# `AttestoMCP.Server.Phoenix`
[🔗](https://github.com/XukuLLC/attesto_mcp_server/blob/v2.8.0/lib/attesto_mcp_server/phoenix.ex#L1)

Narrow integration helpers for Phoenix hosts.

`attesto_mcp_server` remains the protected resource and does not mount or
configure an authorization server. When a host already uses
`attesto_phoenix`, `attesto_config/1` derives the core `Attesto.Config` from
that package's validated application configuration, while
`protected_resource_options/1` also derives its runtime DPoP and mTLS
callbacks, access-token revocation check, and principal loader;
`protected_resource_options/2` can compose a post-load principal callback
without replacing those checks. These helpers introduce no hard dependency
in this package.

# `principal_wrapper`

```elixir
@type principal_wrapper() ::
  (term(), map(), term() -> {:ok, term()} | {:error, term()})
  | {module(), atom()}
  | {module(), atom(), [term()]}
```

A post-load callback that may transform or reject the AttestoPhoenix principal.

# `protected_resource_option`

```elixir
@type protected_resource_option() :: {:principal, principal_wrapper()}
```

Options for composing the automatic protected-resource principal path.

# `attesto_config`

```elixir
@spec attesto_config(atom()) :: term()
```

Derives an Attesto verifier configuration from an installed
`attesto_phoenix` host.

The host must configure `AttestoPhoenix.Config` under `otp_app`. This helper
fails closed when the optional package or its supported configuration API is
unavailable.

# `protected_resource_options`

```elixir
@spec protected_resource_options(atom()) :: keyword()
```

Derives the complete protected-resource authentication options from an
installed `attesto_phoenix` host.

The returned keyword contains the core `Attesto.Config` plus the runtime
DPoP replay, nonce, canonical-URL, and mTLS certificate callbacks enabled by
the host's validated `AttestoPhoenix.Config`. Its principal callback checks
the access-token `jti` through the host's revocation store before resolving
the verified subject through `load_principal`. Resolve it at request time:
the adapter callbacks close over the current validated configuration and
must not be baked into a compiled Phoenix router.

`attesto_phoenix` 3.x and 4.x bind each callback to the named profile loaded from
the `otp_app` argument, so multiple named host profiles remain isolated.
This helper does not select a profile from `conn.private`. The 2.14
compatibility path supports one globally configured profile; using it for
multiple profiles can route persistent replay or revocation reads through
that global profile's store. Use `attesto_phoenix` 3.x or 4.x when serving more than
one named profile.

This helper fails closed when the optional package or its supported public
configuration/adapter API is unavailable.

# `protected_resource_options`

```elixir
@spec protected_resource_options(atom(), [protected_resource_option()]) :: keyword()
```

Derives protected-resource options and composes a post-load principal callback.

The optional `:principal` callback receives the loaded principal, verified
claims, and sender information, in that order. It must return
`{:ok, principal}` with a non-nil final principal or `{:error, reason}`. The
automatic JTI revocation check and AttestoPhoenix `load_principal` callback
always run first and cannot be replaced by this option.

---

*Consult [api-reference.md](api-reference.md) for complete listing*