mathias
c0be5c473c
Closes #155
Reviewed by pr-gatekeeper: #181 (comment) (block, round 1) and re-review at e05a13a (approve).
Co-authored-by: Mathias <mthbqv@gmail.com>
27 lines
1003 B
Go
27 lines
1003 B
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"log/slog"
|
|
|
|
chassisauth "git.d-ma.be/mathias/mcp-chassis/auth"
|
|
)
|
|
|
|
// buildJWTValidator builds the JWT validator for issuer (nil when issuer is
|
|
// empty: JWT auth disabled). Since mcp-chassis v0.7 construction no longer
|
|
// fails when OIDC discovery does (mcp-chassis#4): the issuer resolves lazily,
|
|
// and until it does a JWT is answered 503-and-retry, not 401. That replaces
|
|
// #83's boot-time retry loop (hyperguild#155). An issuer still unresolved at
|
|
// boot is logged, so a misconfigured issuer is visible rather than silent.
|
|
func buildJWTValidator(ctx context.Context, logger *slog.Logger, issuer, audience string) (*chassisauth.JWTValidator, error) {
|
|
v, err := chassisauth.NewJWTValidator(ctx, issuer, audience)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("build jwt validator: %w", err)
|
|
}
|
|
if ok, rerr := v.Ready(ctx); !ok {
|
|
logger.Warn("jwt issuer not resolved at boot; JWTs answer 503 until it is", "issuer", issuer, "err", rerr)
|
|
}
|
|
return v, nil
|
|
}
|