Add support for serverside oauth (#255)

Co-authored-by: David Soria Parra <davidsp@anthropic.com>
Co-authored-by: Basil Hosmer <basil@anthropic.com>
Co-authored-by: ihrpr <inna@anthropic.com>

src/mcp/server/auth/middleware/__init__.py

@@ -0,0 +1,3 @@
+"""
+Middleware for MCP authorization.
+"""

src/mcp/server/auth/middleware/auth_context.py

@@ -0,0 +1,50 @@
+import contextvars
+
+from starlette.types import ASGIApp, Receive, Scope, Send
+
+from mcp.server.auth.middleware.bearer_auth import AuthenticatedUser
+from mcp.server.auth.provider import AccessToken
+
+# Create a contextvar to store the authenticated user
+# The default is None, indicating no authenticated user is present
+auth_context_var = contextvars.ContextVar[AuthenticatedUser | None](
+    "auth_context", default=None
+)
+
+
+def get_access_token() -> AccessToken | None:
+    """
+    Get the access token from the current context.
+
+    Returns:
+        The access token if an authenticated user is available, None otherwise.
+    """
+    auth_user = auth_context_var.get()
+    return auth_user.access_token if auth_user else None
+
+
+class AuthContextMiddleware:
+    """
+    Middleware that extracts the authenticated user from the request
+    and sets it in a contextvar for easy access throughout the request lifecycle.
+
+    This middleware should be added after the AuthenticationMiddleware in the
+    middleware stack to ensure that the user is properly authenticated before
+    being stored in the context.
+    """
+
+    def __init__(self, app: ASGIApp):
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send):
+        user = scope.get("user")
+        if isinstance(user, AuthenticatedUser):
+            # Set the authenticated user in the contextvar
+            token = auth_context_var.set(user)
+            try:
+                await self.app(scope, receive, send)
+            finally:
+                auth_context_var.reset(token)
+        else:
+            # No authenticated user, just process the request
+            await self.app(scope, receive, send)

src/mcp/server/auth/middleware/bearer_auth.py

@@ -0,0 +1,89 @@
+import time
+from typing import Any
+
+from starlette.authentication import (
+    AuthCredentials,
+    AuthenticationBackend,
+    SimpleUser,
+)
+from starlette.exceptions import HTTPException
+from starlette.requests import HTTPConnection
+from starlette.types import Receive, Scope, Send
+
+from mcp.server.auth.provider import AccessToken, OAuthAuthorizationServerProvider
+
+
+class AuthenticatedUser(SimpleUser):
+    """User with authentication info."""
+
+    def __init__(self, auth_info: AccessToken):
+        super().__init__(auth_info.client_id)
+        self.access_token = auth_info
+        self.scopes = auth_info.scopes
+
+
+class BearerAuthBackend(AuthenticationBackend):
+    """
+    Authentication backend that validates Bearer tokens.
+    """
+
+    def __init__(
+        self,
+        provider: OAuthAuthorizationServerProvider[Any, Any, Any],
+    ):
+        self.provider = provider
+
+    async def authenticate(self, conn: HTTPConnection):
+        auth_header = conn.headers.get("Authorization")
+        if not auth_header or not auth_header.startswith("Bearer "):
+            return None
+
+        token = auth_header[7:]  # Remove "Bearer " prefix
+
+        # Validate the token with the provider
+        auth_info = await self.provider.load_access_token(token)
+
+        if not auth_info:
+            return None
+
+        if auth_info.expires_at and auth_info.expires_at < int(time.time()):
+            return None
+
+        return AuthCredentials(auth_info.scopes), AuthenticatedUser(auth_info)
+
+
+class RequireAuthMiddleware:
+    """
+    Middleware that requires a valid Bearer token in the Authorization header.
+
+    This will validate the token with the auth provider and store the resulting
+    auth info in the request state.
+    """
+
+    def __init__(self, app: Any, required_scopes: list[str]):
+        """
+        Initialize the middleware.
+
+        Args:
+            app: ASGI application
+            provider: Authentication provider to validate tokens
+            required_scopes: Optional list of scopes that the token must have
+        """
+        self.app = app
+        self.required_scopes = required_scopes
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        auth_user = scope.get("user")
+        if not isinstance(auth_user, AuthenticatedUser):
+            raise HTTPException(status_code=401, detail="Unauthorized")
+        auth_credentials = scope.get("auth")
+
+        for required_scope in self.required_scopes:
+            # auth_credentials should always be provided; this is just paranoia
+            if (
+                auth_credentials is None
+                or required_scope not in auth_credentials.scopes
+            ):
+                raise HTTPException(status_code=403, detail="Insufficient scope")
+
+        await self.app(scope, receive, send)

src/mcp/server/auth/middleware/client_auth.py

@@ -0,0 +1,56 @@
+import time
+from typing import Any
+
+from mcp.server.auth.provider import OAuthAuthorizationServerProvider
+from mcp.shared.auth import OAuthClientInformationFull
+
+
+class AuthenticationError(Exception):
+    def __init__(self, message: str):
+        self.message = message
+
+
+class ClientAuthenticator:
+    """
+    ClientAuthenticator is a callable which validates requests from a client
+    application, used to verify /token calls.
+    If, during registration, the client requested to be issued a secret, the
+    authenticator asserts that /token calls must be authenticated with
+    that same token.
+    NOTE: clients can opt for no authentication during registration, in which case this
+    logic is skipped.
+    """
+
+    def __init__(self, provider: OAuthAuthorizationServerProvider[Any, Any, Any]):
+        """
+        Initialize the dependency.
+
+        Args:
+            provider: Provider to look up client information
+        """
+        self.provider = provider
+
+    async def authenticate(
+        self, client_id: str, client_secret: str | None
+    ) -> OAuthClientInformationFull:
+        # Look up client information
+        client = await self.provider.get_client(client_id)
+        if not client:
+            raise AuthenticationError("Invalid client_id")
+
+        # If client from the store expects a secret, validate that the request provides
+        # that secret
+        if client.client_secret:
+            if not client_secret:
+                raise AuthenticationError("Client secret is required")
+
+            if client.client_secret != client_secret:
+                raise AuthenticationError("Invalid client_secret")
+
+            if (
+                client.client_secret_expires_at
+                and client.client_secret_expires_at < int(time.time())
+            ):
+                raise AuthenticationError("Client secret has expired")
+
+        return client