auth wip

Signed-off-by: phernandez <paul@basicmachines.co>

Author: phernandez

AUTH.md

@@ -2,6 +2,43 @@
 
 This guide shows how to test OAuth authentication with Basic Memory MCP server, including how to connect from Claude.ai.
 
+## MCP Inspector Testing
+
+To test with MCP Inspector when OAuth is enabled:
+
+1. **Start the server with OAuth**:
+   ```bash
+   FASTMCP_AUTH_ENABLED=true basic-memory mcp --transport streamable-http
+   ```
+
+2. **Register a client** (in another terminal):
+   ```bash
+   basic-memory auth register-client --client-id=test-client
+   # Save the client_secret that's generated!
+   ```
+
+3. **Get an access token**:
+   ```bash
+   # Test the flow to get a token
+   basic-memory auth test-auth
+   # Look for "Access token: ..." in the output
+   ```
+
+4. **Use token in MCP Inspector**:
+   - Header Name: `Authorization`
+   - Bearer Token: `<paste the access token from step 3>`
+
+   Or manually get a token:
+   ```bash
+   # Get authorization code
+   curl "http://localhost:8000/auth/authorize?client_id=test-client&redirect_uri=http://localhost:3000/callback&response_type=code&code_challenge=test"
+   
+   # Exchange for token (use code from redirect URL)
+   curl -X POST http://localhost:8000/auth/token \
+     -H "Content-Type: application/x-www-form-urlencoded" \
+     -d "grant_type=authorization_code&code=YOUR_CODE&client_id=test-client&client_secret=YOUR_SECRET&code_verifier=test"
+   ```
+
 ## Local Testing with Built-in Provider
 
 1. **Create `.env` file**:
@@ -21,7 +58,7 @@ This guide shows how to test OAuth authentication with Basic Memory MCP server,
    basic-memory mcp --transport streamable-http
 
    # Or directly
-   FASTMCP_AUTH_ENABLED=true basic-memory mcp --transport streamable-http
+   
    ```
 
 4. **Register a client**:
@@ -57,15 +94,47 @@ This guide shows how to test OAuth authentication with Basic Memory MCP server,
 
 When OAuth is enabled, these endpoints are available:
 
-- `GET /authorize` - OAuth authorization endpoint
-- `POST /token` - Token exchange endpoint
+- `GET /auth/authorize` - OAuth authorization endpoint
+- `POST /auth/token` - Token exchange endpoint
 - `GET /mcp` - Protected MCP endpoint (requires Bearer token)
 
+## Testing with MCP Inspector
+
+**Note**: The OAuth2 flow typically requires browser interaction. With MCP Inspector, you can use bearer token authentication directly.
+
+### Bearer Token Approach
+
+1. Run the test-auth command to get tokens:
+   ```bash
+   basic-memory auth test-auth
+   ```
+   This will output an access token that you can copy.
+
+2. In MCP Inspector:
+   - Server URL: `http://localhost:8000/mcp`
+   - Transport: `streamable-http`
+   - Add custom headers:
+     ```
+     Authorization: Bearer YOUR_ACCESS_TOKEN
+     ```
+
+### Full OAuth Flow Testing
+
+If you want to test the full OAuth flow:
+
+1. Register a client:
+   ```bash
+   basic-memory auth register-client
+   ```
+   Copy the returned `client_id` and `client_secret`.
+
+2. Follow the OAuth flow described below with the correct callback URL (`http://localhost:8000/auth/callback`).
+
 ## Testing with cURL
 
 1. **Get authorization code**:
    ```bash
-   curl "http://localhost:8000/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=http://localhost:3000/callback&response_type=code&code_challenge=test"
+   curl "http://localhost:8000/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=http://localhost:8000/auth/callback&response_type=code&code_challenge=test"
    ```
 
 2. **Exchange for token**:
@@ -99,7 +168,7 @@ async def test_oauth():
             "http://localhost:8000/authorize",
             params={
                 "client_id": client_id,
-                "redirect_uri": "http://localhost:3000/callback",
+                "redirect_uri": "http://localhost:8000/auth/callback",
                 "response_type": "code",
                 "code_challenge": "test-challenge",
                 "code_challenge_method": "S256",

src/basic_memory/cli/commands/auth.py

@@ -22,10 +22,13 @@ def register_client(
     # Create provider instance
     provider = BasicMemoryOAuthProvider(issuer_url=issuer_url)
 
-    # Create client info
+    # Create client info with required redirect_uris
     client_info = OAuthClientInformationFull(
         client_id=client_id,
         client_secret=client_secret,
+        redirect_uris=["http://localhost:8000/auth/callback"],  # Default redirect URI
+        client_name="Basic Memory OAuth Client",
+        grant_types=["authorization_code", "refresh_token"],
     )
 
     # Register the client
@@ -57,6 +60,9 @@ async def test_flow():
         client_info = OAuthClientInformationFull(
             client_id=secrets.token_urlsafe(16),
             client_secret=secrets.token_urlsafe(32),
+            redirect_uris=["http://localhost:8000/auth/callback"],
+            client_name="Test OAuth Client",
+            grant_types=["authorization_code", "refresh_token"],
         )
         await provider.register_client(client_info)
         typer.echo(f"Registered test client: {client_info.client_id}")
@@ -72,7 +78,7 @@ async def test_flow():
             state="test-state",
             scopes=["read", "write"],
             code_challenge="test-challenge",
-            redirect_uri=AnyHttpUrl("http://localhost:3000/callback"),
+            redirect_uri=AnyHttpUrl("http://localhost:8000/auth/callback"),
             redirect_uri_provided_explicitly=True,
         )
 
@@ -98,8 +104,8 @@ async def test_flow():
 
         # Exchange for tokens
         token = await provider.exchange_authorization_code(client, code_obj)
-        typer.echo(f"Access token: {token.access_token[:20]}...")
-        typer.echo(f"Refresh token: {token.refresh_token[:20]}...")
+        typer.echo(f"Access token: {token.access_token}")
+        typer.echo(f"Refresh token: {token.refresh_token}")
         typer.echo(f"Expires in: {token.expires_in} seconds")
 
         # Validate access token  

src/basic_memory/mcp/auth_provider.py

@@ -1,7 +1,6 @@
 """OAuth authentication provider for Basic Memory MCP server."""
 
 import secrets
-from dataclasses import dataclass
 from datetime import datetime, timedelta
 from typing import Dict, Optional, Any
 
@@ -21,19 +20,16 @@
 from loguru import logger
 
 
-@dataclass
 class BasicMemoryAuthorizationCode(AuthorizationCode):
     """Extended authorization code with additional metadata."""
     issuer_state: Optional[str] = None
 
 
-@dataclass  
 class BasicMemoryRefreshToken(RefreshToken):
     """Extended refresh token with additional metadata."""
     pass
 
 
-@dataclass
 class BasicMemoryAccessToken(AccessToken):
     """Extended access token with additional metadata."""
     pass