soma_auth/upstream.rs
1//! Outbound OAuth support for upstream MCP servers.
2//!
3//! Reusable runtime mechanics for the outbound `authorization_code` + PKCE flow
4//! used when proxying to OAuth-protected upstream MCP servers. This is the
5//! SDK-side half of upstream OAuth: per-`(upstream, subject)` token storage,
6//! single-flight refresh, encryption-at-rest with AAD binding, and the
7//! per-subject `AuthClient` cache. Browser/API route handling, sessions,
8//! `AuthContext`, cookies, and admin checks stay with the product binary.
9//!
10//! Gated behind the `upstream-oauth-rmcp` feature because it depends on the rmcp
11//! client/auth transport stack and `oauth2`.
12
13pub mod cache;
14pub mod config;
15pub mod encryption;
16pub mod manager;
17pub mod refresh;
18pub mod runtime;
19pub mod store;
20pub mod types;