Resource Server (mcpresource)

go get github.com/glincker/theauth-go/mcpresource

package main

import (
    "net/http"

    "github.com/glincker/theauth-go/mcpresource"
    "github.com/go-chi/chi/v5"
)

func main() {
    v := mcpresource.New(
        "https://mcp.example.com",       // the resource URI this server serves
        mcpresource.WithJWKS("https://as.example.com/oauth/jwks"),
        mcpresource.WithIntrospection(
            "https://as.example.com/oauth/introspect",
            "mcp-client-id",
            "mcp-client-secret",
        ),
    )

    r := chi.NewRouter()
    r.Use(v.Middleware)

    r.Get("/tools/run", func(w http.ResponseWriter, r *http.Request) {
        p, _ := v.Principal(r.Context())
        // p.Subject    -- the originating user (or root agent)
        // p.Actor      -- the innermost agent currently acting
        // p.ActorChain -- slice from innermost to outermost
    })

    http.ListenAndServe(":8090", r)
}

type Principal struct {
    Subject    string   // sub claim: user ULID or "agent:<id>"
    Actor      string   // innermost acting identity; equals Subject when no delegation chain
    ActorChain []string // from innermost to outermost
    Scope      []string // scope claim split on spaces
    ClientID   string   // OAuth client that obtained the token
    IssuedAt   time.Time
    ExpiresAt  time.Time
    // Issuer, Audience, JWTID, DelegationGrantID, and CnfJKT (DPoP jkt
    // thumbprint) are also populated; see mcpresource/principal.go.
}