Module manager 

Upstream OAuth lifecycle manager.

UpstreamOauthManager orchestrates the full outbound authorization_code + PKCE flow for one configured upstream MCP server. It is per-upstream (constructed once per UpstreamConfig that has an oauth block) and is Clone / Send + Sync.

Subject

All public methods take a subject: &str identifying the user initiating the flow. Credentials are stored and refreshed independently per (upstream, subject).

Two-phase authorization

begin_authorization(subject)
  ↓  generates PKCE + CSRF, stores state in SQLite, returns redirect URL
browser → AS → callback
  ↓
complete_authorization_callback(subject, code, csrf)
  ↓  exchanges code, stores encrypted tokens in SQLite
build_auth_client(subject)
  ↓  loads stored credentials, proactively refreshes if stale
AuthClient<reqwest::Client>  → used by the consumer's connection pool for MCP calls

AS metadata caching

Authorization server metadata is fetched once per upstream (not per-subject) and cached to avoid an HTTP round-trip on every build_auth_client call.

Structs

UpstreamOauthManager

Upstream OAuth manager for a single upstream MCP server.