auth: New auth flow (#273)

Fixes #264. Adds endpoints:

```
/v0/auth/github    # exchange a github token for a registry token that gives you access to namespaces io.github.username and io.github.org for your orgs
/v0/auth/none     # get a registry token for namespace io.modelcontextprotocol.anonymous (only for testing/local dev purposes)
```

Updates `/v0/publish` to accept one of these registry tokens.

## Motivation and Context

See #264

## How Has This Been Tested?

- Running locally and getting a token from `/v0/auth/none` and then
publishing to `/v0/publish`
- Updating the integration tests that get a token and then publish, and
them passing

## Breaking Changes

This is a breaking change to the auth API. This is fine for registry
given it's not deployed yet.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>

tests/integration/README.md

@@ -12,7 +12,6 @@ This directory contains an end-to-end test for publishing to the registry.
 ## Test Flow
 
 1. **Build**: Build `publisher` and `registry`
-   - build `registry` with the `noauth` tag so that it accepts fake tokens
 2. **Start Services**: Launch registry and MongoDB using Docker Compose with test configuration
 3. **Publish Examples**: Extract JSON examples from documentation and run `publisher` to publish each one
 4. **Validate Responses**: GET each published server from the registry and compare it to the example JSON

tests/integration/main.go

@@ -29,6 +29,44 @@ func main() {
 	}
 }
 
+func getAnonymousToken() (string, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, registryURL+"/v0/auth/none", nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to create request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("failed to get anonymous token: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("auth endpoint returned %d: %s", resp.StatusCode, string(body))
+	}
+
+	var tokenResponse struct {
+		RegistryToken string `json:"registry_token"`
+		ExpiresAt     int    `json:"expires_at"`
+	}
+
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResponse); err != nil {
+		return "", fmt.Errorf("failed to decode token response: %w", err)
+	}
+
+	if tokenResponse.RegistryToken == "" {
+		return "", fmt.Errorf("received empty token from auth endpoint")
+	}
+
+	log.Printf("Got anonymous token (expires at %d)", tokenResponse.ExpiresAt)
+	return tokenResponse.RegistryToken, nil
+}
+
 func run() error {
 	examplesPath := filepath.Join("docs", "server-json", "examples.md")
 	examples, err := examples(examplesPath)
@@ -41,10 +79,14 @@ func run() error {
 
 	log.Printf("Found %d examples in %q\n", len(examples), examplesPath)
 
-	// publisher will send this fake token to the registry, which will accept it
-	// because the registry was built with noauth enabled (see tests/integration/run.sh)
-	if err := os.WriteFile(".mcpregistry_token", []byte("fake"), 0600); err != nil {
-		log.Fatalf("failed to write fake token: %v", err)
+	// Get anonymous token from the none endpoint
+	token, err := getAnonymousToken()
+	if err != nil {
+		log.Fatalf("failed to get anonymous token: %v", err)
+	}
+
+	if err := os.WriteFile(".mcpregistry_token", []byte(token), 0600); err != nil {
+		log.Fatalf("failed to write token: %v", err)
 	}
 	defer os.Remove(".mcpregistry_token")
 
@@ -62,6 +104,14 @@ func publish(examples []example) error {
 			continue
 		}
 
+		// Remove any existing namespace prefix and add anonymous prefix
+		if !strings.HasPrefix(expected["name"].(string), "io.modelcontextprotocol.anonymous/") {
+			parts := strings.SplitN(expected["name"].(string), "/", 2)
+			serverName := parts[len(parts)-1]
+			expected["name"] = "io.modelcontextprotocol.anonymous/" + serverName
+		}
+		example.content, _ = json.Marshal(expected)
+
 		p := filepath.Join("bin", fmt.Sprintf("example-line-%d.json", example.line))
 		if err := os.WriteFile(p, example.content, 0600); err != nil {
 			log.Printf("  ⛔ Failed to write example JSON to %s: %v\n", p, err)
@@ -113,11 +163,8 @@ func publish(examples []example) error {
 		if err := json.Unmarshal(content, &actual); err != nil {
 			return fmt.Errorf("  ⛔ failed to unmarshal registry response: %w", err)
 		}
-		for k, v := range expected {
-			v2 := actual[k]
-			if err := compare(v, v2); err != nil {
-				return fmt.Errorf(`  ⛔ field "%s": %w`, k, err)
-			}
+		if err := compare(expected, actual); err != nil {
+			return fmt.Errorf(`  ⛔ example "%s": %w`, expected["name"], err)
 		}
 		log.Print("  ✅ registry response matches example\n\n")
 		published++

tests/integration/run.sh

@@ -11,7 +11,7 @@ cleanup() {
 
 go build -o ./bin/publisher ./tools/publisher
 
-docker build -t registry --build-arg GO_BUILD_TAGS=noauth .
+docker build -t registry .
 
 trap cleanup EXIT