Elamur Groupantsmova-serve-oauth
The groupant beside tools/mova-serve/src/oauth.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| Approximant | partial | Approximant |
| Ast | partial | syntax.json |
| Cost | symbolic source derived | Cost |
| Descriptant | present | Descriptant |
| Invariant | partial | Invariant |
| Tests | executed bounded checks | Tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | Behavior complement |
| Reverse reconstruction | reverse reconstruction | partial source derived model | Reverse reconstruction |
| Model presence | model presence | partial source derived model | Model presence |
Model text
Descriptant
OAuth 2.1 authorization server state for MCP connectors: public clients registered dynamically, authorization codes with PKCE S256, resource-bound access tokens (1 h) and rotating refresh tokens (30 days) stored as hashes, grants per account and client, reuse detection, revocation, metadata documents.
Approximant
register -> client; issue_code -> code; exchange_code(code, client, redirect, verifier) -> tokens iff S256(verifier) = challenge; refresh uses the old token up; authenticate(access) -> sub iff alive and the audience is ours.
Invariant
No token or code is stored in clear; a code and a refresh token work once and a replay revokes the grant; an access token is valid at this resource only; redirect URIs are https or loopback http and compared whole (loopback: any port); secrets are compared in constant time.
Cost
See the registry entry; lookups by token hash are O(log n).
Behavior complement
No client secrets, no plain PKCE, no implicit or password grant, no scopes beyond mcp, no introspection, no client ID metadata documents.
Reverse reconstruction
A token hash identifies its grant, the grant the account, client and accepted terms; a used code or refresh token identifies a replay.
Model presence
Without a state directory the store lives in memory.
Tests
oauth::tests: redirect URI rules with negative controls, registration limits and the rate limit, PKCE/client/redirect/resource/expiry controls and code reuse, token expiry and audience, refresh rotation and replay revocation, revocation and disconnect, restart with hashes only, metadata documents.
Provenance
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/mova-serve/src/oauth.rs.groupant/