McpAuth Class Reference

McpAuth Class. More...

Collaboration diagram for McpAuth:

Public Member Functions
	__construct ($db)
	Constructor.
	getCredential ($server=null, $get=null)
	Extract the credential presented by the caller.
	authenticate ($server=null, $get=null)
	Authenticate the caller.
	getWwwAuthenticateHeader ($resourcemetadataurl='')
	Value of the WWW-Authenticate header to send with a 401.

Public Attributes
const	MODE_USER = 'user'
	Credential mode: an individual user API key was presented.
const	MODE_SHARED = 'shared'
	Credential mode: the shared AI_MCP_API_KEY was presented.

Private Member Functions
	fetchUserIdFromApiKey ($credential)
	Look up the active user owning this API key.

Detailed Description

McpAuth Class.

Resolves the credential presented by an MCP client and turns it into a Dolibarr identity. Two credentials are accepted:

• a user API key (the same key the REST API takes), which authenticates the request as that user, so tools run with that user's permissions and the request log names who actually called;
• the shared server key AI_MCP_API_KEY, kept for backward compatibility, which authenticates the request as the AI_MCP_USER_ID service user.

The class deliberately holds no state beyond the result of the last call and touches neither the HTTP response nor the session: it reads a request and answers a question. That is what lets the MCP entry point stay a thin script today, and lets the same logic be handed to an AuthorizationMiddleware later without being rewritten.

Definition at line 45 of file mcpauth.class.php.

Constructor & Destructor Documentation

__construct()

McpAuth::__construct

(

$db

)

Constructor.

Parameters

DoliDB

$db

Database handler

Definition at line 96 of file mcpauth.class.php.

Member Function Documentation

authenticate()

McpAuth::authenticate	(		$server = null,
			$get = null )

Authenticate the caller.

On success, $this->userid holds the user to run the request as (0 when the shared key was used) and $this->mode says which credential matched. On failure, $this->error and $this->httpcode hold what to answer.

Parameters

array<string,mixed>|null	$server Server variables, defaults to $_SERVER
array<string,mixed>|null	$get Query parameters, defaults to $_GET

Returns

int 1 if authenticated, -1 otherwise

Definition at line 185 of file mcpauth.class.php.

References dol_syslog(), fetchUserIdFromApiKey(), getCredential(), getDolGlobalString(), MODE_SHARED, MODE_USER, and user.

fetchUserIdFromApiKey()

McpAuth::fetchUserIdFromApiKey ( $credential )

private

Look up the active user owning this API key.

The lookup matches the REST API: the key is stored either plain or encrypted, and moves to the token table when API_IN_TOKEN_TABLE is set. Entity selection is not handled here; MCP requests run in the entity of the endpoint, and multicompany switching is a separate piece of work.

Parameters

string

$credential

Credential presented by the caller

Returns

int User rowid, or 0 when no single active user owns this key

Definition at line 287 of file mcpauth.class.php.

References dol_syslog(), dolDecrypt(), dolEncrypt(), and getDolGlobalString().

Referenced by authenticate().

getCredential()

McpAuth::getCredential	(		$server = null,
			$get = null )

Extract the credential presented by the caller.

Accepted forms, in order of precedence, mirroring the REST API (see Api Access class) so a key that works on /api/index.php works here:

• "DOLAPIKEY: <key>" header
• "Authorization: Bearer <key>" header
• "X-API-Key: <key>" header
• "?DOLAPIKEY=", "?api_key=" or "?key=" query parameter

The Authorization header is read from several places on purpose: Apache in CGI/FastCGI mode does not expose it unless CGIPassAuth is on, and the usual workaround republishes it as REDIRECT_HTTP_AUTHORIZATION. Reading $_SERVER alone makes Bearer authentication fail on those setups with no diagnostic other than a 401.

Parameters

array<string,mixed>|null	$server Server variables, defaults to $_SERVER
array<string,mixed>|null	$get Query parameters, defaults to $_GET

Returns

string The credential, or '' when none was presented

Definition at line 121 of file mcpauth.class.php.

References dol_string_nounprintableascii().

Referenced by authenticate().

getWwwAuthenticateHeader()

McpAuth::getWwwAuthenticateHeader

(

$resourcemetadataurl = ''

)

Value of the WWW-Authenticate header to send with a 401.

RFC 6750 section 3 requires the challenge on a rejected Bearer request; without it a client cannot tell "this endpoint wants a token" from "this endpoint is broken". When an authorization server is added, the URL of the Protected Resource Metadata document is passed here and clients discover it as described by RFC 9728 section 5.1.

Parameters

string

$resourcemetadataurl

Absolute URL of the Protected Resource Metadata document, if any

Returns

string Header value, without the header name

Definition at line 266 of file mcpauth.class.php.

---

The documentation for this class was generated from the following file:

• dolibarr_dev/htdocs/ai/class/mcpauth.class.php