Package org.apache.juneau.rest.server.mcp.v20260728

Class McpBearerChallenge

java.lang.Object
org.apache.juneau.rest.server.mcp.v20260728.McpBearerChallenge
public final class McpBearerChallenge extends Object
Fluent, insertion-ordered builder for a WWW-Authenticate: Bearer ... challenge value (RFC 6750 §3, RFC 9728 §5.1) emitted by the 2026-07-28 MCP resource server on a 401.

Produces Bearer <k>="<v>", ... auth-params in the order added, so the emitted header parses cleanly on the client side via org.apache.juneau.rest.client.mcp.auth.WwwAuthenticateChallenge (which lower-cases keys and accepts quoted values). Auth-param values are sanitized for the RFC 7235 quoted-string grammar: control characters (< 0x20 and 0x7F, including CR/LF that would otherwise enable header injection) are stripped, and "/\ are backslash-escaped (\" / \\) rather than mangled.

Extensibility:

The baseline emits realm, error, error_description, scope, and resource_metadata. The generic param(String, String) seam lets a later layer (SEP-2350 scoped step-up) add further auth-params without touching this class — this class deliberately does not implement scope-accumulation/step-up.

Since:
10.0.0

  • Method Details

    • create

      public static McpBearerChallenge create()
      Static creator.
      Returns:
      A new, empty challenge builder.

    • realm

      public McpBearerChallenge realm(String value)
      Adds the realm auth-param.
      Parameters:
      value - The realm. A null value is ignored.
      Returns:
      This object (for method chaining).

    • error

      public McpBearerChallenge error(String value)
      Adds the error auth-param (e.g. invalid_token, insufficient_scope).
      Parameters:
      value - The error code. A null value is ignored.
      Returns:
      This object (for method chaining).

    • errorDescription

      public McpBearerChallenge errorDescription(String value)
      Adds the error_description auth-param.
      Parameters:
      value - The human-readable error description. A null value is ignored.
      Returns:
      This object (for method chaining).

    • scope

      public McpBearerChallenge scope(Collection<String> scopes)
      Adds the space-delimited scope auth-param.
      Parameters:
      scopes - The scopes. A null or empty collection is ignored.
      Returns:
      This object (for method chaining).

    • resourceMetadata

      public McpBearerChallenge resourceMetadata(URI value)
      Adds the resource_metadata auth-param (RFC 9728 §5.1) pointing at the PRM document.
      Parameters:
      value - The PRM document URI. A null value is ignored.
      Returns:
      This object (for method chaining).

    • param

      public McpBearerChallenge param(String name, String value)
      Adds an arbitrary auth-param — the extensibility seam for future challenge parameters.
      Parameters:
      name - The auth-param name. Must not be null or blank.
      value - The auth-param value. A null value is ignored (the param is not added).
      Returns:
      This object (for method chaining).

    • build

      public String build()
      Builds the WWW-Authenticate challenge value.
      Returns:
      The header value (e.g. Bearer realm="mcp", resource_metadata="https://host/.well-known/..."), or the bare Bearer scheme when no auth-params were added.

    • toString

      public String toString()
      Overrides:
      toString in class Object