---
title: "mova-serve-oauth-http — Mova code model"
description: "Mova code model of tools/mova-serve/src/oauth_http.rs: components with their labels, obernants and the model text."
url: "https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/oauth_http.rs.groupant/"
---
Elamur: [Mova](https://md.mova.elamur.ai/free/en/) · [Parse](https://mova.elamur.ai/free/en/parse/) · [Dictionary](https://md.dictionary.elamur.ai/free/en/) · [Translate](https://md.translate.elamur.ai/free/en/) · [Research](https://md.research.elamur.ai/free/en/) · [MCP](https://mcp.elamur.ai/) · **Groupants**

This page as HTML: <https://groupants.elamur.ai/free/en/mova/tools/mova-serve/src/oauth_http.rs.groupant/>

# mova-serve-oauth-http

The groupant beside tools/mova-serve/src/oauth_http.rs in the Mova repository: what the code computes, what it never does, how to go back from its outputs, its invariants, cost and checks.

## Facts

- **kind:** groupant
- **status:** partial source bound model
- **source:** [`tools/mova-serve/src/oauth_http.rs`](https://github.com/ElamurAI/mova-free/blob/main/tools/mova-serve/src/oauth_http.rs)
- **repository folder:** [`tools/mova-serve/src/oauth_http.rs.groupant`](https://github.com/ElamurAI/mova-free/tree/main/tools/mova-serve/src/oauth_http.rs.groupant)

> **Implementation material.** A Mova code model describes this code at one source revision: partial models, finite checks and their stated scope. It is not a reviewed general exposition, and its labels are shown as written, never raised.

## Components

| component | label | where |
|---|---|---|
| **Approximant** | partial | [Approximant](#approximant) |
| **Ast** | partial | `syntax.json` |
| **Cost** | symbolic source derived | [Cost](#cost) |
| **Descriptant** | present | [Descriptant](#descriptant) |
| **Invariant** | partial | [Invariant](#invariant) |
| **Tests** | executed bounded checks | [Tests](#tests) |

## Obernants

The typed relations around the forward model: the behaviour complement (what the code never does), the reverse reconstruction (every input compatible with an output) and specialised views.

| relation | type | label | where |
|---|---|---|---|
| Behavior complement | behavior complement | partial source derived model | [Behavior complement](#behavior-complement) |
| Reverse reconstruction | reverse reconstruction | partial source derived model | [Reverse reconstruction](#reverse-reconstruction) |
| Model presence | model presence | partial source derived model | [Model presence](#model-presence) |

## Model text


### Descriptant

The routes of the authorization server (cabinet host) and the resource server (MCP host): metadata, registration, authorize, consent, token, revoke, disconnect, the bearer challenge, the /account endpoint.

### Approximant

`authorize -> consent?rq` iff client and redirect URI are registered; `consent(allow, csrf, terms) -> redirect(code, state, iss)`; `token -> JSON`; `bearer -> account` on the MCP host only.

### Invariant

An unregistered redirect URI is never redirected to; the consent form needs a session, an HMAC CSRF token, our origin and the terms box, and refuses framing; the root MCP endpoint never asks for credentials and answers 401 with resource_metadata only to an invalid token; /account answers 401 with the challenge to no credentials.

### Cost

See the registry entry; lookups by token hash are O(log n).

### Behavior complement

Never logs a token or code; never accepts an access token on the API host; no tokens in URLs except the code in the redirect.

### Reverse reconstruction

The redirect and the cabinet list recover request and grants.

### Model presence

Without Google settings authorization answers 503 and nothing is issued.

### Tests

`oauth_http::tests`: metadata on the right hosts, registration, open-redirect and PKCE controls, consent controls, and the end-to-end flow register, authorize, consent, token, MCP call, refresh, replay, revoke, disconnect, account deletion, terms change; tool annotations, server info, icon.

## Provenance

- **source SHA-256:** `56d2938190c9dddf…`
- **repository commit:** `e490f327bb66`