3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-07-17 16:48:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

mcp: split mcp into server and client for better option grouping (#5666)

Browse source
This commit is contained in:
Denis Mishin 2025-06-24 10:21:32 -07:00 • committed by GitHub
parent d36c48a2bc
commit db6449ecca
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
11 changed files with 1156 additions and 934 deletions
Download patch file Download diff file Expand all files Collapse all files

4
authorize/check_response_test.go
View file

@ -117,7 +117,7 @@ func TestAuthorize_handleResult(t *testing.T) {
res, err := a.handleResult(t.Context(),
&envoy_service_auth_v3.CheckRequest{},
&evaluator.Request{
Policy: &config.Policy{MCP: &config.MCP{}},
Policy: &config.Policy{MCP: &config.MCP{Server: &config.MCPServer{}}},
},
&evaluator.Result{
Allow: evaluator.NewRuleResult(false, criteria.ReasonUserUnauthenticated),
@ -130,7 +130,7 @@ func TestAuthorize_handleResult(t *testing.T) {
res, err := a.handleResult(t.Context(),
&envoy_service_auth_v3.CheckRequest{},
&evaluator.Request{
Policy: &config.Policy{MCP: &config.MCP{}},
Policy: &config.Policy{MCP: &config.MCP{Server: &config.MCPServer{}}},
},
&evaluator.Result{
Allow: evaluator.NewRuleResult(false, criteria.ReasonUserUnauthenticated),

4
authorize/evaluator/headers_evaluator_evaluation.go
View file

@ -104,7 +104,7 @@ func (e *headersEvaluatorEvaluation) fillMCPHeaders(ctx context.Context) (err er
}
var accessToken string
if e.request.Policy.MCP.IsUpstreamClientNeedsAccessToken() {
if e.request.Policy.IsMCPClient() {
accessToken, err = p.GetAccessTokenForSession(e.request.Session.ID, time.Now().Add(5*time.Minute))
if err != nil {
return fmt.Errorf("authorize/header-evaluator: error getting MCP access token: %w", err)
@ -113,7 +113,7 @@ func (e *headersEvaluatorEvaluation) fillMCPHeaders(ctx context.Context) (err er
return nil
}
if e.request.Policy.MCP.HasUpstreamOAuth2() {
if e.request.Policy.MCP.GetServerUpstreamOAuth2() != nil {
user := e.getUser(ctx)
accessToken, err = p.GetUpstreamOAuth2Token(ctx, e.request.HTTP.Host, user.Id)
if err != nil {