golf-mcp 0.2.0__tar.gz → 0.2.1__tar.gz

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: golf-mcp
-Version: 0.2.0
+Version: 0.2.1
 Summary: Framework for building MCP servers
 Author-email: Antoni Gmitruk <antoni@golf.dev>
 License-Expression: Apache-2.0

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "golf-mcp"
-version = "0.2.0"
+version = "0.2.1"
 description = "Framework for building MCP servers"
 authors = [
     {name = "Antoni Gmitruk", email = "antoni@golf.dev"}
@@ -66,7 +66,7 @@ golf = ["examples/**/*"]
 
 [tool.poetry]
 name = "golf-mcp"
-version = "0.1.20"
+version = "0.2.1"
 description = "Framework for building MCP servers with zero boilerplate"
 authors = ["Antoni Gmitruk <antoni@golf.dev>"]
 license = "Apache-2.0"

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/src/golf/__init__.py

@@ -1,4 +1,4 @@
-__version__ = "0.2.0"
+__version__ = "0.2.1"
 
 # Import endpoints with fallback for dev mode
 try:

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/src/golf/auth/__init__.py

@@ -14,6 +14,7 @@ from .providers import (
     StaticTokenConfig,
     OAuthServerConfig,
     RemoteAuthConfig,
+    OAuthProxyConfig,
 )
 from .factory import (
     create_auth_provider,
@@ -44,6 +45,7 @@ __all__ = [
     "configure_auth",
     "configure_jwt_auth",
     "configure_dev_auth",
+    "configure_oauth_proxy",
     "get_auth_config",
     # Provider configurations
     "AuthConfig",
@@ -51,6 +53,7 @@ __all__ = [
     "StaticTokenConfig",
     "OAuthServerConfig",
     "RemoteAuthConfig",
+    "OAuthProxyConfig",
     # Factory functions
     "create_auth_provider",
     "create_simple_jwt_provider",
@@ -191,6 +194,51 @@ def configure_dev_auth(
     configure_auth(config)
 
 
+def configure_oauth_proxy(
+    upstream_authorization_endpoint: str,
+    upstream_token_endpoint: str,
+    upstream_client_id: str,
+    upstream_client_secret: str,
+    base_url: str,
+    token_verifier_config: JWTAuthConfig | StaticTokenConfig,
+    scopes_supported: list[str] | None = None,
+    upstream_revocation_endpoint: str | None = None,
+    redirect_path: str = "/oauth/callback",
+) -> None:
+    """Configure OAuth proxy authentication for non-DCR providers.
+    
+    This sets up an OAuth proxy that bridges MCP clients (expecting DCR) with
+    traditional OAuth providers like GitHub, Google, Okta Web Apps that use
+    fixed client credentials.
+    
+    Args:
+        upstream_authorization_endpoint: Provider's authorization URL
+        upstream_token_endpoint: Provider's token endpoint URL  
+        upstream_client_id: Your client ID registered with the provider
+        upstream_client_secret: Your client secret from the provider
+        base_url: This proxy server's public URL
+        token_verifier_config: JWT or static token config for token verification
+        scopes_supported: Scopes to advertise to MCP clients
+        upstream_revocation_endpoint: Optional token revocation endpoint
+        redirect_path: OAuth callback path (default: /oauth/callback)
+        
+    Note:
+        Requires golf-mcp-enterprise package for implementation.
+    """
+    config = OAuthProxyConfig(
+        upstream_authorization_endpoint=upstream_authorization_endpoint,
+        upstream_token_endpoint=upstream_token_endpoint,
+        upstream_client_id=upstream_client_id,
+        upstream_client_secret=upstream_client_secret,
+        upstream_revocation_endpoint=upstream_revocation_endpoint,
+        base_url=base_url,
+        redirect_path=redirect_path,
+        scopes_supported=scopes_supported or [],
+        token_verifier_config=token_verifier_config,
+    )
+    configure_auth(config)
+
+
 def get_auth_config() -> AuthConfig | None:
     """Get the current auth configuration.
 

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/src/golf/auth/factory.py

@@ -17,6 +17,7 @@ from .providers import (
     StaticTokenConfig,
     OAuthServerConfig,
     RemoteAuthConfig,
+    OAuthProxyConfig,
 )
 from .registry import (
     get_provider_registry,
@@ -55,6 +56,8 @@ def create_auth_provider(config: AuthConfig) -> "AuthProvider":
             return _create_oauth_server_provider(config)
         elif config.provider_type == "remote":
             return _create_remote_provider(config)
+        elif config.provider_type == "oauth_proxy":
+            return _create_oauth_proxy_provider(config)
         else:
             raise ValueError(f"Unknown provider type: {config.provider_type}") from None
 
@@ -238,6 +241,11 @@ def _create_remote_provider(config: RemoteAuthConfig) -> "AuthProvider":
     if not hasattr(token_verifier, "verify_token"):
         raise ValueError(f"Remote auth provider requires a TokenVerifier, got {type(token_verifier).__name__}")
 
+    # Update token verifier's required_scopes to match our scopes_supported for PRM
+    # RemoteAuthProvider uses token_verifier.required_scopes for scopes_supported in PRM
+    if config.scopes_supported and hasattr(token_verifier, "required_scopes"):
+        token_verifier.required_scopes = list(config.scopes_supported)
+
     return RemoteAuthProvider(
         token_verifier=token_verifier,
         authorization_servers=authorization_servers,
@@ -245,6 +253,21 @@ def _create_remote_provider(config: RemoteAuthConfig) -> "AuthProvider":
     )
 
 
+def _create_oauth_proxy_provider(config: OAuthProxyConfig) -> "AuthProvider":
+    """Create OAuth proxy provider - requires enterprise package."""
+    try:
+        # Try to import from enterprise package
+        from golf_enterprise import create_oauth_proxy_provider
+        return create_oauth_proxy_provider(config)
+    except ImportError as e:
+        raise ImportError(
+            "OAuth Proxy requires golf-mcp-enterprise package. "
+            "This feature provides OAuth proxy functionality for non-DCR providers "
+            "(GitHub, Google, Okta Web Apps, etc.). "
+            "Contact sales@golf.dev for enterprise licensing."
+        ) from e
+
+
 def create_simple_jwt_provider(
     *,
     jwks_uri: str | None = None,
@@ -319,6 +342,7 @@ def register_builtin_providers() -> None:
     - static: Static token verification (development)
     - oauth_server: Full OAuth authorization server
     - remote: Remote authorization server integration
+    - oauth_proxy: OAuth proxy for non-DCR providers (requires golf-mcp-enterprise)
     """
     registry = get_provider_registry()
 
@@ -327,6 +351,7 @@ def register_builtin_providers() -> None:
     registry.register_factory("static", _create_static_provider)
     registry.register_factory("oauth_server", _create_oauth_server_provider)
     registry.register_factory("remote", _create_remote_provider)
+    registry.register_factory("oauth_proxy", _create_oauth_proxy_provider)
 
 
 # Register built-in providers when module is imported

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/src/golf/auth/providers.py

@@ -299,6 +299,12 @@ class RemoteAuthConfig(BaseModel):
     # This server's URL
     resource_server_url: str = Field(..., description="URL of this resource server")
 
+    # Scopes this resource supports (advertised via /.well-known/oauth-protected-resource)
+    scopes_supported: list[str] = Field(
+        default_factory=list,
+        description="Scopes this resource supports (advertised via /.well-known/oauth-protected-resource)",
+    )
+
     # Token verification (delegate to another config)
     token_verifier_config: JWTAuthConfig | StaticTokenConfig = Field(
         ..., description="Configuration for the underlying token verifier"
@@ -362,6 +368,45 @@ class RemoteAuthConfig(BaseModel):
 
         return url
 
+    @field_validator("scopes_supported")
+    @classmethod
+    def validate_scopes_supported(cls, v: list[str]) -> list[str]:
+        """Validate scopes_supported format and security."""
+        if not v:
+            return v
+
+        cleaned_scopes = []
+        for scope in v:
+            scope = scope.strip()
+            if not scope:
+                raise ValueError("Scopes cannot be empty or whitespace-only")
+
+            # OAuth 2.0 scope format validation (RFC 6749)
+            if not all(32 < ord(c) < 127 and c not in ' "\\' for c in scope):
+                raise ValueError(
+                    f"Invalid scope format: '{scope}' - must be ASCII printable without spaces, quotes, or backslashes"
+                )
+
+            # Reasonable length limit to prevent abuse
+            if len(scope) > 128:
+                raise ValueError(f"Scope too long: '{scope}' - maximum 128 characters")
+
+            # Warn about potentially dangerous scope names
+            dangerous_scopes = {"admin", "root", "superuser", "system", "*", "all"}
+            if scope.lower() in dangerous_scopes:
+                import warnings
+
+                warnings.warn(
+                    f"Potentially dangerous scope detected: '{scope}'. "
+                    "Consider using more specific, principle-of-least-privilege scopes.",
+                    UserWarning,
+                    stacklevel=2,
+                )
+
+            cleaned_scopes.append(scope)
+
+        return cleaned_scopes
+
     @model_validator(mode="after")
     def validate_token_verifier_compatibility(self) -> "RemoteAuthConfig":
         """Validate that the token verifier config is compatible with token verification."""
@@ -389,6 +434,11 @@ class RemoteAuthConfig(BaseModel):
         if isinstance(config, StaticTokenConfig) and not config.tokens:
             raise ValueError("Static token verifier config must provide at least one token")
 
+        # Convenience: if user didn't set scopes_supported, default to verifier.required_scopes
+        if not self.scopes_supported:
+            if hasattr(config, "required_scopes") and config.required_scopes:
+                self.scopes_supported = list(config.required_scopes)
+
         return self
 
 

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/src/golf/core/builder_auth.py

@@ -52,7 +52,7 @@ def generate_auth_code(
         "import os",
         "import sys",
         "from golf.auth.factory import create_auth_provider",
-        "from golf.auth.providers import RemoteAuthConfig, JWTAuthConfig, StaticTokenConfig, OAuthServerConfig",
+        "from golf.auth.providers import RemoteAuthConfig, JWTAuthConfig, StaticTokenConfig, OAuthServerConfig, OAuthProxyConfig",
     ]
 
     # Embed the auth configuration directly in the generated code

{golf_mcp-0.2.0 → golf_mcp-0.2.1}/src/golf_mcp.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: golf-mcp
-Version: 0.2.0
+Version: 0.2.1
 Summary: Framework for building MCP servers
 Author-email: Antoni Gmitruk <antoni@golf.dev>
 License-Expression: Apache-2.0