Adding RPST bootstrap method to the common auth module

AGENTS.md

@@ -50,7 +50,7 @@ When validating the quality of any MCP server under `src/`:
 - Confirm the server includes unit tests for the MCP server code.
 - For Python MCP servers, require unit tests to enforce at least 90% coverage through `[tool.coverage.report] fail_under = 90` in `pyproject.toml`. Do not mark validation complete if the coverage threshold is lower than 90% or if coverage fails.
 - For OCI Python SDK-backed servers, require every OCI client-configuration path to derive the canonical `<user_agent_name>/<version>` `additional_user_agent` from package `__project__` and `__version__`; do not duplicate literal names or versions. Client factories may live outside `server.py`, but every path that constructs an OCI client must receive the value. Strip `-server` off the end of `__project__` when applicable; ex `oci-cloud-mcp`.
-- For OCI Python SDK-backed servers, declare `oracle-mcp-common>=0.1.0,<0.2.0` and use `oracle_mcp_common.build_auth_context()` for stdio and other configured OCI credential modes instead of duplicating credential resolution, OCI profile parsing, environment-variable precedence, or signer construction. Merge the returned `AuthContext.config` with the derived `additional_user_agent`, pass `AuthContext.signer` to each OCI client, and keep the server responsible for its client type, retry and circuit-breaker policy, and lifecycle. Use `AuthOptions` only when a server must explicitly override configured authentication inputs.
+- For OCI Python SDK-backed servers, declare `oracle-mcp-common>=0.2.0,<0.3.0` and use `oracle_mcp_common.build_auth_context()` for stdio and other configured OCI credential modes instead of duplicating credential resolution, OCI profile parsing, environment-variable precedence, or signer construction. Merge the returned `AuthContext.config` with the derived `additional_user_agent`, pass `AuthContext.signer` to each OCI client, and keep the server responsible for its client type, retry and circuit-breaker policy, and lifecycle. Use `AuthOptions` only when a server must explicitly override configured authentication inputs.
 - For an HTTP server that uses OCI IAM/IDCS request-token exchange, use `build_idcs_http_auth(required_scopes)` once for provider configuration; the server retains listener startup, `mcp.auth` assignment, request-token retrieval, and user-agent assignment. During each authenticated request, call `IDCSHttpAuth.context_for(access_token.token)` and create only caller-specific OCI SDK clients from that context. Do not inspect host/port to select credentials, call FastMCP request-context APIs from the common library, or cache an HTTP-derived signer/client globally across callers.
 - For OCI Python SDK-backed servers, require unit tests to assert the exact derived `additional_user_agent` for each supported client-construction authentication path: API-key, security-token, each supported principal-based path (for example, instance- and resource-principal), and HTTP/token-exchange.
 - For servers that invoke the OCI CLI instead of constructing OCI Python SDK clients, require the same derived value through `OCI_SDK_APPEND_USER_AGENT` in the launched process environment.

BEST_PRACTICES.md

@@ -127,7 +127,7 @@ Declare a bounded dependency compatible with the shared library's public API:
 
 ```toml
 dependencies = [
-    "oracle-mcp-common>=0.1.0,<0.2.0",
+    "oracle-mcp-common>=0.2.0,<0.3.0",
 ]
 ```
 

src/common/CHANGELOG.md

@@ -9,6 +9,12 @@ All notable changes to `oracle-mcp-common` are documented in this file.
 - Runtime package metadata now reads the installed distribution version, with
   `pyproject.toml` as the single source of truth.
 
+## 0.2.0
+
+### Added
+
+- Added RPv2.1.2 authentication with refreshed time-bound security contexts and realm-aware bootstrap endpoints.
+
 ## 0.1.3
 
 ### Changed

src/common/README.md

@@ -18,7 +18,7 @@ An adopting server normally declares a bounded dependency on this package:
 
 ```toml
 dependencies = [
-  "oracle-mcp-common>=0.1.0,<0.2.0",
+  "oracle-mcp-common>=0.2.0,<0.3.0",
 ]
 ```
 
@@ -74,6 +74,7 @@ Set `OCI_MCP_AUTH_TYPE`, or pass `AuthOptions(auth_type=...)` to
 | `identity_domain_upst` | Identity Domains JWT-to-UPST token exchange | Uses file-backed JWT and client-secret inputs. See [Identity Domains token exchange](#identity-domains-token-exchange). |
 | `instance_principal` | OCI instance principal | Intended for OCI compute instances. |
 | `resource_principal` | OCI resource principal | Intended for supported OCI managed-resource environments. |
+| `resource_principal_v212` | Database-service resource-principal exchange | Builds the v2.1.2 RPT security context and uses the OCI SDK's refreshing RPST exchange signer. See [Database-service RPv2.1.2 exchange](#database-service-rpv212-exchange). |
 | `instance_principal_delegation` | Instance principal and delegation token | Requires a delegation-token file. |
 | `resource_principal_delegation` | Resource principal and delegation token | Requires a delegation-token file. |
 | `oke_workload_identity` | OKE workload identity | Uses the OCI SDK's default service-account token unless an override is supplied. |
@@ -82,6 +83,25 @@ Set `OCI_MCP_AUTH_TYPE`, or pass `AuthOptions(auth_type=...)` to
 principal environments. Select those types explicitly so a deployment's OCI
 identity remains predictable.
 
+### Database-service RPv2.1.2 exchange
+
+`resource_principal_v212` supports the Resource Principal Session token bootstrap flow.
+It requires a region and these file-safe configuration values:
+
+| Setting | `AuthOptions` field | Environment variable |
+| --- | --- | --- |
+| Tenancy OCID | `resource_principal_tenancy_id` | `OCI_MCP_RP_TENANCY_ID` |
+| Resource OCID | `resource_principal_resource_id` | `OCI_MCP_RP_RESOURCE_ID` |
+| Resource private-key file | `resource_principal_private_key_path` | `OCI_MCP_RP_PRIVATE_KEY_PATH` |
+| Resource context HMAC key (sensitive) | `resource_principal_rci` | `OCI_MCP_RP_RCI` |
+| Context base time | `resource_principal_t0` | `OCI_MCP_RP_T0` |
+
+RCI is sensitive HMAC key material: do not log it or place it in source control.
+The RPT and RPST endpoints are resolved by the OCI SDK as realm-aware `database`
+and `auth` endpoints (for example, the displayed domain is `.oraclecloud.com` in
+OC1); override them only with
+`OCI_MCP_RP_RPT_ENDPOINT` and `OCI_MCP_RP_RPST_ENDPOINT` when required.
+
 ### Configuration precedence
 
 An explicit non-empty `AuthOptions` value wins over its canonical environment