12ab632d32Adds support for auth'ing to the registry via [GitHub Actions OIDC](https://docs.github.com/en/actions/concepts/security/openid-connect). Fixes #271 ## Motivation and Context People will probably want to publish to the registry from CI environments. DNS auth can work here fine (https://github.com/modelcontextprotocol/registry/issues/270). But for people who haven't set up DNS, the standard GitHub device flow won't really work here. We could make this nice by supporting GitHub Actions OIDC. ## How Has This Been Tested? Tested locally with a real GitHub OIDC token from a personal repo. ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed
76 lines
1.6 KiB
Go
76 lines
1.6 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"strings"
|
|
)
|
|
|
|
type NoneProvider struct {
|
|
registryURL string
|
|
token string
|
|
}
|
|
|
|
type TokenResponse struct {
|
|
RegistryToken string `json:"registry_token"`
|
|
ExpiresAt int64 `json:"expires_at"`
|
|
}
|
|
|
|
func NewNoneProvider(registryURL string) Provider { //nolint:ireturn
|
|
return &NoneProvider{
|
|
registryURL: registryURL,
|
|
}
|
|
}
|
|
|
|
func (p *NoneProvider) GetToken(ctx context.Context) (string, error) {
|
|
if p.token != "" {
|
|
return p.token, nil
|
|
}
|
|
|
|
// Get anonymous token from registry
|
|
if !strings.HasSuffix(p.registryURL, "/") {
|
|
p.registryURL += "/"
|
|
}
|
|
tokenURL := p.registryURL + "v0/auth/none"
|
|
|
|
req, err := http.NewRequestWithContext(ctx, http.MethodPost, tokenURL, nil)
|
|
if err != nil {
|
|
return "", fmt.Errorf("error creating request: %w", err)
|
|
}
|
|
|
|
client := &http.Client{}
|
|
resp, err := client.Do(req)
|
|
if err != nil {
|
|
return "", fmt.Errorf("error getting anonymous token: %w", err)
|
|
}
|
|
defer resp.Body.Close()
|
|
|
|
if resp.StatusCode != http.StatusOK {
|
|
body, _ := io.ReadAll(resp.Body)
|
|
return "", fmt.Errorf("failed to get anonymous token (status %d): %s", resp.StatusCode, body)
|
|
}
|
|
|
|
var tokenResp TokenResponse
|
|
if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
|
|
return "", fmt.Errorf("error decoding token response: %w", err)
|
|
}
|
|
|
|
p.token = tokenResp.RegistryToken
|
|
return p.token, nil
|
|
}
|
|
|
|
func (p *NoneProvider) NeedsLogin() bool {
|
|
return false
|
|
}
|
|
|
|
func (p *NoneProvider) Login(_ context.Context) error {
|
|
// No login needed for anonymous auth
|
|
return nil
|
|
}
|
|
|
|
func (p *NoneProvider) Name() string {
|
|
return "none"
|
|
}
|