Elamur Groupantsmova-serve-oauth-http
The groupant beside tools/mova-serve/src/oauth_http.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.
Facts
Implementation material. A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.
Components
| component | label | where |
|---|---|---|
| Approximant | partial | Approximant |
| Ast | partial | syntax.json |
| Cost | symbolic source derived | Cost |
| Descriptant | present | Descriptant |
| Invariant | partial | Invariant |
| Tests | executed bounded checks | Tests |
Obernants
The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.
| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | Behavior complement |
| Reverse reconstruction | reverse reconstruction | partial source derived model | Reverse reconstruction |
| Model presence | model presence | partial source derived model | Model presence |
Model text
Descriptant
The routes of the authorization server (cabinet host) and the resource server (MCP host): metadata, registration, authorize, consent, token, revoke, disconnect, the bearer challenge, the /account endpoint.
Approximant
authorize -> consent?rq iff client and redirect URI are registered; consent(allow, csrf, terms) -> redirect(code, state, iss); token -> JSON; bearer -> account on the MCP host only.
Invariant
An unregistered redirect URI is never redirected to; the consent form needs a session, an HMAC CSRF token, our origin and the terms box, and refuses framing; the root MCP endpoint never asks for credentials and answers 401 with resource_metadata only to an invalid token; /account answers 401 with the challenge to no credentials.
Cost
See the registry entry; lookups by token hash are O(log n).
Behavior complement
Never logs a token or code; never accepts an access token on the API host; no tokens in URLs except the code in the redirect.
Reverse reconstruction
The redirect and the cabinet list recover request and grants.
Model presence
Without Google settings authorization answers 503 and nothing is issued.
Tests
oauth_http::tests: metadata on the right hosts, registration, open-redirect and PKCE controls, consent controls, and the end-to-end flow register, authorize, consent, token, MCP call, refresh, replay, revoke, disconnect, account deletion, terms change; tool annotations, server info, icon.
Provenance
This page in Markdown → https://md.groupants.elamur.ai/free/en/mova/tools/mova-serve/src/oauth_http.rs.groupant/