---
title: "mova-serve-oauth — Mova code model"
description: "Mova code model of tools/mova-serve/src/oauth.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/oauth.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Parse](https://mova.elamur.ai/free/en/parse/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Translate](https://md.translate.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · [MCP](https://mcp.elamur.ai/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/oauth.rs.groupant/>

# mova-serve-oauth

The groupant beside tools/mova-serve/src/oauth.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/mova-serve/src/oauth.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/mova-serve/src/oauth.rs)
- **repository folder:** [`tools/mova-serve/src/oauth.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/mova-serve/src/oauth.rs.groupant)

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **Approximant** | partial | [Approximant](#approximant) |
| **Ast** | partial | `syntax.json` |
| **Cost** | symbolic source derived | [Cost](#cost) |
| **Descriptant** | present | [Descriptant](#descriptant) |
| **Invariant** | partial | [Invariant](#invariant) |
| **Tests** | executed bounded checks | [Tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | [Behavior complement](#behavior-complement) |
| Reverse reconstruction | reverse reconstruction | partial source derived model | [Reverse reconstruction](#reverse-reconstruction) |
| Model presence | model presence | partial source derived model | [Model presence](#model-presence) |

## Model text


### Descriptant

OAuth 2.1 authorization server state for MCP connectors: public clients registered dynamically, authorization codes with PKCE S256, resource-bound access tokens (1 h) and rotating refresh tokens (30 days) stored as hashes, grants per account and client, reuse detection, revocation, metadata documents.

### Approximant

`register -> client`; `issue_code -> code`; `exchange_code(code, client, redirect, verifier) -> tokens` iff `S256(verifier) = challenge`; `refresh` uses the old token up; `authenticate(access) -> sub` iff alive and the audience is ours.

### Invariant

No token or code is stored in clear; a code and a refresh token work once and a replay revokes the grant; an access token is valid at this resource only; redirect URIs are https or loopback http and compared whole (loopback: any port); secrets are compared in constant time.

### Cost

See the registry entry; lookups by token hash are O(log n).

### Behavior complement

No client secrets, no plain PKCE, no implicit or password grant, no scopes beyond mcp, no introspection, no client ID metadata documents.

### Reverse reconstruction

A token hash identifies its grant, the grant the account, client and accepted terms; a used code or refresh token identifies a replay.

### Model presence

Without a state directory the store lives in memory.

### Tests

`oauth::tests`: redirect URI rules with negative controls, registration limits and the rate limit, PKCE/client/redirect/resource/expiry controls and code reuse, token expiry and audience, refresh rotation and replay revocation, revocation and disconnect, restart with hashes only, metadata documents.

## Provenance

- **source SHA-256:** `aa3d1b77f1ea5049…`
- **repository commit:** `e490f327bb66`