diff --git a/features/cooked-mcp/authentication.feature.yaml b/features/cooked-mcp/authentication.feature.yaml index 7851f7d4f68da56a1867ae2a6601208e5769121d..c4327f89af1046d957f09b74d9f3992ff26bafbf 100644 --- a/features/cooked-mcp/authentication.feature.yaml +++ b/features/cooked-mcp/authentication.feature.yaml @@ -10,26 +10,41 @@ components: 2: The server accepts the Cooked password from COOKED_LOGIN_PASSWORD. 3: The server accepts the Cooked username from TOML user.name. 4: The server accepts the Cooked password from TOML user.password. - 5: The server accepts a command for producing the Cooked username from TOML user.name_cmd. - 6: The server accepts a command for producing the Cooked password from TOML user.password_cmd. + 5: + requirement: The server accepts a command for producing the Cooked username from TOML user.name_cmd. + deprecated: true + 6: + requirement: The server accepts a command for producing the Cooked password from TOML user.password_cmd. + deprecated: true 7: A credential command returns the credential on stdout. 7-1: Trailing newlines are trimmed from credential command stdout. 7-2: Empty credential command output is rejected. - 8: The server rejects ambiguous TOML credential configuration for a single credential field. - 8-1: user.name and user.name_cmd are mutually exclusive. - 8-2: user.password and user.password_cmd are mutually exclusive. + 8: + requirement: The server rejects ambiguous TOML credential configuration for a single credential field. + deprecated: true + 8-1: + requirement: user.name and user.name_cmd are mutually exclusive. + deprecated: true + 8-2: + requirement: user.password and user.password_cmd are mutually exclusive. + deprecated: true 9: The server reports missing username or password configuration before serving. 10: The server obtains Cooked session cookies by logging in with configured username and password credentials. - 11: COOKED_LOGIN_USERNAME takes precedence over TOML user.name and user.name_cmd. - 12: COOKED_LOGIN_PASSWORD takes precedence over TOML user.password and user.password_cmd. + 11: COOKED_LOGIN_USERNAME takes precedence over TOML user.name. + 12: COOKED_LOGIN_PASSWORD takes precedence over TOML user.password. 13: Browser-provided Cooked session cookies are not supported in this version. 14: Social-login and passwordless Cooked accounts are not supported in this version. - 15: Credential command fields are TOML strings executed as shell commands. - 16: Credential commands must exit successfully within 5 seconds. - 17: Credential command stdout read by the server is capped at 64 KiB. + 15: Credential command config values are TOML strings beginning with !. + 16: Credential command config values must exit successfully within 10 seconds. + 17: Credential command config value stdout read by the server is bounded. 18: Credential command stdout is trimmed of leading and trailing ASCII whitespace before use. 19: Credential command stderr is not included in logs or user-facing errors. 20: Non-zero credential command exits are reported as credential resolution failures without command output. + 21: TOML user.name uses config-values.RESOLUTION.1. + 22: TOML user.password uses config-values.RESOLUTION.1. + 23: TOML user.name may reference any existing environment variable through config value syntax. + 24: TOML user.password may reference any existing environment variable through config value syntax. + 25: Separate TOML user.name_cmd and user.password_cmd fields are not supported in this version. LOGIN: requirements: 1: The server logs in to Cooked with the configured username and password when an authenticated request needs a session. diff --git a/features/cooked-mcp/config-values.feature.yaml b/features/cooked-mcp/config-values.feature.yaml new file mode 100644 index 0000000000000000000000000000000000000000..afab353ac94c487312f949c784727b81b63f95ba --- /dev/null +++ b/features/cooked-mcp/config-values.feature.yaml @@ -0,0 +1,45 @@ +feature: + name: config-values + product: cooked-mcp + description: Resolve TOML configuration strings that may be literals, environment references, or shell commands. + +components: + RESOLUTION: + requirements: + 1: TOML fields documented as config values use Pi-style config value resolution. + 2: Plain config value strings resolve as literal values. + 3: Config value strings beginning with ! execute the remainder as a shell command. + 4: Command config values resolve to trimmed stdout. + 5: Command config values with empty stdout are unresolved. + 6: Config value strings interpolate $ENV_VAR references using existing environment variables. + 7: Config value strings interpolate ${ENV_VAR} references using existing environment variables. + 8: Config value strings treat $$ as a literal dollar sign. + 9: Config value strings treat $! as a literal exclamation mark. + 10: Missing environment variables make the config value unresolved. + 11: Empty environment variables make the config value unresolved. + 12: Required settings reject unresolved config values before serving. + COMMANDS: + requirements: + 1: Command config values execute through the platform shell. + 2: Command config values have a bounded runtime. + 2-1: Command config values time out after 10 seconds. + 3: Command config value results are cached for the process lifetime. + 4: Command config value stderr is discarded. + 5: Command config value stdout is never logged. + 6: Command config value stderr is never logged. + 7: Non-zero command exits make the config value unresolved. + ERRORS: + requirements: + 1: Unresolved command config values are reported without command stdout or stderr. + 2: Unresolved environment references are reported with the missing environment variable names. + 3: Config value errors identify the setting being resolved. + +constraints: + SECRETS: + requirements: + 1: Config value resolution never logs resolved values for secret settings. + 2: Config value resolution never includes resolved secret values in user-facing errors. + VERIFICATION: + requirements: + 1: Config value resolution is verified without invoking real credential managers. + 2: Config value command tests use fake shell commands. diff --git a/features/cooked-mcp/server.feature.yaml b/features/cooked-mcp/server.feature.yaml index f450c562cd985ff5b125f7656faec4041e979ff2..a877cc3adb8f32219f3381d0584f36a4a5f72f3d 100644 --- a/features/cooked-mcp/server.feature.yaml +++ b/features/cooked-mcp/server.feature.yaml @@ -46,13 +46,18 @@ constraints: 2: HTTP authentication secrets are never logged. 3: HTTP transport supports bearer-token authentication. 4: HTTP bearer tokens can be configured through COOKED_MCP_HTTP_TOKEN. - 5: HTTP bearer tokens can be configured through TOML mcp.http_token or mcp.http_token_cmd. + 5: HTTP bearer tokens can be configured through TOML mcp.http_token. 6: HTTP bearer authentication uses the Authorization header with the Bearer scheme. 7: When an HTTP token is configured, every MCP HTTP request must provide the matching bearer token. - 8: TOML mcp.http_token and mcp.http_token_cmd are mutually exclusive. - 9: COOKED_MCP_HTTP_TOKEN takes precedence over TOML mcp.http_token and mcp.http_token_cmd. - 10: TOML mcp.http_token_cmd follows the same command execution, trimming, timeout, and secrecy rules as Cooked credential commands. + 8: + requirement: TOML mcp.http_token and mcp.http_token_cmd are mutually exclusive. + deprecated: true + 9: COOKED_MCP_HTTP_TOKEN takes precedence over TOML mcp.http_token. + 10: TOML mcp.http_token follows the same config value resolution, trimming, timeout, and secrecy rules as Cooked credential settings. 11: Empty HTTP bearer tokens are rejected before serving. + 12: TOML mcp.http_token uses config-values.RESOLUTION.1. + 13: TOML mcp.http_token may reference any existing environment variable through config value syntax. + 14: Separate TOML mcp.http_token_cmd is not supported in this version. COMPATIBILITY: requirements: 1: The server does not require MCP resource support from clients.