Add AuthConfig model and AuthConfigReader for OIDC provider configura…

[imranq2]

…tion

Introduces a Pydantic AuthConfig with OAuth 2.1 support (PKCE, Dynamic Client Registration) and a thread-safe AuthConfigReader that lazily loads provider configs from environment variables. Includes register_auth_configs for merging externally-sourced configs (e.g. .mcp.json).

[gecko-security]

Gecko PR Review

Summary

This PR refactors the configuration schema in oidcauthlib/auth/config/auth_config.py and oidcauthlib/auth/config/auth_config_reader.py by renaming the generic extra_info field to app_login and removing environment variable parsing logic for it. The changes shift configuration sourcing from environment variables to external files (e.g., .mcp.json), which reduces the attack surface for credential leakage but requires careful migration of existing deployments and validation of the new app_login structure.

Important Files Changed

2 important files

File Path	Why it matters
oidcauthlib/auth/config/auth_config.py	Field rename from extra_info to app_login changes the configuration contract; all downstream consumers and serialization/deserialization logic must be updated to avoid runtime failures.
oidcauthlib/auth/config/auth_config_reader.py	Removal of JSON parsing for environment variables eliminates the attack vector where malformed JSON in AUTH_EXTRA_INFO_* could trigger exceptions, but callers must now validate app_login structure when loaded from external sources (e.g., .mcp.json).

Sequence Diagram

sequenceDiagram
  participant Reviewer
  participant PR as Changed Files
  Reviewer->>PR: Inspect changed files and control flow
  Reviewer->>Reviewer: Validate security assumptions

Loading

No vulnerabilities found, LGTM.
_{Edit Gecko PR Settings | Reviewed commit: 544339e}

[claude]

Simple field rename and removal of unused env var parsing, with no remaining references elsewhere in the codebase.

Extended reasoning...

Overview

This PR renames the extra_info field on AuthConfig to app_login (with a narrower description) and removes the AUTH_EXTRA_INFO_<PROVIDER> environment-variable JSON parsing in AuthConfigReader.read_config_for_auth_provider. The comment indicates that app_login is now sourced from .mcp.json externally (presumably via register_auth_configs).

Security risks

None of significance. The change actually removes a small attack surface — the JSON-from-env parsing path is gone, which eliminates the ValueError raised on malformed JSON. The new field is still typed as dict[str, Any] | None and defaults to None; no auth-decision logic changed.

Level of scrutiny

Low. This is a small, mechanical rename/removal in a config model. I verified via grep that no other code references extra_info or AUTH_EXTRA_INFO, so there are no stale callers. app_login is only referenced in the two modified files, consistent with the intent that it's populated externally.

Other factors

The PR is small (two files, ~25 lines changed), self-contained, and the diff is easy to read. The accompanying AuthConfig.model_config = ConfigDict(extra="forbid") would catch any forgotten consumer that still tries to pass extra_info.