datarobot_genai.drmcpbase.oauth_protected_resource_metadata.entities

entities

CrossApplicationAccessMetadata dataclass

Bases: BaseDataClass

Cross-Application Access parameters for the hybrid RFC 8693 / RFC 7523 flow.

Mirrors dragent.cross_app_access_config.CrossApplicationAccessConfig so an agent can either declare the block itself or read this one off the MCP server's protected resource metadata document.

Source code in datarobot_genai/drmcpbase/oauth_protected_resource_metadata/entities.py

@dataclass
class CrossApplicationAccessMetadata(BaseDataClass):
    """Cross-Application Access parameters for the hybrid RFC 8693 / RFC 7523 flow.

    Mirrors ``dragent.cross_app_access_config.CrossApplicationAccessConfig`` so an
    agent can either declare the block itself or read this one off the MCP
    server's protected resource metadata document.
    """

    token_exchange: XAATokenExchangeParams
    token_request: XAATokenRequestParams
    token_endpoint_auth_method: str = DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD

    @classmethod
    def from_dict(cls, metadata_in_dict: dict[str, Any]) -> "CrossApplicationAccessMetadata":
        return cls(
            token_exchange=XAATokenExchangeParams.from_dict(metadata_in_dict["token_exchange"]),
            token_request=XAATokenRequestParams.from_dict(metadata_in_dict["token_request"]),
            token_endpoint_auth_method=metadata_in_dict.get(
                "token_endpoint_auth_method", DEFAULT_TOKEN_ENDPOINT_AUTH_METHOD
            ),
        )

MCPOAuthProtectedResourceMetadataConfig dataclass

Bases: BaseDataClass

User-authored config (dr_mcp/oauth-config.yaml / MCP_OAUTH_METADATA).

Every field is optional: resource, authorization_servers and scopes_supported are published verbatim but nothing enforces them yet, so a config that only declares cross_application_access is valid. Unknown keys are ignored, so a config still using the pre-rename xaa_metadata block silently publishes no Cross-Application Access metadata.

Source code in datarobot_genai/drmcpbase/oauth_protected_resource_metadata/entities.py

@dataclass
class MCPOAuthProtectedResourceMetadataConfig(BaseDataClass):
    """User-authored config (``dr_mcp/oauth-config.yaml`` / ``MCP_OAUTH_METADATA``).

    Every field is optional: ``resource``, ``authorization_servers`` and
    ``scopes_supported`` are published verbatim but nothing enforces them yet, so
    a config that only declares ``cross_application_access`` is valid. Unknown
    keys are ignored, so a config still using the pre-rename ``xaa_metadata``
    block silently publishes no Cross-Application Access metadata.
    """

    resource: str | None = None
    authorization_servers: list[str] | None = None
    scopes_supported: list[str] | None = None
    cross_application_access: CrossApplicationAccessMetadata | None = None
    mcp_enable_unauthenticated_well_known_route: bool | None = None

    @classmethod
    def from_dict(
        cls, metadata_in_dict: dict[str, Any]
    ) -> "MCPOAuthProtectedResourceMetadataConfig":
        cross_application_access_in_dict = metadata_in_dict.get(CROSS_APPLICATION_ACCESS_CONFIG_KEY)
        cross_application_access = (
            CrossApplicationAccessMetadata.from_dict(cross_application_access_in_dict)
            if cross_application_access_in_dict
            else None
        )
        return cls(
            resource=metadata_in_dict.get("resource"),
            authorization_servers=metadata_in_dict.get("authorization_servers"),
            scopes_supported=metadata_in_dict.get("scopes_supported"),
            cross_application_access=cross_application_access,
            mcp_enable_unauthenticated_well_known_route=metadata_in_dict.get(
                "mcp_enable_unauthenticated_well_known_route"
            ),
        )

MCPOAuthProtectedResourceMetadata dataclass

Bases: BaseDataClass

The document served at /.well-known/oauth-protected-resource.

Registered RFC 9728 parameters keep their standard names, and DataRobot additions are x_-prefixed — except cross_application_access, which is published unprefixed so it matches the agent-side config block name. Unset fields are dropped by to_dict_without_null_attribute, so a config that only declares cross_application_access yields just that block plus bearer_methods_supported.

Source code in datarobot_genai/drmcpbase/oauth_protected_resource_metadata/entities.py

@dataclass
class MCPOAuthProtectedResourceMetadata(BaseDataClass):
    """The document served at ``/.well-known/oauth-protected-resource``.

    Registered RFC 9728 parameters keep their standard names, and DataRobot
    additions are ``x_``-prefixed — except ``cross_application_access``, which is
    published unprefixed so it matches the agent-side config block name. Unset
    fields are dropped by ``to_dict_without_null_attribute``, so a config that
    only declares ``cross_application_access`` yields just that block plus
    ``bearer_methods_supported``.
    """

    bearer_methods_supported: list[str]
    resource: str | None = None
    authorization_servers: list[str] | None = None
    scopes_supported: list[str] | None = None
    cross_application_access: CrossApplicationAccessMetadata | None = None
    x_mcp_enable_unauthenticated_well_known_route: bool | None = None

    @classmethod
    def build(
        cls,
        user_config: MCPOAuthProtectedResourceMetadataConfig,
        admin_config: MCPOAuthProtectedResourceMetadataAdminConfig,
    ) -> "MCPOAuthProtectedResourceMetadata":
        return cls(
            bearer_methods_supported=admin_config.bearer_methods_supported,
            resource=user_config.resource,
            authorization_servers=user_config.authorization_servers,
            scopes_supported=user_config.scopes_supported,
            cross_application_access=user_config.cross_application_access,
            x_mcp_enable_unauthenticated_well_known_route=(
                user_config.mcp_enable_unauthenticated_well_known_route
            ),
        )