mirror of
https://github.com/containers/kubernetes-mcp-server.git
synced 2025-10-23 01:22:57 +03:00
275b91a00d
Introduce require-oauth flag When this flag is enabled, authorization middleware will be turned on. When this flag is enabled, Derived which is generated based on the client token will not be used. --- Wire Authorization middleware to http mux This commit adds authorization middleware. Additionally, this commit rejects the requests if the bearer token is absent in Authorization header of the request. --- Add offline token validation for expiration and audience Per Model Context Protocol specification, MCP Servers must check the audience field of the token to ensure that they are generated specifically for them. This commits parses the JWT token and asserts that audience is correct and token is not expired. --- Add online token verification via TokenReview request to API Server This commit sends online token verification by sending request to TokenReview endpoint of API Server with the token and expected audience. If API Server returns the status as authenticated, that means this token can be used to generate a new ad hoc token for MCP Server. If API Server returns the status as not authenticated, that means this token is invalid and MCP Server returns 401 to force the client to initiate OAuth flow. --- Serve oauth protected resource metadata endpoint --- Introduce server-url to be represented in protected resource metadata --- Add error return type in Derived function --- Return error if error occurs in Derived, when require-oauth --- Add test cases for authorization-url and server-url --- Wire server-url to audience, if it is set --- Remove redundant ssebaseurl parameter from http
67 lines
1.3 KiB
Go
67 lines
1.3 KiB
Go
package http
|
|
|
|
import (
|
|
"bufio"
|
|
"net"
|
|
"net/http"
|
|
"time"
|
|
|
|
"k8s.io/klog/v2"
|
|
)
|
|
|
|
func RequestMiddleware(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path == "/healthz" {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
start := time.Now()
|
|
|
|
lrw := &loggingResponseWriter{
|
|
ResponseWriter: w,
|
|
statusCode: http.StatusOK,
|
|
}
|
|
|
|
next.ServeHTTP(lrw, r)
|
|
|
|
duration := time.Since(start)
|
|
klog.V(5).Infof("%s %s %d %v", r.Method, r.URL.Path, lrw.statusCode, duration)
|
|
})
|
|
}
|
|
|
|
type loggingResponseWriter struct {
|
|
http.ResponseWriter
|
|
statusCode int
|
|
headerWritten bool
|
|
}
|
|
|
|
func (lrw *loggingResponseWriter) WriteHeader(code int) {
|
|
if !lrw.headerWritten {
|
|
lrw.statusCode = code
|
|
lrw.headerWritten = true
|
|
lrw.ResponseWriter.WriteHeader(code)
|
|
}
|
|
}
|
|
|
|
func (lrw *loggingResponseWriter) Write(b []byte) (int, error) {
|
|
if !lrw.headerWritten {
|
|
lrw.statusCode = http.StatusOK
|
|
lrw.headerWritten = true
|
|
}
|
|
return lrw.ResponseWriter.Write(b)
|
|
}
|
|
|
|
func (lrw *loggingResponseWriter) Flush() {
|
|
if flusher, ok := lrw.ResponseWriter.(http.Flusher); ok {
|
|
flusher.Flush()
|
|
}
|
|
}
|
|
|
|
func (lrw *loggingResponseWriter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
|
|
if hijacker, ok := lrw.ResponseWriter.(http.Hijacker); ok {
|
|
return hijacker.Hijack()
|
|
}
|
|
return nil, nil, http.ErrNotSupported
|
|
}
|