better_auth 0.3.0 → 0.5.0

data/lib/better_auth/plugins/mcp/registration.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module MCP
+      module_function
+
+      def register_client(ctx, config)
+        set_cors_headers(ctx)
+        body = OAuthProtocol.stringify_keys(ctx.body)
+        body["token_endpoint_auth_method"] ||= "none"
+        body["grant_types"] ||= [OAuthProtocol::AUTH_CODE_GRANT, OAuthProtocol::REFRESH_GRANT]
+        body["response_types"] ||= ["code"]
+        body["require_pkce"] = true unless body.key?("require_pkce") || body.key?("requirePKCE")
+
+        OAuthProtocol.create_client(
+          ctx,
+          model: "oauthClient",
+          body: body,
+          default_auth_method: "none",
+          store_client_secret: config[:store_client_secret],
+          default_scopes: config[:scopes],
+          allowed_scopes: config[:scopes],
+          prefix: config[:prefix],
+          dynamic_registration: true,
+          strip_client_metadata: true
+        )
+      end
+    end
+  end
+end

data/lib/better_auth/plugins/mcp/resource_handler.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module MCP
+      module ResourceHandler
+        module_function
+
+        def with_mcp_auth(app, resource_metadata_url:, auth: nil, resource_metadata_mappings: {})
+          lambda do |env|
+            authorization = env["HTTP_AUTHORIZATION"].to_s
+            return unauthorized(resource_metadata_url) unless authorization.start_with?("Bearer ")
+
+            session = auth&.api&.get_mcp_session(headers: {"authorization" => authorization})
+            return unauthorized(resource_metadata_url) unless session
+
+            env["better_auth.mcp_session"] = session
+            app.call(env)
+          rescue APIError
+            unauthorized(resource_metadata_url)
+          end
+        end
+
+        def unauthorized(resource_metadata_url)
+          [
+            401,
+            {
+              "www-authenticate" => %(Bearer resource_metadata="#{resource_metadata_url}"),
+              "access-control-expose-headers" => "WWW-Authenticate"
+            },
+            ["unauthorized"]
+          ]
+        end
+      end
+    end
+  end
+end

data/lib/better_auth/plugins/mcp/schema.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module MCP
+      module_function
+
+      def schema
+        {
+          oauthClient: {
+            modelName: "oauthClient",
+            fields: {
+              clientId: {type: "string", unique: true, required: true},
+              clientSecret: {type: "string", required: false},
+              disabled: {type: "boolean", default_value: false, required: false},
+              skipConsent: {type: "boolean", required: false},
+              enableEndSession: {type: "boolean", required: false},
+              clientSecretExpiresAt: {type: "number", required: false},
+              scopes: {type: "string[]", required: false},
+              userId: {type: "string", required: false},
+              createdAt: {type: "date", required: true, default_value: -> { Time.now }},
+              updatedAt: {type: "date", required: true, default_value: -> { Time.now }, on_update: -> { Time.now }},
+              name: {type: "string", required: false},
+              uri: {type: "string", required: false},
+              icon: {type: "string", required: false},
+              contacts: {type: "string[]", required: false},
+              tos: {type: "string", required: false},
+              policy: {type: "string", required: false},
+              softwareId: {type: "string", required: false},
+              softwareVersion: {type: "string", required: false},
+              softwareStatement: {type: "string", required: false},
+              redirectUris: {type: "string[]", required: true},
+              postLogoutRedirectUris: {type: "string[]", required: false},
+              tokenEndpointAuthMethod: {type: "string", required: false},
+              grantTypes: {type: "string[]", required: false},
+              responseTypes: {type: "string[]", required: false},
+              public: {type: "boolean", required: false},
+              type: {type: "string", required: false},
+              requirePKCE: {type: "boolean", required: false},
+              subjectType: {type: "string", required: false},
+              referenceId: {type: "string", required: false},
+              metadata: {type: "json", required: false}
+            }
+          },
+          oauthRefreshToken: {
+            fields: {
+              token: {type: "string", required: true},
+              clientId: {type: "string", required: true},
+              sessionId: {type: "string", required: false},
+              userId: {type: "string", required: false},
+              referenceId: {type: "string", required: false},
+              authTime: {type: "date", required: false},
+              expiresAt: {type: "date", required: false},
+              createdAt: {type: "date", required: true, default_value: -> { Time.now }},
+              revoked: {type: "date", required: false},
+              scopes: {type: "string[]", required: true}
+            }
+          },
+          oauthAccessToken: {
+            modelName: "oauthAccessToken",
+            fields: {
+              token: {type: "string", unique: true, required: true},
+              expiresAt: {type: "date", required: true},
+              clientId: {type: "string", required: true},
+              userId: {type: "string", required: false},
+              sessionId: {type: "string", required: false},
+              scopes: {type: "string[]", required: true},
+              revoked: {type: "date", required: false},
+              referenceId: {type: "string", required: false},
+              authTime: {type: "date", required: false},
+              refreshId: {type: "string", required: false},
+              createdAt: {type: "date", required: true, default_value: -> { Time.now }},
+              updatedAt: {type: "date", required: true, default_value: -> { Time.now }, on_update: -> { Time.now }}
+            }
+          },
+          oauthConsent: {
+            modelName: "oauthConsent",
+            fields: {
+              clientId: {type: "string", required: true},
+              userId: {type: "string", required: false},
+              referenceId: {type: "string", required: false},
+              scopes: {type: "string[]", required: true},
+              createdAt: {type: "date", required: true, default_value: -> { Time.now }},
+              updatedAt: {type: "date", required: true, default_value: -> { Time.now }, on_update: -> { Time.now }}
+            }
+          }
+        }
+      end
+    end
+  end
+end

data/lib/better_auth/plugins/mcp/token.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module MCP
+      module_function
+
+      def token(ctx, config)
+        set_cors_headers(ctx)
+        body = OAuthProtocol.stringify_keys(ctx.body)
+        client = OAuthProtocol.authenticate_client!(ctx, "oauthClient", store_client_secret: config[:store_client_secret], prefix: config[:prefix])
+        audience = validate_resource!(config, body)
+
+        case body["grant_type"]
+        when OAuthProtocol::AUTH_CODE_GRANT
+          code = OAuthProtocol.consume_code!(
+            config[:store],
+            body["code"],
+            client_id: OAuthProtocol.stringify_keys(client)["clientId"],
+            redirect_uri: body["redirect_uri"],
+            code_verifier: body["code_verifier"]
+          )
+          OAuthProtocol.issue_tokens(
+            ctx,
+            config[:store],
+            model: "oauthAccessToken",
+            client: client,
+            session: code[:session],
+            scopes: code[:scopes],
+            include_refresh: code[:scopes].include?("offline_access"),
+            issuer: validate_issuer_url(OAuthProtocol.issuer(ctx)),
+            prefix: config[:prefix],
+            refresh_token_expires_in: config[:refresh_token_expires_in],
+            access_token_expires_in: config[:access_token_expires_in],
+            audience: audience,
+            grant_type: OAuthProtocol::AUTH_CODE_GRANT,
+            jwt_access_token: !audience.nil?,
+            nonce: code[:nonce],
+            auth_time: code[:auth_time],
+            reference_id: code[:reference_id],
+            filter_id_token_claims_by_scope: true
+          )
+        when OAuthProtocol::REFRESH_GRANT
+          OAuthProtocol.refresh_tokens(
+            ctx,
+            config[:store],
+            model: "oauthAccessToken",
+            client: client,
+            refresh_token: body["refresh_token"],
+            scopes: body["scope"],
+            issuer: validate_issuer_url(OAuthProtocol.issuer(ctx)),
+            prefix: config[:prefix],
+            refresh_token_expires_in: config[:refresh_token_expires_in],
+            access_token_expires_in: config[:access_token_expires_in],
+            audience: audience,
+            jwt_access_token: !audience.nil?,
+            filter_id_token_claims_by_scope: true
+          )
+        else
+          raise APIError.new("BAD_REQUEST", message: "unsupported_grant_type")
+        end
+      end
+
+      def validate_resource!(config, body)
+        resources = Array(body["resource"]).compact.map(&:to_s)
+        return nil if resources.empty?
+
+        valid = Array(config[:valid_audiences]).map(&:to_s)
+        resources.each do |resource|
+          raise APIError.new("BAD_REQUEST", message: "requested resource invalid") unless valid.empty? || valid.include?(resource)
+        end
+        (resources.length == 1) ? resources.first : resources
+      end
+
+      def introspect(ctx, config)
+        OAuthProtocol.authenticate_client!(ctx, "oauthClient", store_client_secret: config[:store_client_secret], prefix: config[:prefix])
+        body = OAuthProtocol.stringify_keys(ctx.body)
+        token_record = OAuthProtocol.find_token_by_hint(config[:store], body["token"].to_s, body["token_type_hint"], prefix: config[:prefix])
+        return inactive_token_response if token_record.nil? || token_record["revoked"] || (token_record["expiresAt"] && token_record["expiresAt"] <= Time.now)
+
+        {
+          active: true,
+          client_id: token_record["clientId"],
+          scope: OAuthProtocol.scope_string(token_record["scope"] || token_record["scopes"]),
+          sub: token_record["subject"] || token_record.dig("user", "id"),
+          iss: token_record["issuer"],
+          iat: token_record["issuedAt"]&.to_i,
+          exp: token_record["expiresAt"]&.to_i,
+          sid: token_record["sessionId"],
+          aud: token_record["audience"]
+        }.compact
+      end
+
+      def revoke(ctx, config)
+        OAuthProtocol.authenticate_client!(ctx, "oauthClient", store_client_secret: config[:store_client_secret], prefix: config[:prefix])
+        body = OAuthProtocol.stringify_keys(ctx.body)
+        if (token_record = OAuthProtocol.find_token_by_hint(config[:store], body["token"].to_s, body["token_type_hint"], prefix: config[:prefix]))
+          token_record["revoked"] = Time.now
+        end
+        {revoked: true}
+      end
+
+      def inactive_token_response
+        {active: false}
+      end
+    end
+  end
+end

data/lib/better_auth/plugins/mcp/userinfo.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "jwt"
+
+module BetterAuth
+  module Plugins
+    module MCP
+      module_function
+
+      def userinfo(ctx, config)
+        OAuthProtocol.userinfo(config[:store], ctx.headers["authorization"], prefix: config[:prefix], jwt_secret: ctx.context.secret)
+      end
+
+      def session_from_token(ctx, config)
+        authorization = ctx.headers["authorization"].to_s
+        token_value = authorization.start_with?("Bearer ") ? authorization.delete_prefix("Bearer ").strip : authorization.strip
+        return nil if token_value.empty?
+
+        token_record = OAuthProtocol.token_record(config[:store], token_value, prefix: config[:prefix])
+        return token_record if token_record
+
+        payload = ::JWT.decode(token_value, ctx.context.secret, true, algorithm: "HS256").first
+        {
+          "clientId" => payload["azp"],
+          "userId" => payload["sub"],
+          "sessionId" => payload["sid"],
+          "scopes" => OAuthProtocol.parse_scopes(payload["scope"]),
+          "audience" => payload["aud"],
+          "subject" => payload["sub"],
+          "expiresAt" => payload["exp"] ? Time.at(payload["exp"].to_i) : nil
+        }.compact
+      rescue ::JWT::DecodeError
+        nil
+      end
+    end
+  end
+end