[Server] Oauth2 based on middleware (#221)

* Add Middleware handlers to StreamableHttpTransport

* OAuth Implementation based on middleware

* OAuth Implementation based on middleware

* Add Middleware handlers to StreamableHttpTransport

* OAuth Implementation based on middleware

* OAuth Implementation based on middleware

Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>

* Address PR review feedback for OAuth middleware

* Apply php-cs-fixer to satisfy QA

* Use Mcp exception classes in OAuth middleware

* Refactor OAuth HTTP stack and add Microsoft example policies

* Fix QA PHPStan findings in OAuth examples and auth middleware

* Require OIDC discovery in JWKS provider and refine OAuth proxy behavior

* Remove local development docker artifacts from VCS

* Revert .gitignore changes for local docker files

* Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion

Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>

* Address OAuth PR review feedback and align example configs

* Fix QA style issues and add authorization docs

* Fix PHPStan typing issues in OAuth middleware

* Remove duplicate Middleware namespace, consolidate under Http\Middleware

Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated
in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs
to reference the correct namespaces.

* Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR

- JwtTokenValidator: replace catch(\Throwable) with explicit
  \InvalidArgumentException|\UnexpectedValueException|\DomainException,
  letting RuntimeException from JwksProvider propagate as infrastructure errors
- OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response
- Update tests to expect RuntimeException for JWKS infrastructure failures

---------

Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com>
Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>

examples/server/oauth-microsoft/server.php

@@ -0,0 +1,91 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+require_once dirname(__DIR__).'/bootstrap.php';
+
+use Http\Discovery\Psr17Factory;
+use Laminas\HttpHandlerRunner\Emitter\SapiEmitter;
+use Mcp\Example\Server\OAuthMicrosoft\MicrosoftJwtTokenValidator;
+use Mcp\Example\Server\OAuthMicrosoft\MicrosoftOidcMetadataPolicy;
+use Mcp\Server;
+use Mcp\Server\Session\FileSessionStore;
+use Mcp\Server\Transport\Http\Middleware\AuthorizationMiddleware;
+use Mcp\Server\Transport\Http\Middleware\OAuthProxyMiddleware;
+use Mcp\Server\Transport\Http\Middleware\OAuthRequestMetaMiddleware;
+use Mcp\Server\Transport\Http\Middleware\ProtectedResourceMetadataMiddleware;
+use Mcp\Server\Transport\Http\OAuth\JwksProvider;
+use Mcp\Server\Transport\Http\OAuth\JwtTokenValidator;
+use Mcp\Server\Transport\Http\OAuth\OidcDiscovery;
+use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;
+use Mcp\Server\Transport\StreamableHttpTransport;
+
+$tenantId = getenv('AZURE_TENANT_ID') ?: throw new RuntimeException('AZURE_TENANT_ID environment variable is required');
+$clientId = getenv('AZURE_CLIENT_ID') ?: throw new RuntimeException('AZURE_CLIENT_ID environment variable is required');
+
+$issuerV2 = "https://login.microsoftonline.com/{$tenantId}/v2.0";
+$issuerV1 = "https://sts.windows.net/{$tenantId}/";
+$localBaseUrl = 'http://localhost:8000';
+
+$discovery = new OidcDiscovery(
+    metadataPolicy: new MicrosoftOidcMetadataPolicy(),
+);
+
+$jwtTokenValidator = new JwtTokenValidator(
+    issuer: [$issuerV2, $issuerV1],
+    audience: $clientId,
+    jwksProvider: new JwksProvider($discovery),
+    jwksUri: 'https://login.microsoftonline.com/common/discovery/v2.0/keys',
+    scopeClaim: 'scp',
+);
+
+$validator = new MicrosoftJwtTokenValidator($jwtTokenValidator);
+
+$protectedResourceMetadata = new ProtectedResourceMetadata(
+    authorizationServers: [$localBaseUrl],
+    scopesSupported: ['openid', 'profile', 'email'],
+    resourceName: 'OAuth Microsoft Example MCP Server',
+    resourceDocumentation: $localBaseUrl,
+);
+
+$metadataMiddleware = new ProtectedResourceMetadataMiddleware($protectedResourceMetadata);
+
+$clientSecret = getenv('AZURE_CLIENT_SECRET') ?: null;
+
+$oauthProxyMiddleware = new OAuthProxyMiddleware(
+    upstreamIssuer: $issuerV2,
+    localBaseUrl: $localBaseUrl,
+    discovery: $discovery,
+    clientSecret: $clientSecret,
+);
+
+$authMiddleware = new AuthorizationMiddleware(
+    $validator,
+    $protectedResourceMetadata,
+);
+
+$server = Server::builder()
+    ->setServerInfo('OAuth Microsoft Example', '1.0.0')
+    ->setLogger(logger())
+    ->setSession(new FileSessionStore(__DIR__.'/sessions'))
+    ->setDiscovery(__DIR__)
+    ->build();
+
+$transport = new StreamableHttpTransport(
+    (new Psr17Factory())->createServerRequestFromGlobals(),
+    logger: logger(),
+    middleware: [$oauthProxyMiddleware, $metadataMiddleware, $authMiddleware, new OAuthRequestMetaMiddleware()],
+);
+
+$response = $server->run($transport);
+
+(new SapiEmitter())->emit($response);