feat: Phase 2 — OAuth2 refresh, SMTP transport, persistent MCP state

[CodeWithJuber]

Summary

Phase 2 of the Rust rebuild adds the execution layer that turns the Phase 1 scaffold into a working actuator: OAuth2 token refresh, SMTP email transport, path parameter substitution, persistent MCP server state, and full auth-type wiring across all 7 credential patterns.

What changed:

• OAuth2 / password-grant token refresh (hub-auth): Async resolve() method handles Bearer, Basic, Header, Custom, OAuth2, PasswordGrant, and HMAC auth types. Token cache with Arc<RwLock> for thread-safe async refresh. Form-encoded POST to token endpoints with 60s early-refresh buffer.

• SMTP email transport (hub-net/mail.rs): MailClient::send() via lettre with multipart/alternative (text + HTML), TLS/STARTTLS, full to/cc/bcc support. email.send operation registered with JSON Schema at startup.

• Path parameter substitution (hub-core/dispatch.rs): Replaces {param} and {+param} (RFC 6570 reserved expansion) in URL templates, removes consumed params from args, defaults {userId} to me. Detects absolute URLs from Discovery specs to prevent double base-URL prepend.

• Persistent MCP state (connector-hub/mcp.rs): Arc<Dispatcher/AuthStore/Policy/NetClient> built once at server startup instead of reconstructed per request.

• Transport routing: Transport enum (Http/Smtp) on operations; dispatcher routes SMTP operations to execute_smtp() bypassing the HTTP path entirely.

152 operations total (79 Gmail, 72 Hetzner, 1 email.send), 26 tests passing.

Validation

• Formatting and lint checks pass.
• Type checks pass.
• Unit tests pass (26 tests — 6 path substitution, 12 SSRF/redaction, 6 policy/ledger, 2 spec parsing).
• Integration tests were run, or are not applicable.
• Documentation and data-source references are updated.

Security and operations

• No credentials, tokens, customer data, or generated .env files are included.
• New network calls have timeouts, bounded retries, validation, and rate-limit handling.
• Breaking changes, deployment steps, and rollback steps are documented.

---

Generated by Claude Code