name: centralized-auth

guards:
  agent_jwt:
    type: jwt
    options:
      issuer: https://auth.example.com
      audience: https://mcp.example.com
      keys:
        - kty: RSA
          kid: example-key
          alg: RS256
          n: s9UPTz1zecQcug_nFPhAw0J8FcyiHFKirFRYJOkYq90pKEm_lgDhf9Acyt5qSh-2vjldpuPR_wEa91K2Nzu-3VhXEFuRZtn_6sCLcSxSEVpSZkZR_u7V3CM-9EX6iGzvLs0CXb4VXVwrxuVf8G5T6dEdzqTqRkArjYEbbQgkZoFbb_NBWc13rP9nJ1suH1_Cghohb-U7usIH08jVbznOhVwTp1I8dcZpvXGHejRSpePq9pus1aJ-LYS9EYTJjC_eMJWARZj1dx51_pAGfPlNS0o9s8KAFMQm-O8QbxPP_X2ekg8umzPrTLdflFdwnpBGxVXNmtbEc5CBlTQr0rKx4Q
          e: AQAB

stores:
  cache:
    type: memory

catalogs:
  api_catalog:
    type: inline
    options:
      subjects:
        billing_params:
          schema: |
            {
              "type": "object",
              "properties": { "id": { "type": "string" } },
              "required": [ "id" ]
            }
        support_params:
          schema: |
            {
              "type": "object",
              "properties": { "id": { "type": "string" } },
              "required": [ "id" ]
            }

bindings:
  north_tcp_server:
    type: tcp
    kind: server
    options:
      host: 0.0.0.0
      port: 7114
    routes:
      - when:
          - port: 7114
        exit: north_http_server

  north_http_server:
    type: http
    kind: server
    options:
      access-control:
        policy: cross-origin
    routes:
      - when:
          - headers:
              ":path": /mcp
        exit: north_mcp_server

  #region authorization
  north_mcp_server:
    type: mcp
    kind: server
    options:
      authorization:
        agent_jwt:
          credentials: "Bearer {credentials}"
    exit: north_mcp_proxy
  #endregion authorization

  north_mcp_proxy:
    type: mcp
    kind: proxy
    options:
      cache:
        store: cache
        ttl: PT5M
    routes:
      - exit: billing_http_proxy
        when:
          - toolkit: billing
      - exit: support_http_proxy
        when:
          - toolkit: support

  billing_http_proxy:
    type: mcp-http
    kind: proxy
    options:
      tools:
        get_payment_status:
          description: Look up the status of a payment by identifier.
          summary: "Routed to ${result.url}"
          schemas:
            input:
              model: json
              catalog:
                api_catalog:
                  - subject: billing_params
                    version: latest
    routes:
      - when:
          - tool: get_payment_status
        exit: sys:http_client
        with:
          headers:
            ":method": GET
            ":scheme": http
            ":authority": api:80
            ":path": /anything/billing/${args.id}

  support_http_proxy:
    type: mcp-http
    kind: proxy
    options:
      tools:
        get_ticket_status:
          description: Look up the status of a support ticket by identifier.
          summary: "Routed to ${result.url}"
          schemas:
            input:
              model: json
              catalog:
                api_catalog:
                  - subject: support_params
                    version: latest
    routes:
      - when:
          - tool: get_ticket_status
        exit: sys:http_client
        with:
          headers:
            ":method": GET
            ":scheme": http
            ":authority": api:80
            ":path": /anything/support/${args.id}