| 1: | <?php |
| 2: | |
| 3: | declare(strict_types=1); |
| 4: | |
| 5: | /** |
| 6: | * This file is part of the Nexus MCP SDK package. |
| 7: | * |
| 8: | * (c) 2026 John Paul E. Balandan, CPA <paulbalandan@gmail.com> |
| 9: | * |
| 10: | * For the full copyright and license information, please view |
| 11: | * the LICENSE file that was distributed with this source code. |
| 12: | */ |
| 13: | |
| 14: | namespace Nexus\Mcp\Client\Auth; |
| 15: | |
| 16: | use Nexus\Mcp\Core\Auth\ApplicationType; |
| 17: | use Nexus\Mcp\Core\Auth\TokenEndpointAuthMethod; |
| 18: | |
| 19: | /** |
| 20: | * How this client identifies itself to the authorization servers protecting the MCP servers it talks to. |
| 21: | */ |
| 22: | final readonly class AuthorizationOptions |
| 23: | { |
| 24: | /** |
| 25: | * @param string $clientName Name shown to the resource owner on a consent screen |
| 26: | * @param null|string $redirectUri Redirect URI the authorization response lands on, either loopback or HTTPS. `null` for grants that never visit an authorization endpoint |
| 27: | * @param null|string $clientIdMetadataDocumentUrl HTTPS URL of a hosted Client ID Metadata Document, used verbatim as `client_id` |
| 28: | * @param null|ClientRegistration $preRegistered Credentials issued out of band, which take priority over every other mechanism |
| 29: | * @param ApplicationType $applicationType Declared during Dynamic Client Registration |
| 30: | * @param int $maxScopeUpgrades How many times a request may be retried after an insufficient-scope challenge |
| 31: | * @param bool $requestOfflineAccess Whether to ask for `offline_access`, and with it a refresh token, where the authorization server offers it |
| 32: | * @param list<non-empty-string> $defaultScopes Scopes to ask for when no challenge names any, in place of everything the resource advertises |
| 33: | * @param InsufficientScopePolicy $onInsufficientScope Whether an insufficient-scope answer steps the scopes up or is reported to the caller |
| 34: | * @param float $timeout Seconds a single authorization round trip may take |
| 35: | * @param bool $allowInsecureLoopback Admits an authorization server reached over cleartext HTTP on a loopback host, which the spec does not exempt. For local development and conformance runs, never production |
| 36: | */ |
| 37: | public function __construct( |
| 38: | public string $clientName, |
| 39: | public ?string $redirectUri = null, |
| 40: | public ?string $clientIdMetadataDocumentUrl = null, |
| 41: | public ?ClientRegistration $preRegistered = null, |
| 42: | public ApplicationType $applicationType = ApplicationType::Native, |
| 43: | public int $maxScopeUpgrades = 2, |
| 44: | public bool $requestOfflineAccess = false, |
| 45: | public array $defaultScopes = [], |
| 46: | public InsufficientScopePolicy $onInsufficientScope = InsufficientScopePolicy::Reauthorize, |
| 47: | public float $timeout = 10.0, |
| 48: | public bool $allowInsecureLoopback = false, |
| 49: | ) { |
| 50: | $secureEndpoint = new SecureEndpoint($allowInsecureLoopback); |
| 51: | |
| 52: | if (null !== $redirectUri) { |
| 53: | $secureEndpoint->verifyRedirectUri($redirectUri); |
| 54: | } |
| 55: | |
| 56: | if (null !== $clientIdMetadataDocumentUrl) { |
| 57: | $secureEndpoint->verifyClientIdMetadataDocumentUrl($clientIdMetadataDocumentUrl); |
| 58: | } |
| 59: | |
| 60: | if (TokenEndpointAuthMethod::PrivateKeyJwt === $preRegistered?->tokenEndpointAuthMethod) { |
| 61: | throw new \InvalidArgumentException(\sprintf( |
| 62: | 'Pre-registered credentials cannot authenticate with "%s". Configure a ClientCredentialsGrant with a PrivateKeyJwtCredential instead.', |
| 63: | TokenEndpointAuthMethod::PrivateKeyJwt->value, |
| 64: | )); |
| 65: | } |
| 66: | } |
| 67: | } |
| 68: |