Class: MCP::Client::OAuth::ClientCredentialsProvider

Inherits:
Object
  • Object
show all
Includes:
StorageBackedProvider
Defined in:
lib/mcp/client/oauth/client_credentials_provider.rb

Overview

OAuth client configuration for the OAuth 2.1 ‘client_credentials` grant (machine-to-machine, no user and no browser redirect). Handed to `MCP::Client::HTTP` via the `oauth:` keyword, the same as `Provider`. The interactive Authorization Code flow lives in `Provider`; this class exists so a credentials-only client never has to supply the redirect arguments that grant has no use for, mirroring the dedicated `ClientCredentialsProvider` in the TypeScript SDK and `ClientCredentialsOAuthProvider` in the Python SDK.

Required keyword arguments:

  • ‘client_id` - String identifying the pre-registered confidential client.

  • ‘client_secret` - String shared secret. The `client_credentials` grant is for confidential clients, so a credential is mandatory.

Optional keyword arguments:

  • ‘token_endpoint_auth_method` - `“client_secret_basic”` (default) or `“client_secret_post”`. `“none”` is rejected: an unauthenticated `client_credentials` request is meaningless.

  • ‘scope` - String of space-separated scopes to request when the server’s ‘WWW-Authenticate` and the Protected Resource Metadata do not specify one.

  • ‘storage` - Object responding to `tokens`, `save_tokens(tokens)`, `client_information`, and `save_client_information(info)`. Defaults to an `InMemoryStorage`. The `client_id` / `client_secret` are written into it so the token exchange reads them through the same path as a pre-registered authorization-code client.

Defined Under Namespace

Classes: InvalidCredentialsError

Constant Summary collapse

SUPPORTED_AUTH_METHODS = 
["client_secret_basic", "client_secret_post"].freeze

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from StorageBackedProvider

#access_token, #clear_tokens!, #client_information, #save_client_information, #save_tokens, #tokens

Constructor Details

#initialize(client_id:, client_secret:, token_endpoint_auth_method: "client_secret_basic", scope: nil, storage: nil) ⇒ ClientCredentialsProvider

Returns a new instance of ClientCredentialsProvider.



44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
 
# File 'lib/mcp/client/oauth/client_credentials_provider.rb', line 44

def initialize(
  client_id:,
  client_secret:,
  token_endpoint_auth_method: "client_secret_basic",
  scope: nil,
  storage: nil
)
  if blank?(client_id)
    raise InvalidCredentialsError, "client_id is required for the client_credentials grant."
  end

  unless SUPPORTED_AUTH_METHODS.include?(token_endpoint_auth_method)
    raise InvalidCredentialsError,
      "token_endpoint_auth_method must be one of #{SUPPORTED_AUTH_METHODS.inspect} for the " \
        "client_credentials grant (got #{token_endpoint_auth_method.inspect}); an unauthenticated " \
        "client_credentials request is not allowed."
  end

  if blank?(client_secret)
    raise InvalidCredentialsError,
      "client_secret is required for the client_credentials grant with #{token_endpoint_auth_method}."
  end

  @scope = scope
  @storage = storage || InMemoryStorage.new
  @storage.save_client_information(
    "client_id" => client_id,
    "client_secret" => client_secret,
    "token_endpoint_auth_method" => token_endpoint_auth_method,
  )
end

Instance Attribute Details

#scope ⇒ Object (readonly)

Returns the value of attribute scope.



42
43
44
 
# File 'lib/mcp/client/oauth/client_credentials_provider.rb', line 42

def scope
  @scope
end

#storage ⇒ Object (readonly)

Returns the value of attribute storage.



42
43
44
 
# File 'lib/mcp/client/oauth/client_credentials_provider.rb', line 42

def storage
  @storage
end

Instance Method Details

#authorization_flow ⇒ Object

See ‘Provider#authorization_flow`.



77
78
79
 
# File 'lib/mcp/client/oauth/client_credentials_provider.rb', line 77

def authorization_flow
  :client_credentials
end