administrate-mcp 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 4da1e224450ced4f0f0e209279bf8f07e3e863b8cc54d53deb20071e09c162f5
+  data.tar.gz: 7299ecaabb67efa26432087c689d6291d7b839692a97855997f0a5aa94ea8e5c
+SHA512:
+  metadata.gz: 52016172bf5d81384da02d845c2a7e491ad88859b414ce20b1732804deeff46f930a4df8e4d73b254721c31c39fe8bf2907cda7e56c32dd7b1728641993025ae
+  data.tar.gz: 78e0e4ac8f02ce53a3c4603d5bcb8d95ace6976192fed36519a0df092fa2a0b7bec2ac1fc071e3fcc2862e60f81195377943bd2c7693060c488d5ea4b4548a5a

data/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project
+follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). While the major version is 0, a
+minor release may change behaviour a host depends on; the entry says so when it does.
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-22
+
+### Added
+
+- Rails engine exposing Administrate dashboards over the Model Context Protocol.
+- Three generic tools built from a host's dashboards: `admin_resource_list_resources`,
+  `admin_resource_list`, `admin_resource_show`.
+- `report_mcp_improvement`, a feedback tool so users can report what the server got wrong, stored
+  through `Administrate::MCP::Feedback` and cleaned up with `CleanOldFeedbacks`.
+- Two optional Sidekiq tools, `sidekiq_stats` and `sidekiq_retries`, backed by a host-supplied
+  `sidekiq_stats_provider`.
+- `mcp_action`, a dashboard macro that publishes a host-declared write action as its own tool.
+- API key authentication: tokens are generated with a configurable prefix
+  (`api_key_token_prefix`), stored only as a SHA-256 digest, and default to read-only unless
+  granted write access.
+- A complete OAuth 2.1 authorization server: Dynamic Client Registration, a consent screen, PKCE,
+  refresh tokens, and the discovery documents clients need to find all of it. Access tokens last a
+  week, authorization codes ten minutes, and refreshing revokes the old token.
+- `config.oauth = false` to turn the built-in OAuth server off for hosts where something in front
+  of the application, such as Cloudflare Access managed OAuth, already runs one.
+- `config.identity_fallback`, an extension point consulted only when no credential the engine
+  issued matches, for hosts that authenticate the caller before the request reaches Rails.
+- `Administrate::MCP::CloudflareAccess`, a verifier for the assertion Cloudflare Access attaches to
+  a request, ready to use as an `identity_fallback`.
+- `config.admin_active`, checked on every authenticated call, so a host can revoke every credential
+  an admin holds by deactivating the admin in one place.
+- Two authorization adapters, `Authorization::Permissive` and `Authorization::Pundit`, plus
+  per-tool role gating through `requires_roles` and `config.default_required_roles`.
+- `FastSearch`, a subclass of `Administrate::Search` that searches exactly by default, with `*` as
+  the only wildcard, and casts every compared column to text so a plain word searched against a
+  uuid column returns no rows instead of raising.
+- Dashboard-level MCP declarations: `MCP_BASE_SCOPE`, `MCP_SKIPPED_ATTRIBUTES`, `mcp_value` on a
+  field, and collection filters.
+- `Administrate::MCP::RackAttack.throttles`, a set of recommended Rack::Attack throttles for the
+  OAuth endpoints, for hosts that already depend on rack-attack.
+- Migrations for `administrate_mcp_api_keys`, `administrate_mcp_feedbacks`,
+  `administrate_mcp_oauth_applications`, `administrate_mcp_oauth_access_grants` and
+  `administrate_mcp_oauth_access_tokens`, all using uuid primary keys, an indexed but
+  unconstrained uuid `admin_id`, and array columns for `redirect_uris` and `grant_types`.
+
+### Security
+
+- OAuth access tokens, refresh tokens and authorization codes are now stored as SHA-256 digests
+  (`token_digest`, `refresh_token_digest`) instead of plaintext, matching how API keys were already
+  stored. The plaintext is handed to the caller once, when it is issued, and is not recoverable
+  afterwards. This changes the schema of the authorization tables migration, so installations that
+  took the gem from git before 0.1.0 must reinstall its migrations rather than migrate
+  incrementally.
+
+[Unreleased]: https://github.com/sorare/administrate-mcp/compare/v0.1.0...HEAD
+[0.1.0]: https://github.com/sorare/administrate-mcp/releases/tag/v0.1.0

data/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sorare
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,267 @@
+# administrate-mcp
+
+A Rails engine that exposes [Administrate](https://github.com/thoughtbot/administrate) dashboards
+over the [Model Context Protocol](https://modelcontextprotocol.io), so an MCP client such as Claude
+can list, show and search your admin data, and run the write actions you opt in, with the same
+permissions the admin UI enforces.
+
+[![Gem Version](https://img.shields.io/gem/v/administrate-mcp.svg)](https://rubygems.org/gems/administrate-mcp)
+[![CI](https://github.com/sorare/administrate-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/sorare/administrate-mcp/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE.txt)
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%203.2-CC342D.svg)](administrate-mcp.gemspec)
+
+## Table of contents
+
+- [Why](#why)
+- [Features](#features)
+- [Demo](#demo)
+- [Requirements](#requirements)
+- [Installation](#installation)
+- [Quick start](#quick-start)
+- [Configuration](#configuration)
+- [Routes](#routes)
+- [Dashboard declarations](#dashboard-declarations)
+- [Authentication](#authentication)
+- [OAuth](#oauth)
+- [Rate limiting](#rate-limiting)
+- [Admin integration](#admin-integration)
+- [Development](#development)
+- [Security](#security)
+- [Contributing](#contributing)
+- [Changelog](#changelog)
+- [Licence](#licence)
+
+## Why
+
+Administrate dashboards are built for a person clicking through a browser. This gem reads the same
+dashboard declarations, the same Pundit policies and the same scoped queries, and publishes them as
+MCP tools, so an LLM client can answer questions about your admin data and, where you allow it, act
+on it, without a second implementation of your authorization rules. Nothing in the engine knows
+about your application; everything host-specific goes through `Administrate::MCP.configure`.
+
+## Features
+
+- Three generic tools built from every Administrate dashboard: `admin_resource_list_resources`,
+  `admin_resource_list`, `admin_resource_show`.
+- Write actions declared per dashboard with `mcp_action`, each published as its own tool, gated by
+  the `write` scope (an API key with write access, or an OAuth token granted it) and the resource's own authorization predicate on the loaded record.
+- Three ways to authenticate a caller: API keys stored as a digest, an external identity provider
+  through `identity_fallback` (a Cloudflare Access verifier ships with the gem), and an optional
+  built-in OAuth 2.1 server with Dynamic Client Registration, PKCE and refresh tokens, on by default
+  and disabled with one setting.
+- Pundit-aware authorization by default: reads run through the same `index?` and `show?` predicates
+  as the admin UI, so a resource an admin cannot see in the browser is not exposed over MCP either.
+- Search, filters and field selection built from the dashboard's own declarations, plus foreign key
+  filters that need no declaration at all.
+- A feedback tool, `report_mcp_improvement`, so users can report what the server got wrong, and a
+  housekeeping method to clean up old feedback records.
+- Optional Sidekiq introspection tools, `sidekiq_stats` and `sidekiq_retries`, wired to a stats
+  provider object you supply.
+- No reference to a constant it does not own: field serializers are keyed on class names, dashboards
+  opt in per attribute, and every host-specific behaviour is configuration, not a subclass.
+
+## Demo
+
+A `tools/list` call against the JSON-RPC endpoint, authenticated with an API key:
+
+```sh
+curl https://admin-mcp.example.com/ \
+  -H 'Authorization: Bearer amcp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: application/json, text/event-stream' \
+  -d '{"jsonrpc": "2.0", "method": "tools/list", "id": 1}'
+```
+
+returns the generic tools built from your dashboards, plus any `mcp_action` you declared, among
+them:
+
+```json
+{
+  "result": {
+    "tools": [
+      { "name": "admin_resource_list_resources" },
+      { "name": "admin_resource_list" },
+      { "name": "admin_resource_show" },
+      { "name": "report_mcp_improvement" }
+    ]
+  }
+}
+```
+
+A `tools/call` against `admin_resource_list`, restricted to three fields:
+
+```json
+{
+  "jsonrpc": "2.0",
+  "method": "tools/call",
+  "id": 2,
+  "params": {
+    "name": "admin_resource_list",
+    "arguments": { "resource": "widget", "fields": ["id", "name", "status"] }
+  }
+}
+```
+
+returns columns, rows and pagination metadata built from the dashboard's `COLLECTION_ATTRIBUTES`:
+
+```json
+{
+  "columns": ["url", "id", "name", "status"],
+  "rows": [
+    [
+      "https://admin.example.com/admin/widgets/1",
+      "1",
+      "Turbo encabulator",
+      "published"
+    ],
+    [
+      "https://admin.example.com/admin/widgets/2",
+      "2",
+      "Flux capacitor",
+      "draft"
+    ]
+  ],
+  "meta": { "page": 1, "per_page": 10, "total_count": 2, "total_pages": 1 }
+}
+```
+
+## Requirements
+
+- Ruby 3.2 or newer.
+- Rails 8.1 or newer.
+- Administrate 1.0.0.beta3 or newer, below 2.0 (the search implementation calls methods
+  `Administrate::Search` treats as internal, see [Search](docs/dashboards.md#search)).
+- PostgreSQL. The migrations create uuid primary keys defaulted with `gen_random_uuid()` and store
+  the OAuth `redirect_uris` and `grant_types` as array columns.
+
+## Installation
+
+```ruby
+# Gemfile
+gem 'administrate-mcp'
+```
+
+Copy the migrations and run them:
+
+```sh
+bundle install
+bin/rails administrate_mcp:install:migrations
+bin/rails db:migrate
+```
+
+The tables are `administrate_mcp_api_keys`, `administrate_mcp_feedbacks`,
+`administrate_mcp_oauth_applications`, `administrate_mcp_oauth_access_grants` and
+`administrate_mcp_oauth_access_tokens`. They use uuid primary keys and a uuid `admin_id` column
+that is indexed but carries no foreign key constraint, so the engine works with any admin table.
+
+## Quick start
+
+The smallest configuration that works. Save it as `config/initializers/administrate_mcp.rb`; it
+must run before the engine's models load, because the `admin` association reads `admin_class_name`:
+
+```ruby
+Administrate::MCP.configure do |c|
+  c.admin_class_name = 'Administrator'
+  c.current_admin = ->(controller) { controller.send(:warden)&.authenticate(scope: :administrator) }
+  c.issuer = 'https://admin-mcp.example.com'
+  c.admin_origin = 'https://admin.example.com'
+end
+```
+
+Then draw the routes, split across the MCP origin and the admin origin (see [Routes](#routes) for
+why):
+
+```ruby
+# config/routes.rb
+Rails.application.routes.draw do
+  constraints ->(request) { request.subdomain == 'admin-mcp' } do
+    Administrate::MCP::Routes.draw_mcp_origin(self)
+  end
+
+  constraints subdomain: 'admin' do
+    Administrate::MCP::Routes.draw_admin_origin(self)
+  end
+end
+```
+
+This draws a full OAuth 2.1 server by default (see [OAuth](#oauth) to turn it off) and grants every
+authenticated admin access to every dashboard until you set `c.authorization`. For the full picture,
+including hooks, authorization adapters, field serializers and identity fallback, see the reference
+sections below.
+
+## Configuration
+
+The full `Configuration` object, the settings table, the authorization adapters, and how to
+register, skip or reclassify a field class: [docs/configuration.md](docs/configuration.md).
+
+## Routes
+
+Why the consent screen and the JSON-RPC endpoint are drawn on separate origins, and what each route
+helper adds: [docs/routes.md](docs/routes.md).
+
+## Dashboard declarations
+
+`MCP_DESCRIPTION`, `MCP_BASE_SCOPE`, `MCP_SKIPPED_ATTRIBUTES`, `MCP_EXPOSED`, `COLLECTION_FILTERS`
+and `mcp_action`, the constants and macro that turn one dashboard into an MCP resource with its own
+readable fields and writable actions: [docs/dashboards.md](docs/dashboards.md).
+
+## Authentication
+
+How a request is authenticated (API key, then OAuth token, then `identity_fallback`), how to issue
+and rotate API keys, and the `identity_fallback` recipe for an identity resolved in front of the
+application: [docs/authentication.md](docs/authentication.md). A Cloudflare Access verifier ships
+with the gem for hosts that run edge-managed OAuth in front of the application:
+[docs/authentication.md#identity-fallback](docs/authentication.md#identity-fallback).
+
+## OAuth
+
+The built-in OAuth 2.1 server, what turning it off with `c.oauth = false` changes, and when a host
+should: [docs/oauth.md](docs/oauth.md).
+
+## Rate limiting
+
+The rack-attack throttles recommended for the OAuth endpoints, and the helper that registers them
+for you: [docs/oauth.md#rate-limiting](docs/oauth.md#rate-limiting).
+
+## Admin integration
+
+Exposing the engine's own tables (API keys, feedback) in your host admin, customising the consent
+screen, and cleaning up old feedback: [docs/admin-integration.md](docs/admin-integration.md).
+
+## Development
+
+```sh
+bundle install
+bundle exec rspec
+bundle exec rubocop
+```
+
+Needs a reachable PostgreSQL server; the test suite creates its own database on first run. See
+[docs/development.md](docs/development.md) for the dummy application and the Postgres environment
+variables.
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for how to report a vulnerability.
+
+The JSON-RPC endpoint authenticates by bearer token only. It never falls back to a session cookie,
+so a browser signed into the admin UI cannot drive the protocol endpoint. API keys, OAuth access and
+refresh tokens, and OAuth authorization codes are all stored as SHA-256 digests, never in plaintext.
+The Cloudflare Access verifier fails closed: a blank team domain or audience makes it refuse every
+request rather than admit an unverified one. A credential does not outlive the admin who holds it,
+because `admin_active` is checked on every call, whether the credential is an API key, an OAuth
+token, or an identity resolved through `identity_fallback`.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub. See [CONTRIBUTING.md](CONTRIBUTING.md) for the
+development workflow, and [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) for how we expect people to treat
+each other in this project's spaces.
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md) for a history of releases.
+
+## Licence
+
+MIT. See [LICENSE.txt](LICENSE.txt). Copyright Sorare.

data/app/controllers/administrate/mcp/json_rpc_controller.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module Administrate
+  module MCP
+    # Streamable HTTP endpoint for MCP JSON-RPC requests.
+    # Handles POST (JSON-RPC), GET (SSE, rejected in stateless mode), and DELETE (session close).
+    #
+    # Authentication is bearer-token only. It inherits from ActionController::API so no session or
+    # cookie ever reaches it: hosts share a session cookie across sibling subdomains, and a browser
+    # that is signed into the admin UI must not thereby be able to drive the protocol endpoint.
+    class JsonRpcController < ActionController::API
+      AUTHORIZATION_ERROR_CODE = -32_003
+
+      before_action :authenticate_admin!
+
+      def handle
+        server, server_context = setup_server
+        status, headers, body = dispatch_request(server)
+
+        if (authz_error = server_context[:authorization_errors].first)
+          render_authorization_error(authz_error, extract_jsonrpc_id(body))
+          return
+        end
+
+        self.status = status
+        headers.each { |key, value| response.headers[key] = value }
+        self.response_body = body
+      end
+
+      private
+
+      def dispatch_request(server)
+        rack_request = Rack::Request.new(request.env)
+        server.transport.handle_request(rack_request)
+      end
+
+      def setup_server
+        server_context = { admin: @identity.admin, scopes: @identity.scopes }
+        [ServerBuilder.build(server_context:), server_context]
+      end
+
+      def authenticate_admin!
+        @identity = Authentication.authenticate!(request)
+      rescue Authentication::Error => e
+        response.headers['X-Auth-Error'] = e.auth_error_type
+        response.headers['WWW-Authenticate'] = www_authenticate_header
+        render json: {
+                 jsonrpc: '2.0',
+                 error: {
+                   code: e.jsonrpc_error_code,
+                   message: e.message
+                 },
+                 id: nil
+               },
+               status: :unauthorized
+      end
+
+      def www_authenticate_header
+        issuer = Administrate::MCP.config.issuer_for(request)
+        "Bearer resource_metadata=\"#{issuer}/.well-known/oauth-protected-resource\""
+      end
+
+      def render_authorization_error(message, jsonrpc_id)
+        response.headers['X-Auth-Error'] = 'forbidden'
+        render json: {
+                 jsonrpc: '2.0',
+                 error: {
+                   code: AUTHORIZATION_ERROR_CODE,
+                   message:
+                 },
+                 id: jsonrpc_id
+               },
+               status: :forbidden
+      end
+
+      def extract_jsonrpc_id(body)
+        JSON.parse(body.first)['id']
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/app/controllers/administrate/mcp/o_auth_controller.rb

@@ -0,0 +1,199 @@
+# frozen_string_literal: true
+
+module Administrate
+  module MCP
+    # OAuth 2.1 endpoints for MCP authentication.
+    class OAuthController < ActionController::Base
+      skip_forgery_protection only: %i[resource_metadata server_metadata register token]
+      before_action :authenticate_admin!, only: %i[authorize approve]
+
+      def resource_metadata
+        render json: {
+          resource: "#{mcp_origin}/",
+          authorization_servers: [mcp_origin],
+          bearer_methods_supported: ['header']
+        }
+      end
+
+      def server_metadata
+        render json: {
+          issuer: mcp_origin,
+          authorization_endpoint: "#{admin_origin}#{Routes::AUTHORIZE_PATH}",
+          token_endpoint: "#{mcp_origin}/oauth/token",
+          registration_endpoint: "#{mcp_origin}/oauth/register",
+          response_types_supported: ['code'],
+          grant_types_supported: %w[authorization_code refresh_token],
+          code_challenge_methods_supported: ['S256'],
+          token_endpoint_auth_methods_supported: ['none']
+        }
+      end
+
+      def register
+        application = build_application
+        return render(json: registration_error(application), status: :bad_request) unless application.save
+
+        render json: {
+                 client_id: application.client_id,
+                 client_name: application.name,
+                 redirect_uris: application.redirect_uris,
+                 grant_types: application.grant_types
+               },
+               status: :created
+      end
+
+      def authorize
+        @application = OAuthApplication.find_by(client_id: params[:client_id])
+        error =
+          oauth_service.validate_authorize_params(
+            application: @application,
+            redirect_uri: params[:redirect_uri],
+            code_challenge_method: params[:code_challenge_method],
+            code_challenge: params[:code_challenge]
+          )
+        return render plain: error, status: :bad_request if error
+
+        assign_consent_details
+        render 'administrate/mcp/o_auth/authorize', layout: false
+      end
+
+      def approve
+        application = find_application!
+        return unless application
+
+        redirect_uri = validated_redirect_uri!(application)
+        return unless redirect_uri
+
+        if params[:deny].present?
+          return redirect_to callback_url(redirect_uri, error: 'access_denied'), allow_other_host: true
+        end
+
+        grant = create_access_grant(application, redirect_uri)
+        redirect_to callback_url(redirect_uri, code: grant.plaintext_token), allow_other_host: true
+      end
+
+      def token
+        case params[:grant_type]
+        when 'authorization_code'
+          handle_authorization_code
+        when 'refresh_token'
+          handle_refresh_token
+        else
+          render json: { error: 'unsupported_grant_type' }, status: :bad_request
+        end
+      end
+
+      private
+
+      def build_application
+        OAuthApplication.new(
+          client_id: OAuthApplication.generate_client_id,
+          name: register_params[:client_name] || Administrate::MCP.config.default_client_name,
+          redirect_uris: register_params[:redirect_uris] || []
+        )
+      end
+
+      def registration_error(application)
+        { error: 'invalid_client_metadata', error_description: application.errors.full_messages.join(', ') }
+      end
+
+      def handle_authorization_code
+        result =
+          oauth_service.exchange_authorization_code(
+            code: params[:code],
+            code_verifier: params[:code_verifier],
+            redirect_uri: params[:redirect_uri]
+          )
+        render_token_result(result)
+      end
+
+      def handle_refresh_token
+        result = oauth_service.exchange_refresh_token(refresh_token: params[:refresh_token])
+        render_token_result(result)
+      end
+
+      def render_token_result(result)
+        if result.success?
+          render json: result.data
+        else
+          body = { error: result.error }
+          body[:error_description] = result.error_description if result.error_description
+          render json: body, status: :bad_request
+        end
+      end
+
+      def create_access_grant(application, redirect_uri)
+        OAuthAccessGrant.issue(
+          admin: current_admin,
+          application:,
+          expires_in: OAuthAccessGrant::DEFAULT_EXPIRES_IN,
+          redirect_uri:,
+          code_challenge: params[:code_challenge],
+          code_challenge_method: params[:code_challenge_method].presence || 'S256',
+          scopes: params[:scope].to_s
+        )
+      end
+
+      def find_application!
+        application = OAuthApplication.find_by(client_id: params[:client_id])
+        render(plain: 'Unknown client_id', status: :bad_request) unless application
+        application
+      end
+
+      def validated_redirect_uri!(application)
+        uri = params[:redirect_uri]
+        return uri if oauth_service.valid_redirect_uri?(application, uri)
+
+        render(plain: 'Invalid redirect_uri', status: :bad_request)
+        nil
+      end
+
+      # A registered callback may already carry a query string, so the response parameters are
+      # appended to it rather than started with a second `?`.
+      def callback_url(redirect_uri, **response_params)
+        uri = URI.parse(redirect_uri)
+        existing = URI.decode_www_form(uri.query.to_s)
+        uri.query = URI.encode_www_form(existing + response_params.merge(state: params[:state].to_s).to_a)
+        uri.to_s
+      end
+
+      def assign_consent_details
+        @redirect_uri = params[:redirect_uri]
+        @scopes = params[:scope].to_s.split
+        @redirect_host = URI.parse(@redirect_uri.to_s).host
+      rescue URI::InvalidURIError
+        @redirect_host = nil
+      end
+
+      def register_params
+        params.permit(:client_name, redirect_uris: [])
+      end
+
+      def oauth_service
+        @oauth_service ||= OAuthService.new
+      end
+
+      def authenticate_admin!
+        return if current_admin
+
+        sign_in = Administrate::MCP.config.sign_in
+        return sign_in.call(self) if sign_in
+
+        render plain: 'Authentication required', status: :unauthorized
+      end
+
+      def current_admin
+        return @current_admin if defined?(@current_admin)
+
+        @current_admin = Administrate::MCP.config.current_admin.call(self)
+      end
+
+      def mcp_origin
+        Administrate::MCP.config.issuer_for(request)
+      end
+
+      def admin_origin
+        Administrate::MCP.config.admin_origin_for(request)
+      end
+    end
+  end
+end