# Catalyst::Plugin::OAuth2::ResourceServer

An MCP-profile OAuth 2.1 Resource Server for Catalyst: HS256 bearer-JWT
verification (signature, `aud`, `exp`, `iss`), an app subject-resolver hook for
per-request re-validation, scope assertion, and RFC 6750 challenges + an
RFC 9728 protected-resource metadata document. Verification config is
app-supplied; the distribution carries no application specifics.

Pairs with `Catalyst::Plugin::OAuth2::AuthorizationServer` (it mints, this
verifies) via a shared signing key. See the module POD for configuration and
the hook contract.

## Author

Mike Whitaker <mike@altrion.org>

Built with tool assistance from Claude Code/(mostly) Opus 4.8 to accelerate
code generation and maximise test coverage (and reduce typing :D).

With thanks to

- Jesse Vincent for `/superpowers` (<https://github.com/obra/superpowers>) and the
  `AGENTS.md` boilerplate
- Curtis "Ovid" Poe for `/paad` (<https://github.com/Ovid/paad>)

for providing an agentic development framework that keeps code authority
firmly where it belongs.

Iteratively reviewed by Finn Kempers <finn@shadow.cat> with analysis from
ZCode/GLM-5.2.

## License

This library is free software; you can redistribute it and/or modify it
under the terms of the Artistic License, as distributed with Perl.