Commit graph registry/internal/auth
Author SHA1 Message Date
adam jones
c733cedaf8
auth: New auth flow (#273)
Fixes #264. Adds endpoints:

```
/v0/auth/github    # exchange a github token for a registry token that gives you access to namespaces io.github.username and io.github.org for your orgs
/v0/auth/none     # get a registry token for namespace io.modelcontextprotocol.anonymous (only for testing/local dev purposes)
```

Updates `/v0/publish` to accept one of these registry tokens.

## Motivation and Context

See #264

## How Has This Been Tested?

- Running locally and getting a token from `/v0/auth/none` and then
publishing to `/v0/publish`
- Updating the integration tests that get a token and then publish, and
them passing

## Breaking Changes

This is a breaking change to the auth API. This is fine for registry
given it's not deployed yet.

## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [x] Breaking change (fix or feature that would cause existing
functionality to change)
- [x] Documentation update

## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed

## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: adam jones <domdomegg@users.noreply.github.com>
2025-08-15 13:03:35 +01:00
Charles Lowell
4f5e85b510
End-to-end publish test using examples from docs (#199) 2025-07-25 16:09:17 -07:00
Avinash Sridhar
820e0ab8b9 feat(publish): escape server name to prevent HTML injection attacks 2025-05-27 19:13:51 -06:00
Avinash Sridhar
b6c141a721 Fixed linter errors and fixed tests
- Added error handling for JSON encoding in ServersHandler and ServersDetailHandler.
- Updated test cases to reflect changes in handler functions and improved mock expectations.
- Refactored server initialization to include ReadHeaderTimeout for better request handling.
- Modified GitHubDeviceAuth to accept context in ValidateToken and checkOrgMembership methods.
- Improved error messages in database import functions for better debugging.
- Updated memory and mongo database list functions to accept context and improved filtering logic.
- Enhanced logging in publisher tool for better visibility during execution.
- Cleaned up code formatting and comments for better readability and maintainability.
2025-05-27 19:13:51 -06:00
Avinash Sridhar
f843bd4243 feat(auth): refactor authentication handling by removing redundant checks and introducing dynamic auth method determination 2025-05-05 14:38:45 -06:00
Avinash Sridhar
6191066b2e feat(auth): enhance token validation to ensure association with GitHub application and improve error handling 2025-05-05 14:38:45 -06:00
Avinash Sridhar
089fd3994a feat(auth): streamline GitHub token validation and add organization membership check 2025-05-05 14:38:45 -06:00
Avinash Sridhar
2089c5aaa1 feat(auth): Implement GitHub OAuth authentication flow for package publishing
- Added authentication service and GitHub OAuth integration.
- Introduced new authentication methods and structures in the model.
- Updated the API to handle authentication during the publishing process.
- Created handlers for starting and checking the status of the OAuth flow.
- Enhanced the publish handler to validate authentication credentials.
- Updated configuration to include GitHub OAuth settings.
- Added tests for the OAuth flow and publishing with authentication.
- Updated documentation to reflect changes in the API and authentication process.
2025-05-05 14:38:45 -06:00