status, README

Author: simonredfern

README.md

@@ -188,6 +188,9 @@ OBP_OIDC_ISSUER_URL=http://localhost:9000/obp-oidc
 OBP_AUTHORIZATION_VIA="consent"
 OBP_OPEY_CONSUMER_KEY=<opey's consumer key (same as the OBP_CONSUMER_KEY in Opey)>
 ```
+
+> [!IMPORTANT] `OBP_AUTHORIZATION_VIA` must be set to `oauth` or `consent`. Any other value (including unset) causes the server to refuse to start — unauthenticated OBP-API access is not supported.
+
 > [!NOTE] You will not be able to use the MCP server, set up in this way, with any other MCP clients, unless they are capable of creating valid consents on the fly.
 
 In Opey's `mcp_servers.json` (inside the servers array):

src/mcp_server_obp/lifespan.py

@@ -8,6 +8,25 @@
 
 logger = logging.getLogger(__name__)
 
+_VALID_OUTBOUND_AUTH = {"oauth", "consent"}
+
+
+def _validate_outbound_auth() -> None:
+    """Fail loudly at startup if OBP_AUTHORIZATION_VIA isn't oauth or consent.
+
+    The previous 'none' mode let call_obp_api fire unauthenticated requests
+    against OBP-API, which severed the link between a chat session and an
+    identified OBP user. Requiring an explicit mode here makes that
+    impossible by construction.
+    """
+    value = os.getenv("OBP_AUTHORIZATION_VIA", "").lower()
+    if value not in _VALID_OUTBOUND_AUTH:
+        raise RuntimeError(
+            f"OBP_AUTHORIZATION_VIA must be one of {sorted(_VALID_OUTBOUND_AUTH)}; "
+            f"got {value!r}. Refusing to start — unauthenticated OBP-API access is "
+            "no longer supported."
+        )
+
 
 def print_client_configs():
     """Print copy-pasteable MCP client configuration snippets."""
@@ -90,6 +109,7 @@ async def lifespan(server) -> AsyncIterator[dict[str, Any]]:
     """
     # Startup actions
     logger.info("Starting MCP server...")
+    _validate_outbound_auth()
     print_client_configs()
 
     # Check and update index on startup

src/mcp_server_obp/server.py

@@ -276,7 +276,7 @@ async def call_obp_api(
         method = endpoint.method  # HttpMethod enum value
         request_headers = headers or {}
 
-        auth_method = os.getenv("OBP_AUTHORIZATION_VIA", "none").lower()
+        auth_method = os.getenv("OBP_AUTHORIZATION_VIA", "").lower()
         match auth_method:
             case "oauth":
                 logger.info("Using OAuth authorization method for OBP API call")
@@ -308,13 +308,26 @@ async def call_obp_api(
                                 if body_role not in required_roles:
                                     required_roles.append(body_role)
 
-                    # If the endpoint requires no roles at all, treat it as public and skip
-                    # the consent prompt. OBP will reject the call if it actually needs auth,
-                    # which is a better UX than a meaningless "grant consent" dialog for e.g.
-                    # GET /root.
-                    if not required_roles:
+                    # Detect endpoints that need consent even without explicit role
+                    # requirements:
+                    #   * account/view-scoped: path contains ACCOUNT_ID or VIEW_ID — gated by
+                    #     account-access-to-a-view in OBP.
+                    #   * user-scoped: path contains the `/my/` segment — identity-bound, the
+                    #     response depends on which user is calling so we still need a
+                    #     Consent-JWT for the user.
+                    path_segments = (endpoint.path or "").split("/")
+                    requires_view_access = "ACCOUNT_ID" in path_segments or "VIEW_ID" in path_segments
+                    is_user_scoped = "my" in path_segments
+                    account_id = (path_params or {}).get("ACCOUNT_ID") or (path_params or {}).get("account_id")
+                    view_id = (path_params or {}).get("VIEW_ID") or (path_params or {}).get("view_id")
+
+                    # Endpoints with no role requirements AND no account/view/user scoping are
+                    # treated as public — skip the consent prompt (e.g. GET /root). OBP will
+                    # reject the call if it actually needs auth, which is a better UX than a
+                    # meaningless "grant consent" dialog.
+                    if not required_roles and not requires_view_access and not is_user_scoped:
                         logger.info(
-                            f"Skipping consent for {endpoint.operation_id}: endpoint has no required roles"
+                            f"Skipping consent for {endpoint.operation_id}: no required roles, not account/view-scoped, not user-scoped"
                         )
                     else:
                         return json.dumps({
@@ -325,6 +338,10 @@ async def call_obp_api(
                             "path": endpoint.path,
                             "required_roles": required_roles,
                             "bank_id": bank_id,
+                            "account_id": account_id,
+                            "view_id": view_id,
+                            "requires_view_access": requires_view_access,
+                            "is_user_scoped": is_user_scoped,
                             "message": f"User consent is required to call {endpoint.operation_id}. "
                                        f"Please approve and provide a Consent-JWT.",
                         }, indent=2)
@@ -337,14 +354,14 @@ async def call_obp_api(
                 else:
                     logger.warning("OBP_OPEY_CONSUMER_KEY is not set in environment variables. Consent-based authorization will fail without it.")
 
-            case "none":
-                # No authorization
-                logger.info("No authorization method used for OBP API call")
-                pass
             case _:
-                logger.error(f"Invalid OBP_AUTHORIZATION_VIA value: {auth_method}")
+                logger.error(
+                    f"Invalid OBP_AUTHORIZATION_VIA value: {auth_method!r}. "
+                    "Must be 'oauth' or 'consent'."
+                )
                 return json.dumps({
-                    "error": f"Internal server error."
+                    "error": "OBP-API calls are disabled: OBP_AUTHORIZATION_VIA "
+                             "must be set to 'oauth' or 'consent'."
                 }, indent=2)
 
         # Make the request

src/mcp_server_obp/status.py

@@ -69,6 +69,7 @@ async def build_status() -> dict[str, Any]:
     obp_api_version = os.getenv("OBP_API_VERSION", "")
     auth_enabled = os.getenv("ENABLE_OAUTH", "false").lower() == "true"
     auth_provider = os.getenv("AUTH_PROVIDER", "none") if auth_enabled else "none"
+    outbound_auth_via = os.getenv("OBP_AUTHORIZATION_VIA", "").lower() or None
 
     issuers: list[dict[str, Any]] = []
     if auth_enabled:
@@ -130,6 +131,7 @@ async def build_status() -> dict[str, Any]:
         "auth": {
             "enabled": auth_enabled,
             "provider": auth_provider,
+            "outbound_auth_via": outbound_auth_via,
             "issuers": issuers,
         },
         "index": {
@@ -269,8 +271,9 @@ def row(label: str, value: Any) -> str:
   <section>
     <h2>Authentication</h2>
     <table>
-      {row("OAuth enabled", auth.get("enabled"))}
-      {row("Provider", auth.get("provider"))}
+      {row("OAuth enabled (inbound)", auth.get("enabled"))}
+      {row("Inbound provider", auth.get("provider"))}
+      {row("Outbound to OBP-API (OBP_AUTHORIZATION_VIA)", auth.get("outbound_auth_via"))}
     </table>
     {issuer_sections}
   </section>