Relism/Flash5
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ext-security): add an OAuth 2.1 authorization server

Browse Source 
flash-ext-security-oauth-server issues RFC 9068 access tokens (code + PKCE S256,
CIMD and DCR clients, RFC 8707 resources, rotating refresh tokens) for resources on
the application's own origin. Around it: SecurityExtension resolves a configured
origin instead of X-Forwarded-* headers, mechanisms expose schemes() and a route can
be restricted to some of them, McpConfig.mechanisms(...) uses that, OIDC bearers must
be typed at+jwt, and PublicUrl guards outbound fetches against internal addresses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Zakaria El Orche
2026-09-22 11:39:09 +00:00
co-authored by Claude Opus 5
parent 7f225e0faf
commit f28fc43150
35 changed files with 1958 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flash-extensions/flash-ext-security-test/docs/README.md
+9
View File
@@ -9,6 +9,15 @@ app.request().with(TestSecurity.as(() -> "alice")).get("/me"); /
app.request().with(TestSecurity.as(new OidcPrincipal(...))).get("/projects"); // a mechanism's own type
```
`OAuthTestClient` drives an application's own authorization server
([`flash-ext-security-oauth-server`](../../flash-ext-security-oauth-server/docs/README.md)) the way an MCP
client does — discovery, registration, PKCE, consent, exchange — signing in as any principal:
```java
OAuthTestClient.Tokens tokens = OAuthTestClient.register(app).authorize(() -> "alice");
app.request().with(tokens.bearer()).post("/mcp");
```
`TestSecurity.as(principal)` hands the principal to the application by reference — `FlashTest`
serves it in the same JVM — so tests exercise the real `UserResolver`, `RoleResolver` and policies
with no identity provider running. Tests of the flows themselves use the mechanism's own kit: