcpb
+
+# VSCode settings
+.vscode/PythonImportHelper-v2-Completion.json
+
+# Claude Code local settings (tool permissions, personal overrides — not shared)
+.claude/settings.local.json

authsome_mcp_proxy-0.4.0/.markdownlint.json

@@ -0,0 +1,5 @@
+{
+  "MD003": { "style": "atx" },
+  "MD013": false,
+  "MD036": false
+}

authsome_mcp_proxy-0.4.0/.pre-commit-config.yaml

@@ -0,0 +1,48 @@
+fail_fast: false
+
+repos:
+  - repo: https://github.com/abravalheri/validate-pyproject
+    rev: v0.25
+    hooks:
+      - id: validate-pyproject
+
+  - repo: https://github.com/pre-commit/mirrors-prettier
+    rev: v3.1.0
+    hooks:
+      - id: prettier
+        types_or: [yaml, json]
+
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    # Ruff version.
+    rev: v0.15.14
+    hooks:
+      # Run the linter.
+      - id: ruff-check
+        args: [--fix, --exit-non-zero-on-fix]
+      # Run the formatter.
+      - id: ruff-format
+
+  - repo: local
+    hooks:
+      - id: ty
+        name: ty check
+        entry: uv run ty check
+        language: system
+        types: [python]
+        files: ^src/|^tests/
+        pass_filenames: false
+        require_serial: true
+
+  # - repo: https://github.com/pre-commit/pre-commit-hooks
+  #   rev: v6.0.0
+  #   hooks:
+  #     - id: no-commit-to-branch
+  #       name: prevent commits to main
+  #       args: [--branch, main]
+
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.4.2
+    hooks:
+      - id: codespell # See pyproject.toml for args
+        additional_dependencies:
+          - tomli

authsome_mcp_proxy-0.4.0/.vscode/launch.json

@@ -0,0 +1,17 @@
+{
+  // Use IntelliSense to learn about possible attributes.
+  // Hover to view descriptions of existing attributes.
+  // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "MCP Backend",
+      "type": "debugpy",
+      "request": "launch",
+      "python": "${workspaceFolder}/examples/token_validating_upstream_mcp/.venv/Scripts/python.exe",
+      "program": "${workspaceFolder}/examples/token_validating_upstream_mcp/upstream_mcp.py",
+      "justMyCode": false,
+      "console": "integratedTerminal"
+    }
+  ]
+}