# OAuth 2 connection between Liferay and the Liferay Legacy MCP server.
#
# Liferay creates an OAuth 2 application from this definition and publishes its client ID,
# client secret and token address as routes (files) for the MCP server to read.
#
# The application acts as the service user named in userAccountScreenName, which needs the
# "MCP OAuth Client" role to be issued tokens. The scopes limit it to the APIs the tools call.
#
# Whether the server can write is decided here, and Liferay enforces it. This file allows writes;
# liferay-mcp-oauth-read-only.client-extension.yaml is the read-only version. To make this one
# read-only, change all six write scopes to their .read versions:
#   Liferay.Headless.Delivery.everything          web content, documents, blogs, knowledge base...
#   Liferay.Headless.Admin.Content.everything     drafts and article status
#   Liferay.Headless.Admin.Taxonomy.everything    tags and categories
#   Liferay.Headless.Admin.Workflow.everything    review tasks
#   Liferay.Headless.Batch.Engine.everything      exports and batches
#   Liferay.Headless.Form.everything              forms
# With Delivery read-only, the MCP server also reports its write tools as unavailable.
# Even with write scopes, the server writes only once MCP_WRITE_MODE=confirm is set.
#
# .serviceAddress and .serviceScheme give the application its home page, the MCP server's own
# address; Liferay requires one. They don't affect how the server connects.
#
# After changing it, deploy it again and restart the MCP server.
assemble: []
liferay-mcp-oauth-headless-server:
  name: Liferay MCP server
  description: OAuth 2 connection for the Liferay MCP server
  scopes:
    - Liferay.Data.Engine.REST.everything.read
    - Liferay.Headless.Admin.Content.everything
    - Liferay.Headless.Admin.Taxonomy.everything
    - Liferay.Headless.Admin.User.everything.read
    - Liferay.Headless.Admin.Workflow.everything
    - Liferay.Headless.Batch.Engine.everything
    - Liferay.Headless.Delivery.everything
    - Liferay.Headless.Form.everything
    - liferay-json-web-services.everything.read
  .serviceAddress: localhost:3333
  .serviceScheme: http
  type: oAuthApplicationHeadlessServer
  userAccountScreenName: mcp-service