// authorizer/src/main.rsusestd::collections::HashMap;uselambda_runtime::{run,service_fn,tracing,Error,LambdaEvent};useserde::{Deserialize,Serialize};modgeneric_handler;// https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html#[derive(Deserialize)]pubstructRequest{pubheaders:HashMap<String,String>}#[derive(Serialize)]pubstructResponse{pubisAuthorized:bool,pubcontext:HashMap<String,String>}#[tokio::main]asyncfnmain()->Result<(),Error>{tracing::init_default_subscriber();run(service_fn(function_handler)).await}asyncfnfunction_handler(event:LambdaEvent<Request>)->Result<Response,Error>{// auth logicOk(Response{isAuthorized:false,context:HashMap::new()})}

// mcp-resource/src/main.rsuseaxum::{http::StatusCode,response::IntoResponse,routing::post,Router};usetower_http::trace::{DefaultMakeSpan,TraceLayer};usetracing_subscriber::EnvFilter;constPORT:u16=8080;#[tokio::main]asyncfnmain(){tracing_subscriber::fmt().with_env_filter(EnvFilter::try_from_default_env().unwrap_or_else(|_|EnvFilter::new("debug"))).init();letapp=Router::<()>::new().route("/mcp",post(mcp_handler)).layer(TraceLayer::new_for_http().make_span_with(DefaultMakeSpan::new().include_headers(true)));letlistener=tokio::net::TcpListener::bind(format!("0.0.0.0:{}",PORT)).await.unwrap();axum::serve(listener,app).await.unwrap();}pubasyncfnmcp_handler()->implIntoResponse{"hello"}

infrastructure/lib/infrastructure-stack.tsimport*ascdkfrom'aws-cdk-lib';import{Construct}from'constructs';import{RustFunction}from'@cdklabs/aws-lambda-rust'exportclassMCPAuthLambdaextendscdk.Stack{constructor(scope:Construct,id:string,props?:cdk.StackProps){super(scope,id,props);constauthorizer=newRustFunction(this,'Authorizer',{entry:'../authorizer/Cargo.toml',environment:{RUST_LOG:'info'}})constadapterLayer=cdk.aws_lambda.LayerVersion.fromLayerVersionArn(this,'WebAdapterLayer','arn:aws:lambda:us-east-1:753240598075:layer:LambdaAdapterLayerX86:25');constmcpResourceServer=newRustFunction(this,'McpResourceServer',{entry:'../mcp-resource',layers:[adapterLayer],environment:{RUST_LOG:'info'}})consthttpApi=newcdk.aws_apigatewayv2.HttpApi(this,'MCP-Auth-API');httpApi.addRoutes({path:'/mcp',authorizer:newcdk.aws_apigatewayv2_authorizers.HttpLambdaAuthorizer('Authorizer',authorizer,{responseTypes:[cdk.aws_apigatewayv2_authorizers.HttpLambdaResponseType.SIMPLE]}),methods:[cdk.aws_apigatewayv2.HttpMethod.GET,cdk.aws_apigatewayv2.HttpMethod.POST],integration:newcdk.aws_apigatewayv2_integrations.HttpLambdaIntegration("mcp-resource",mcpResourceServer)});newcdk.CfnOutput(this,'ApiUrl',{value:httpApi.url!})}}

goose configure

// mcp-authorize/src/main.rsuseaxum::{debug_handler,response::IntoResponse,routing::get,Json,Router};constPORT:u16=8081;#[tokio::main]asyncfnmain(){letapp=Router::<()>::new().route("/.well-known/oauth-authorization-server",get(well_known_handler),);letlistener=tokio::net::TcpListener::bind(format!("0.0.0.0:{}",PORT)).await.unwrap();axum::serve(listener,app).await.unwrap();}#[debug_handler]asyncfnwell_known_handler()->implIntoResponse{Json(WellKnownAnswer{authorization_endpoint:"http://localhost:3000/authorize".to_string(),registration_endpoint:"http://localhost:3000/register".to_string(),grant_types_supported:vec!["authorization_code".to_string(),"refresh_token".to_string()],scopes_supported:vec!["email".to_string(),"offline_access".to_string(),"openid".to_string(),"profile".to_string()],response_modes_supported:vec!["query".to_string()],response_types_supported:vec!["code".to_string()],token_endpoint:"http://localhost:3000/token".to_string(),issuer:"https://fresh-lamb-82-staging.authkit.app".to_string(),})}#[derive(serde::Serialize)]pubstructWellKnownAnswer{pubauthorization_endpoint:String,pubregistration_endpoint:String,pubgrant_types_supported:Vec<String>,pubscopes_supported:Vec<String>,pubresponse_modes_supported:Vec<String>,pubresponse_types_supported:Vec<String>,pubtoken_endpoint:String,pubissuer:String,}

// ...constmcpAuthorizationServer=newRustFunction(this,'McpAuthorizationServer',{entry:'../mcp-authorize',layers:[adapterLayer],environment:{RUST_LOG:'debug',PORT:'8081',}})//...httpApi.addRoutes({path:'/.well-known/oauth-authorization-server',methods:[cdk.aws_apigatewayv2.HttpMethod.GET],integration:newcdk.aws_apigatewayv2_integrations.HttpLambdaIntegration("mcp-authorization",mcpAuthorizationServer)});// ...

// mcp-authorize/src/main.rs// ...letapp=Router::<()>::new().route("/.well-known/oauth-authorization-server",get(well_known_handler),).route("/register",post(registration_handler));// ...#[debug_handler]asyncfnregistration_handler(Json(req):Json<ClientRegistrationRequest>)->implIntoResponse{println!("{:?}",req);Json(ClientRegistrationAnswer{client_id:CLIENT_ID.to_string(),redirect_uris:req.redirect_uris,response_types:req.response_types,grant_types:req.grant_types,client_name:req.client_name})}#[derive(Debug,Deserialize)]pubstructClientRegistrationRequest{pubclient_name:String,pubredirect_uris:Vec<String>,pubgrant_types:Vec<String>,pubtoken_endpoint_auth_method:String,pubresponse_types:Vec<String>,}#[derive(Serialize)]pubstructClientRegistrationAnswer{client_id:String,redirect_uris:Vec<String>,response_types:Vec<String>,grant_types:Vec<String>,client_name:String}//...

// ...httpApi.addRoutes({path:'/register',methods:[cdk.aws_apigatewayv2.HttpMethod.POST],integration:newcdk.aws_apigatewayv2_integrations.HttpLambdaIntegration("mcp-authorization",mcpAuthorizationServer)});

// ...#[debug_handler]asyncfnauthorization_handler(Query(params):Query<HashMap<String,String>>)->implIntoResponse{letoriginal_uri=params.get("redirect_uri").unwrap();letstate=BASE64_STANDARD.encode(original_uri);letlocal_redirect="http://localhost:3000/callback";leturl=reqwest::Url::parse_with_params("https://api.workos.com/user_management/authorize",&[("response_type","code"),("client_id",CLIENT_ID),("redirect_uri",local_redirect),("code_challenge",params.get("code_challenge").unwrap()),("code_challenge_method","S256"),("provider","authkit"),("state",state.as_str()),("scope","openid profile email offline_access"),],).unwrap();Redirect::temporary(url.as_str())}// ...

// ...#[debug_handler]asyncfncallback_handler(Query(params):Query<HashMap<String,String>>)->implIntoResponse{letcode=params.get("code").unwrap();letstate=params.get("state").unwrap();letoriginal_redirect_uri=String::from_utf8(BASE64_STANDARD.decode(state).unwrap()).unwrap();letresponse_url=reqwest::Url::parse_with_params(original_redirect_uri.as_str(),&[("code",&code),("state",&state)],).unwrap();Redirect::temporary(response_url.as_str())}// ...

asyncfntoken_handler(State(state):State<AppState>,Form(form):Form<HashMap<String,String>>)->implIntoResponse{letgrant_type=form.get("grant_type").unwrap();letclient=reqwest::Client::new();letrequest=matchgrant_type.as_str(){"authorization_code"=>{letcode=form.get("code").unwrap();letcode_verifier=form.get("code_verifier").unwrap();letclient_id=form.get("client_id").unwrap();json!({"client_id":client_id,"client_secret":state.workos_client_secret,"grant_type":"authorization_code","code":code,"code_verifier":code_verifier})}"refresh_token"=>{letrefresh_token=form.get("refresh_token").unwrap();letclient_id=form.get("client_id").unwrap();json!({"client_id":client_id,"client_secret":state.workos_client_secret,"grant_type":"refresh_token","refresh_token":refresh_token,})}_=>panic!("Invalid grant type"),};println!("token request: {}",request);letres=client.post("https://api.workos.com/user_management/authenticate").body(serde_json::to_string(&request).unwrap()).header("Content-Type","application/json").send().await.unwrap();letauthkit_response:AuthkitAuthResult=serde_json::from_str(res.text().await.unwrap().as_str()).unwrap();println!("token response {:?}",&authkit_response);letexpires_at=chrono::Utc::now().timestamp()+3600;lettoken_result=TokenResponse{access_token:authkit_response.access_token,refresh_token:authkit_response.refresh_token,token_type:"Bearer".to_string(),expires_at,};Json(token_result)}//...#[derive(Serialize,Deserialize,Debug)]pubstructTokenResponse{access_token:String,refresh_token:String,token_type:String,expires_at:i64,}#[derive(Serialize,Deserialize,Debug)]pubstructAuthkitAuthResult{access_token:String,refresh_token:String,}// ...

// authorizer/src/token.rsusejsonwebtoken::{decode_header,DecodingKey,TokenData};useserde::{Deserialize,Serialize};#[derive(Debug,Serialize,Deserialize)]pubstructClaims{pubsub:String,pubexp:usize,}#[derive(Serialize,Deserialize,Clone,Debug)]pubstructJWK{pubkid:String,pubkty:String,pubalg:String,pubn:String,pube:String,}#[derive(Serialize,Deserialize,Clone,Debug)]pubstructJWKS{pubkeys:Vec<JWK>,}pubasyncfnget_jwks(jwks_url:String)->JWKS{letjwks_resp=reqwest::get(jwks_url).await.unwrap();letjwks:JWKS=jwks_resp.json().await.unwrap();jwks}pubasyncfncheck_token(token:&str,keys:&JWKS)->Result<TokenData<Claims>,String>{letheader=decode_header(token).unwrap();letkid=header.kid.ok_or("No kid found in token header")?;letjwk=keys.keys.iter().find(|k|k.kid==kid).ok_or("No matching kid found in jwks")?;letdecoding_key=DecodingKey::from_rsa_components(&jwk.n,&jwk.e).map_err(|op|format!("Error: {:?}",op))?;letmutvalidation=jsonwebtoken::Validation::new(jsonwebtoken::Algorithm::RS256);validation.validate_exp;lettoken_data=jsonwebtoken::decode::<Claims>(token,&decoding_key,&validation).map_err(|op|format!("Error: {:?}",op))?;println!("{:?}",token_data.claims);Ok(token_data)}

// authorizer/src/main.rsusestd::collections::HashMap;uselambda_runtime::{run,service_fn,tracing,Error,LambdaEvent};useserde::{Deserialize,Serialize};useserde_json::{json,Value};usetoken::JWKS;modtoken;// https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-lambda-authorizer.html#[derive(Deserialize)]pubstructRequest{pubheaders:HashMap<String,String>,}#[derive(Serialize)]#[serde(rename_all="camelCase")]pubstructResponse{pubis_authorized:bool,pubcontext:HashMap<String,String>,}#[derive(Serialize)]#[serde(rename_all="camelCase")]pubstructUnauthorizedResponse{puberror_message:String,}#[derive(Serialize)]#[serde(untagged)]pubenumAuthorizerResponse{PermissionResponse(Response),Unauthorized(UnauthorizedResponse),}#[tokio::main]asyncfnmain()->Result<(),Error>{tracing::init_default_subscriber();letjwks_url=std::env::var("JWKS_URL").expect("JWKS_URL must be set");letjwks=token::get_jwks(jwks_url).await;println!("JWKS: {:?}",&jwks);run(service_fn(|ev|function_handler(&jwks,ev))).await}asyncfnfunction_handler(jwks:&JWKS,event:LambdaEvent<Request>,)->Result<AuthorizerResponse,Error>{lettoken_header=event.payload.headers.get("authorization");iftoken_header.is_none(){println!("No token header");returnOk(AuthorizerResponse::Unauthorized({UnauthorizedResponse{error_message:"Unauthorized".to_string(),}}));}lettoken=token_header.unwrap().replace("Bearer ","");letclaims=token::check_token(token.as_str(),jwks).await;// auth logicmatchclaims{Ok(tk)=>{println!("Claims: {:?}",tk);Ok(AuthorizerResponse::PermissionResponse(Response{is_authorized:true,context:HashMap::new(),}))}Err(e)=>{println!("Error: {:?}",e);Ok(AuthorizerResponse::Unauthorized({UnauthorizedResponse{error_message:"Unauthorized".to_string(),}}))}}}