refactor(auth): remove non-essential comments from SEP-2352 binding

Author: alexhancock

crates/rmcp/src/transport/auth.rs

@@ -68,8 +68,6 @@ pub struct StoredCredentials {
     pub granted_scopes: Vec<String>,
     #[serde(default)]
     pub token_received_at: Option<u64>,
-    /// Authorization server `issuer` these credentials are bound to (SEP-2352).
-    /// `None` for legacy credentials that predate issuer tracking.
     #[serde(default)]
     pub issuer: Option<String>,
 }
@@ -90,8 +88,7 @@ impl std::fmt::Debug for StoredCredentials {
 }
 
 impl StoredCredentials {
-    /// Create a new `StoredCredentials` instance, unbound to any authorization
-    /// server. Use [`StoredCredentials::with_issuer`] to record the issuer.
+    /// Create a new `StoredCredentials` instance.
     pub fn new(
         client_id: String,
         token_response: Option<OAuthTokenResponse>,
@@ -107,7 +104,6 @@ impl StoredCredentials {
         }
     }
 
-    /// Bind these credentials to the given authorization server `issuer` (SEP-2352).
     pub fn with_issuer(mut self, issuer: impl Into<String>) -> Self {
         self.issuer = Some(issuer.into());
         self
@@ -1244,14 +1240,10 @@ impl AuthorizationManager {
     /// to avoid races between token retrieval and the actual HTTP request.
     const REFRESH_BUFFER_SECS: u64 = 30;
 
-    /// The `issuer` of the authorization server this manager is currently
-    /// configured against, per the discovered [`AuthorizationMetadata`].
     fn current_issuer(&self) -> Option<&str> {
         self.metadata.as_ref().and_then(|m| m.issuer.as_deref())
     }
 
-    /// Build [`StoredCredentials`] stamped with the currently-configured
-    /// authorization server `issuer` (SEP-2352).
     fn stored_credentials(
         &self,
         client_id: String,
@@ -1267,12 +1259,6 @@ impl AuthorizationManager {
         }
     }
 
-    /// Enforce SEP-2352 authorization-server binding: reject a token when its
-    /// stored issuer differs from the currently-configured issuer. Credentials
-    /// with no recorded issuer (legacy) or an unset active issuer pass through.
-    ///
-    /// CIMD client_ids (HTTPS URLs) are portable across authorization servers,
-    /// so they are exempt from the binding check.
     fn check_issuer_binding(&self, stored: &StoredCredentials) -> Result<(), AuthError> {
         if is_https_url(&stored.client_id) {
             return Ok(());
@@ -1301,9 +1287,6 @@ impl AuthorizationManager {
             return Err(AuthError::AuthorizationRequired);
         };
 
-        // SEP-2352: on an AS mismatch, drop the stale credentials so the next
-        // authorization flow re-registers with the new AS rather than reusing
-        // credentials that are invalid there.
         if let Err(e) = self.check_issuer_binding(&stored_creds) {
             self.credential_store.clear().await?;
             return Err(e);
@@ -2376,8 +2359,6 @@ impl OAuthState {
 
             *manager.current_scopes.write().await = granted_scopes.clone();
 
-            // Discover metadata before persisting so credentials are bound to
-            // the resolved issuer (SEP-2352).
             let metadata = manager.discover_metadata().await?;
             manager.metadata = Some(metadata);
 
@@ -4114,8 +4095,6 @@ mod tests {
         );
     }
 
-    // -- SEP-2352: authorization server binding --
-
     fn metadata_with_issuer(issuer: &str) -> AuthorizationMetadata {
         AuthorizationMetadata {
             authorization_endpoint: format!("{issuer}/authorize"),
@@ -4151,8 +4130,6 @@ mod tests {
 
     #[tokio::test]
     async fn get_access_token_clears_stale_credentials_on_mismatch() {
-        // On an AS mismatch the stale credentials are dropped so the next
-        // authorization flow re-registers with the new AS.
         let manager =
             manager_with_metadata(Some(metadata_with_issuer("https://as-b.example.com"))).await;
 
@@ -4171,8 +4148,6 @@ mod tests {
 
     #[tokio::test]
     async fn get_access_token_allows_portable_cimd_client_id_across_servers() {
-        // CIMD client_ids (HTTPS URLs) are portable, so a differing issuer
-        // must not trigger a mismatch.
         let manager =
             manager_with_metadata(Some(metadata_with_issuer("https://as-b.example.com"))).await;