extractExpectedAudience determines the expected audience for the current request. This should match the resource parameter used during authorization.
(accessURL *url.URL, r *http.Request)
| 874 | // extractExpectedAudience determines the expected audience for the current request. |
| 875 | // This should match the resource parameter used during authorization. |
| 876 | func extractExpectedAudience(accessURL *url.URL, r *http.Request) string { |
| 877 | // For MCP compliance, the audience should be the canonical URI of the resource server |
| 878 | // This typically matches the access URL of the Coder deployment |
| 879 | var audience string |
| 880 | |
| 881 | if accessURL != nil { |
| 882 | audience = accessURL.String() |
| 883 | } else { |
| 884 | scheme := "https" |
| 885 | if r.TLS == nil { |
| 886 | scheme = "http" |
| 887 | } |
| 888 | |
| 889 | // Use the Host header to construct the canonical audience URI |
| 890 | audience = fmt.Sprintf("%s://%s", scheme, r.Host) |
| 891 | } |
| 892 | |
| 893 | // Normalize the URI according to RFC 3986 for consistent comparison |
| 894 | return normalizeAudienceURI(audience) |
| 895 | } |
| 896 | |
| 897 | // UserRBACSubject fetches a user's rbac.Subject from the database. It pulls all roles from both |
| 898 | // site and organization scopes. It also pulls the groups, and the user's status. |