TurboMCP v1.1.0: RFC 9449 DPoP Security & Type-State Builders

use turbomcp_dpop::prelude::*;
use turbomcp::prelude::*;

#[derive(Clone)]
struct SecureAPIServer {
    dpop_store: Arc<RwLock<DpopTokenStore>>,
}

#[server(
    name = "secure-api-server",
    version = "1.0.0",
    description = "API server with RFC 9449 DPoP security"
)]
impl SecureAPIServer {
    #[tool("Access protected resource with DPoP")]
    async fn protected_operation(
        &self,
        ctx: Context,
        resource_url: String
    ) -> McpResult<String> {
        // Generate DPoP proof for the resource
        let dpop_proof = dpop_token!(
            ctx,
            &resource_url,
            "GET",
            Some("additional-claims")
        ).await?;

        ctx_info!(ctx, "DPoP proof generated for: {}", resource_url);

        Ok(format!("Secure access granted with DPoP proof: {}", dpop_proof))
    }

    #[tool("Configure DPoP security level")]
    async fn configure_security(
        &self,
        level: SecurityLevel
    ) -> McpResult<String> {
        match level {
            SecurityLevel::Memory => Ok("Using in-memory token store".to_string()),
            SecurityLevel::Redis => Ok("Using Redis distributed store".to_string()),
            SecurityLevel::HSM => Ok("Using Hardware Security Module".to_string()),
        }
    }
}

use turbomcp::builders::*;

// Compile-time safe capability configuration
let capabilities = CapabilityBuilder::new()
    .with_tools(true)
    .with_resources(true)
    .with_prompts(true)
    .with_simd_optimization_hints()
    .enterprise_security_mode()
    .build_const(); // ← Zero runtime overhead!

// Impossible configurations are prevented at compile time
// This won't compile - you can't have sampling without tools:
// let invalid = CapabilityBuilder::new()
//     .with_sampling(true)  // ← Compiler error!
//     .build_const();

// Pre-configured patterns for common use cases
let full_featured = CapabilityBuilder::full_featured()
    .with_hsm_integration()
    .build_const();

let minimal = CapabilityBuilder::minimal()
    .with_stdio_only()
    .build_const();

let sampling_focused = CapabilityBuilder::sampling_focused()
    .with_enterprise_llm_providers()
    .build_const();

[dependencies]
turbomcp = "1.1"

# Or with specific features for DPoP security
turbomcp = { version = "1.1", features = ["dpop", "hsm"] }

# For type-state builders
turbomcp = { version = "1.1", features = ["type-state-builders"] }

use turbomcp::prelude::*;
use turbomcp_dpop::prelude::*;

#[derive(Clone)]
struct SecureServer;

#[server(
    name = "secure-server",
    version = "1.0.0",
    description = "Server with DPoP security"
)]
impl SecureServer {
    #[dpop_secured]
    #[tool("Secure operation")]
    async fn secure_operation(&self, ctx: Context) -> McpResult<String> {
        ctx_info!(ctx, "Executing secure operation with DPoP proof");
        Ok("Operation completed securely".to_string())
    }
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let server = SecureServer;
    server.run_stdio().await?;
    Ok(())
}