Package org.apache.juneau.rest.client.mcp.auth

Class McpTokenProvider

java.lang.Object
org.apache.juneau.rest.client.mcp.auth.McpTokenProvider
All Implemented Interfaces:
Supplier<String>
public class McpTokenProvider extends Object implements Supplier<String>
A headless bearer-token provider that feeds the McpAuthInterceptor token seam (Supplier<String>).

This is the client-side token-manager: it acquires, caches, and refreshes an access token and returns the current valid bearer credential from get(). Three modes are supported:

  • Pre-provisioned / static (ofStaticToken(String)) — always returns a fixed token.
  • Client-credentials (clientCredentials()) — RFC 6749 §4.4 grant, re-acquired on expiry.
  • Refresh-token (refreshToken(String), SEP-2207) — RFC 6749 §6 grant; rotated refresh tokens returned by the IdP are captured and used for the next refresh without re-consent, and the refreshed access token is fed back to the supplier.

The dynamic modes (client-credentials, refresh-token) require McpTokenProvider.Builder.resource(URI) and carry that RFC 8707 resource indicator on every token request, binding the token's audience to the target MCP server. The static mode issues no token request, so it takes no resource indicator.

get() never returns a blank token: dynamic modes return the IdP-issued (non-blank) access token or throw McpAuthException/OAuthFlowException on failure (which aborts the intercepted request), and the static mode rejects a blank token at construction. This satisfies the McpAuthInterceptor "supply a non-blank token or suppress the header" contract.

Thread-safe. Never logged: toString() discloses only non-secret configuration.

Since:
10.0.0

  • Constructor Details

  • Method Details

    • ofStaticToken

      public static McpTokenProvider ofStaticToken(String token)
      Creates a provider that always returns the supplied pre-provisioned bearer token.
      Parameters:
      token - The static bearer token. Must not be null or blank.
      Returns:
      A new provider.

    • clientCredentials

      public static McpTokenProvider.Builder clientCredentials()
      Creates a builder for the client-credentials grant.
      Returns:
      A new builder.

    • refreshToken

      public static McpTokenProvider.Builder refreshToken(String initialRefreshToken)
      Creates a builder for the refresh-token grant, seeded with the initial refresh token.
      Parameters:
      initialRefreshToken - The initial refresh token. Must not be null or blank.
      Returns:
      A new builder.

    • get

      public String get()
      Returns the current valid bearer token, acquiring or refreshing one on demand.

      Dynamic modes acquire under a single-flight monitor so concurrent callers don't stampede the IdP; the per-request HTTP timeout (McpTokenProvider.Builder.httpTimeout(Duration), default 10s) is the backstop that prevents one hung IdP from wedging the monitor indefinitely. In refresh mode a terminal invalid_grant latches the provider: every subsequent call throws a distinguishable McpAuthException rather than re-hammering the IdP with a dead refresh token (SEP-2207).

      Specified by:
      get in interface Supplier<String>
      Returns:
      A non-blank bearer token. Never null for a successfully configured provider.
      Throws:
      OAuthFlowException - If a token acquisition/refresh HTTP round-trip fails or the IdP returns an error.
      McpAuthException - If a prior refresh was terminally rejected (invalid_grant); re-authorization is required.

    • currentRefreshToken

      public Optional<String> currentRefreshToken()
      Returns the refresh token currently held (the most recently rotated value in refresh mode).

      Callers persisting refresh tokens across process restarts read this after each get() to capture a rotated token (SEP-2207).

      Returns:
      The current refresh token, or Optional.empty() if none is held.

    • interceptor

      public McpAuthInterceptor interceptor()
      Creates an McpAuthInterceptor backed by this provider, ready to attach to an MCP client builder.
      Returns:
      A new interceptor.

    • toString

      public String toString()
      Redacts token/secret material so nothing sensitive reaches logs via this provider's toString().
      Overrides:
      toString in class Object
      Returns:
      A redacted string form disclosing only non-secret configuration.