3f89fc2b1f## What this does The publisher CLI now derives the OIDC audience to request from the `--registry` URL instead of using a fixed constant, and the server validates the token's `aud` claim against a new per-deployment env var (`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE`). Production sets this env var to `https://registry.modelcontextprotocol.io` (and per-environment URL elsewhere), so the deployment only accepts tokens that were requested for it. ## Compatibility This is a breaking change for older `mcp-publisher` binaries that still request the legacy hardcoded audience. After this rolls to a deployment, users on old `mcp-publisher` will see a clear `invalid audience: expected …, got […]` error and need to upgrade. Users following the documented `releases/latest` install pattern get the new binary automatically. ## Test plan - [ ] CI green - [ ] Run a synthetic publish from a real GitHub Actions workflow against staging after deploy - [ ] Confirm an older `mcp-publisher` against the same staging deploy returns the expected `invalid audience` error 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
41 lines
1.6 KiB
Go
41 lines
1.6 KiB
Go
package config
|
|
|
|
import (
|
|
env "github.com/caarlos0/env/v11"
|
|
)
|
|
|
|
// Config holds the application configuration
|
|
// See .env.example for more documentation
|
|
type Config struct {
|
|
ServerAddress string `env:"SERVER_ADDRESS" envDefault:":8080"`
|
|
DatabaseURL string `env:"DATABASE_URL" envDefault:"postgres://localhost:5432/mcp-registry?sslmode=disable"`
|
|
SeedFrom string `env:"SEED_FROM" envDefault:""`
|
|
Version string `env:"VERSION" envDefault:"dev"`
|
|
GithubClientID string `env:"GITHUB_CLIENT_ID" envDefault:""`
|
|
GithubClientSecret string `env:"GITHUB_CLIENT_SECRET" envDefault:""`
|
|
JWTPrivateKey string `env:"JWT_PRIVATE_KEY" envDefault:""`
|
|
EnableAnonymousAuth bool `env:"ENABLE_ANONYMOUS_AUTH" envDefault:"false"`
|
|
EnableRegistryValidation bool `env:"ENABLE_REGISTRY_VALIDATION" envDefault:"true"`
|
|
|
|
GitHubOIDCAudience string `env:"GITHUB_OIDC_AUDIENCE" envDefault:""`
|
|
|
|
// OIDC Configuration
|
|
OIDCEnabled bool `env:"OIDC_ENABLED" envDefault:"false"`
|
|
OIDCIssuer string `env:"OIDC_ISSUER" envDefault:""`
|
|
OIDCClientID string `env:"OIDC_CLIENT_ID" envDefault:""`
|
|
OIDCExtraClaims string `env:"OIDC_EXTRA_CLAIMS" envDefault:""`
|
|
OIDCEditPerms string `env:"OIDC_EDIT_PERMISSIONS" envDefault:""`
|
|
OIDCPublishPerms string `env:"OIDC_PUBLISH_PERMISSIONS" envDefault:""`
|
|
}
|
|
|
|
// NewConfig creates a new configuration with default values
|
|
func NewConfig() *Config {
|
|
var cfg Config
|
|
err := env.ParseWithOptions(&cfg, env.Options{
|
|
Prefix: "MCP_REGISTRY_",
|
|
})
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
return &cfg
|
|
}
|