Authentication

# auth.py
from golf.auth import configure_auth, JWTAuthConfig

configure_auth(
    JWTAuthConfig(
        jwks_uri_env_var="JWKS_URI",
        issuer_env_var="JWT_ISSUER", 
        audience_env_var="JWT_AUDIENCE",
        required_scopes=["read:user"]
    )
)

JWKS_URI=https://your-provider.com/.well-known/jwks.json
JWT_ISSUER=https://your-provider.com/
JWT_AUDIENCE=your-api-audience

# Alternative: PEM-encoded public key (instead of JWKS_URI)
JWT_PUBLIC_KEY="-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEF..."

# Multiple audiences (comma-separated)
JWT_AUDIENCE=https://api.production.com,https://api2.production.com

# auth.py
from golf.auth import configure_auth, StaticTokenConfig

configure_auth(
    StaticTokenConfig(
        tokens={
            "dev-token-123": {
                "client_id": "dev-client",
                "scopes": ["read", "write"]
            },
            "test-token-456": {
                "client_id": "test-client",
                "scopes": ["read"]
            }
        },
        required_scopes=["read"]
    )
)

curl -H "Authorization: Bearer dev-token-123" http://localhost:3000/mcp

# auth.py
from golf.auth import configure_auth, OAuthServerConfig

configure_auth(
    OAuthServerConfig(
        base_url="https://auth.example.com",           # Public URL of your server
        issuer_url="https://auth.example.com",         # OAuth issuer URL  
        service_documentation_url="https://docs.example.com",  # Optional

        # Scope configuration
        valid_scopes=["read", "write", "admin"],       # Scopes clients can request
        default_scopes=["read"],                       # Default scopes for new clients
        required_scopes=["read"],                      # Scopes required for all requests

        # Environment variable support
        base_url_env_var="OAUTH_BASE_URL"              # Runtime URL override
    )
)

# .env file
OAUTH_BASE_URL=https://auth.production.com

# auth.py
from golf.auth import configure_auth, RemoteAuthConfig, JWTAuthConfig

configure_auth(
    RemoteAuthConfig(
        # Static configuration
        authorization_servers=["https://auth1.example.com"],
        resource_server_url="https://api.example.com",

        # Environment variable resolution (NEW in v0.2.0)
        authorization_servers_env_var="AUTH_SERVERS",    # Comma-separated server URLs
        resource_server_url_env_var="RESOURCE_URL",      # This resource server's URL

        token_verifier_config=JWTAuthConfig(jwks_uri_env_var="JWKS_URI")
    )
)

# .env file for Remote Auth
AUTH_SERVERS=https://auth1.prod.com,https://auth2.prod.com,https://backup-auth.prod.com
RESOURCE_URL=https://api.production.com
JWKS_URI=https://auth1.prod.com/.well-known/jwks.json

# auth.py
from golf.auth import configure_api_key

# Configure which header contains the API key
configure_api_key(
    header_name="Authorization",  # Header to extract from
    header_prefix="Bearer "       # Optional prefix to strip
)

from golf.auth import get_api_key

async def my_tool():
    api_key = get_api_key()
    if not api_key:
        return {"error": "No API key provided"}
    
    # Use the key with your API
    response = await client.get(
        "https://api.example.com/endpoint",
        headers={"Authorization": f"Bearer {api_key}"}
    )

from golf.auth import get_auth_token

async def secure_api_tool(data: str):
    # Extract authentication token
    auth_token = get_auth_token()
    
    if not auth_token:
        return {"error": "JWT/OAuth token required"}
    
    # Forward token to upstream API
    import httpx
    async with httpx.AsyncClient() as client:
        response = await client.post(
            "https://api.example.com/secure-endpoint",
            headers={"Authorization": f"Bearer {auth_token}"},
            json={"data": data}
        )
        
        return {
            "data": data,
            "response": response.json(),
            "authenticated": True
        }

# All JWT fields now support environment variables
configure_auth(
    JWTAuthConfig(
        # Direct values (still supported)
        jwks_uri="https://auth.example.com/.well-known/jwks.json",

        # Environment variable resolution (preferred for deployment)
        public_key_env_var="JWT_PUBLIC_KEY",           # PEM-encoded public key
        jwks_uri_env_var="JWKS_URI",                   # JWKS endpoint URL
        issuer_env_var="JWT_ISSUER",                   # Expected issuer
        audience_env_var="JWT_AUDIENCE",               # Expected audience(s)
        required_scopes=["read:user"]                  # Scopes are part of the config object
    )
)

# ❌ BROKEN - These will cause TypeError in v0.2.0
configure_jwt_auth(
    jwks_uri_env_var="JWKS_URI",
    required_scopes=["read:user"]  # This parameter was removed
)

configure_dev_auth(
    tokens={"dev-token": {"client_id": "dev"}},
    required_scopes=["read"]  # This parameter was removed  
)

# ✅ CORRECT - v0.2.0 syntax
from golf.auth import configure_auth, JWTAuthConfig, StaticTokenConfig

# JWT Auth - scopes are part of the config object
configure_auth(
    JWTAuthConfig(
        jwks_uri_env_var="JWKS_URI",
        required_scopes=["read:user"]  # Scopes are part of the config object
    )
)

# Development Auth
configure_auth(
    StaticTokenConfig(
        tokens={
            "dev-token-123": {
                "client_id": "dev-client",
                "scopes": ["read", "write"]
            }
        },
        required_scopes=["read"]  # Scopes are part of the config object
    )
)