cfdbaf0e47
- modules/pier: Host contract, mcp.* config, catalog compiled from pact.HasMCP (prefixing, route binding, guard resolution, schema reflection, annotations), per-request identity through the published verifier and resolvers, built-in backend guard provider, in-process dispatch with the bouncer marker, per-identity SDK server with the per-request re-filter, stateful session router with rehydration over a memory store, audit lines - modules/surf/pier_on.go: the summercms_mcp hook adapting the router to pier.Host; the untagged hello binary carries no SDK - go.mod: go-sdk v1.8.0 and jsonschema-go v0.4.3 (decision note committed before this change) - TestPierTracerSmoke: SDK client lists and calls acme_echo end to end through surf's compiled guard chain; README and root table row
44 lines
1.3 KiB
Go
44 lines
1.3 KiB
Go
package pier
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"git.golem15.com/golem15/summercms/modules/backpack"
|
|
"git.golem15.com/golem15/summercms/modules/pact"
|
|
)
|
|
|
|
// guardRegistry returns the application's pact.MCPGuards registry,
|
|
// publishing an empty one when no plugin did (find-or-publish).
|
|
func guardRegistry(app *backpack.App) (*pact.MCPGuards, error) {
|
|
if reg, ok := app.Lookup[*pact.MCPGuards](); ok && reg != nil {
|
|
return reg, nil
|
|
}
|
|
reg := pact.NewMCPGuards()
|
|
if err := app.Publish(reg); err != nil {
|
|
return nil, fmt.Errorf("pier: publishing the guard registry: %w", err)
|
|
}
|
|
return reg, nil
|
|
}
|
|
|
|
// frontendGuardName picks the guard provider an OAuth grant's user acts
|
|
// under: the one registered provider other than backend. None means OAuth
|
|
// identities have no frontend subject (backend tools only, through the
|
|
// link); more than one is a boot error, because a grant names no guard.
|
|
func frontendGuardName(reg *pact.MCPGuards) (string, error) {
|
|
var names []string
|
|
for _, name := range reg.Names() {
|
|
if name != BackendGuard {
|
|
names = append(names, name)
|
|
}
|
|
}
|
|
switch len(names) {
|
|
case 0:
|
|
return "", nil
|
|
case 1:
|
|
return names[0], nil
|
|
default:
|
|
return "", fmt.Errorf("pier: several frontend guard providers are registered (%s); an OAuth grant can act under exactly one", strings.Join(names, ", "))
|
|
}
|
|
}
|